v0.1.1

AgentAPI Doctor v0.1.1

Summary

v0.1.1 is a focused diagnostic patch for the supported AgentAPI Doctor CLI.
Terminal exactly-once failures now show a bounded ordered trace of the observed
terminal markers, including the logical SSE event index, so a result such as
Observed: 2 can be explained as response.completed followed by [DONE].

The release also freezes an offline OpenAI Responses boundary case for
response.incomplete with incomplete_details.reason=max_output_tokens.
Complete and missing provider usage are both covered through normal
four-request product runs; no live-provider request or fifth Quick Check was
added.

Compatibility and breaking changes

There are no changes to commands, configuration, schemas, report-envelope
versions, exit codes, request count, request budgets, or built-in candidate
pack/profile identities. Existing v0.1.0 baselines remain comparable.

For a terminal_event_count failure, an assertion's schema-permitted
observed value changes from a number to an object containing
terminal_count, framing_complete, terminal_trace, and
trace_entries_omitted. Consumers that inspect this diagnostic field directly
must accept the structured value. Because finding fingerprints bind observed
evidence, a rerun of an existing terminal-count failure receives a new
fingerprint; verdicts and unrelated findings are unchanged.

Migration

No configuration, baseline, or stored-report migration is required. Install
the v0.1.1 binary and rerun the affected check to obtain the richer terminal
trace. Automation that reads AssertionResult.observed for
terminal_event_count should switch from a numeric assumption to the named
object fields above.

Do not relabel or edit prior evidence. Historical v0.1.0 reports remain
readable and retain their original fingerprints and observations.

Known issues

• The built-in protocol interpretations remain
  0.1.0-candidate.3 / pending_review; this patch improves evidence but does
  not turn a bounded Quick Check into vendor certification.
• Under the current candidate interpretation, a Responses
  response.completed followed by [DONE] is reported as two terminal
  markers. The new trace explains that result but does not attribute it to an
  endpoint, proxy, SDK, or normalization layer.
• OpenAI Chat and Responses terminal-status checks request 512 output tokens;
  structural checks remain at 64. These provider-side limits are not billing
  ceilings, and an honest output-limit result remains INCONCLUSIVE.
• Provider usage is optional diagnostic evidence. Missing usage remains
  unknown and does not become a target failure or an observed zero. Doctor
  does not perform price calculations.
• content_filter fixture taxonomy is unchanged in this patch pending a
  separately reviewed terminal-outcome contract.

Support window

Support begins when the immutable v0.1.1 GitHub Release becomes public and
ends on 2026-10-14 or when a newer 0.1.x release supersedes it, whichever
comes first. Publication supersedes the v0.1.0 support window; its immutable
artifacts remain available for historical reproduction.

Support is best-effort and covers security and critical Doctor defects. It does
not establish support for the experimental Registry, authored packs, generic
drivers, package-manager candidates, or a hosted service.

Verification

The exact immutable v0.1.1 tag binds these notes to a protected-main
commit. The release workflow reruns the complete offline product gate, race
tests, the locked OpenAI Python SDK cases, release-tool checks, archive smoke
tests, and public post-publication verification.

Six native archives must report version 0.1.1, the tagged commit, and Go
1.26.5. Checksums, the SPDX SBOM, GitHub build provenance, and the keyless
Sigstore bundle bind the nine-file allowlisted release asset set. No external
security review, vendor endorsement, or arbitrary-endpoint compatibility claim
is implied by those checks.

v0.1.0

AgentAPI Doctor v0.1.0

Summary

v0.1.0 is the first supported AgentAPI Doctor distribution. It publishes six
native Doctor archives for Linux, macOS, and Windows on amd64 and arm64, plus
checksums, an SPDX SBOM, a Sigstore bundle, and GitHub build provenance.

Doctor runs four bounded raw-wire checks against one explicitly authorized
OpenAI Chat, OpenAI Responses, or Anthropic Messages endpoint. It persists
redacted local evidence and renders terminal, JSON, JUnit, SARIF, Markdown, or
offline HTML reports. This stable distribution is not a vendor certification:
the built-in protocol interpretations remain 0.1.0-candidate.3 and pending
independent source review.

Compatibility and breaking changes

The supported 0.1.x command workflow, exit-code meanings, CLI result envelope,
and release archive naming are recorded in cli/spec.yaml, the public schemas,
and schemas/migration-floor.yaml. Terminal reports now say CHECKS PASSED,
CHECKS FAILED, CHECKS PASSED WITH WARNINGS, or CHECKS INCONCLUSIVE instead
of presenting a candidate profile outcome as a broad compatibility claim.
Markdown and HTML use the same phrases in sentence case. All three formats
display report conditions prominently.

Configuration advances from v1beta1 to v1beta2. The release-candidate
defaults fields were validated but never controlled the fixed Quick Check;
they have been removed instead of remaining misleading no-ops. New baselines
carry urn:agentapi-doctor:baseline:v1; the exact unversioned rc baseline shape
remains readable. Report bundles and local run records retain read support for
their v1alpha1 and v1alpha2 forms.

latest run references now require an explicit --allow-latest flag, including
report, compare, and baseline commands. Exact UUIDv7 run IDs remain the durable
and CI-safe default. The stale doctor dev scaffold surface is removed.

Migration

For an rc1-rc3 configuration, delete the top-level defaults block and change
apiVersion from urn:agentapi-doctor:config:v1beta1 to
urn:agentapi-doctor:config:v1beta2, then run doctor self-check. Target
definitions do not otherwise change.

Existing run records, reports, and unversioned baselines can be read in place.
Do not edit immutable digests to force comparison: rc2 and rc3/v0.1.0 Quick
Check baselines have different built-in identities and must be recaptured.
Scripts that intentionally use the local latest pointer must add
--allow-latest; CI should replace it with the exact run ID.

The complete supported-read matrix and configuration steps are in
docs/migration/README.md.

Known issues

• A normal endpoint result covers four selected raw HTTP checks for one exact
  endpoint, model, plan, and artifact set. It does not prove arbitrary SDK,
  Agent, provider, or deployment compatibility.
• Structural checks request 64 output tokens. OpenAI Chat and Responses
  terminal-status checks request 512; these provider-side fields are bounded
  diagnostics, not client-enforced billing ceilings. A model may still return
  an honest INCONCLUSIVE result.
• The pinned OpenAI Python SDK reproducer is one Linux amd64 loopback regression
  case, not an arbitrary-endpoint SDK driver.
• Candidate catalog, pack/profile, Registry, Matrix, OCI, package-manager, and
  workflow integration files in the source tree are experimental and are not
  supported distribution channels.
• Redaction is not anonymization. .agentapi/ contains private local run state;
  keep it out of version control and review every exported report.
• The project has not claimed independent security review, vendor endorsement,
  a hosted service, or a guaranteed response SLA.

Support window

Support begins when the immutable v0.1.0 GitHub Release becomes public and
ends on 2026-10-13 or when a newer 0.1.x release supersedes it, whichever
comes first. Support is best-effort and covers security and critical Doctor
defects; it does not promise backports to release candidates or older patches.

Publication supersedes the rc1, rc2, and rc3 support windows. Their immutable
artifacts remain available only for historical reproduction.

Verification

The exact immutable v0.1.0 tag binds these notes to the source commit on
protected main. Build metadata and provenance bind the assets to that commit;
checksums and the keyless signature bind the exact published bytes. Every
archive must report version 0.1.0, that full commit ID, and Go 1.26.5 build
metadata. The release gate rejects a different Go patch version, requires six
matching standard-library entries in the SPDX SBOM, and runs
govulncheck -mode=binary on the final Linux amd64 binary.

The complete gate runs schema, catalog, support-lock, Go, race, static-analysis,
integration, documentation, license, container, locked real-SDK, release-tool,
and targeted-mutant tests. Representative Linux, macOS, and Windows runners
verify archive identity, version, and the offline demo before and after
publication. Linux also exercises the fixed-tag installer. Checksums, the
keyless Sigstore certificate identity, provenance, and the exact nine-file
allowlist are documented in docs/operations/release-verification.md.

v0.1.0-rc.3

AgentAPI Doctor v0.1.0-rc.3

Summary

This release candidate makes Quick Check output budgets explicit per scenario
instead of applying one 64-token value to every request. The OpenAI Chat and
Responses terminal-status checks now request 512 output tokens so
default-thinking models have more room to reach a natural terminal state. The
other ten structural, envelope, and stream-lifecycle checks remain at 64.

A four-request Chat or Responses run therefore requests at most 704 output
tokens; Anthropic Messages remains at 256 because its selected checks do not
require a natural model stop. Default plans reserve those exact requested
amounts before network access. Provider-reported reasoning-token details are
included in truncation diagnostics, and absent provider usage is recorded as
unknown rather than as an observed zero. For budget enforcement, an unknown
output-token value is conservatively charged at the requested reservation and
remains marked unknown. Input-token usage also remains unknown because Doctor
has no provider-neutral input estimate; neither field is presented as
provider-reported consumption.

The request count remains four, retries remain disabled, and Doctor does not
disable thinking or branch on provider/model names. The pinned OpenAI Python SDK
loopback reproducer from rc.2 remains unchanged.

Compatibility and breaking changes

The CLI commands, configuration shape, report schema, stable exit codes, and
release archive set are unchanged. Output-limit termination remains
INCONCLUSIVE and never becomes a target finding merely because a provider used
the requested budget.

If a completed response pushes cumulative accounting beyond the approved run
budget, Doctor preserves the target assertion verdict but marks the aggregate
run INCONCLUSIVE with exit 4 and a durable run_budget_exhausted condition. A
last-scenario run-budget exhaustion can no longer produce a successful
aggregate run. A provider can still exceed one request estimate without
exhausting the cumulative run budget; that reservation overshoot remains
visible in accounting and is not silently redefined as provider incompatibility.

The built-in driver, evaluator, protocol pack, profile, resolver, and producer
identities advance from 0.1.0-candidate.2 to 0.1.0-candidate.3. Request
bodies and token reservations are part of the digest-bound execution contract,
so rc.2 and rc.3 Quick Check baselines are intentionally incomparable. This is
a pre-1.0 evidence-identity change, not a silent migration of old results.

Existing persisted plans and reports remain readable. The Requirement Catalog's
larger candidate metadata set is not regenerated by this change; its scenario
budgets are offline catalog metadata and are not the four runtime request
bodies used by Quick Check.

Migration

Replace an older binary with the exact archive for this release and confirm
doctor version --json reports 0.1.0-rc.3. Keep old reports when they are
needed as historical observations, but recapture any named baseline before
comparing it with a new rc.3 run. Do not edit an rc.2 baseline or digest to make
it appear compatible with the new built-in profile.

No configuration migration is required. The pinned real-SDK reproducer still
uses CPython 3.12.12 and OpenAI Python 2.38.0 on Linux amd64 with the same
wheel-only hash lock. Registry, reference-server, OCI, Homebrew, Scoop,
composite Action, reusable workflow, Python package, and hosted-service files
remain unpublished candidates rather than supported rc.3 channels.

Known issues

• A 512-token terminal-status request is a bounded default, not a guarantee
  that every reasoning model will finish. A model with a larger default
  reasoning budget may still produce an honest INCONCLUSIVE result.
• Provider request fields are not client-enforced cost ceilings. A provider can
  reject or ignore them; reported usage can also be absent or use
  provider-specific accounting semantics.
• Doctor does not inject a vendor-specific setting to disable thinking, infer a
  capability from a model name, or retry with a larger hidden request.
• The ordinary endpoint PASS still covers four selected raw-HTTP checks for one
  exact endpoint, model, and artifact set. It is not complete SDK, Agent, or
  vendor compatibility.
• The pinned SDK command remains a frozen loopback regression baseline, not an
  arbitrary-endpoint SDK driver. It does not run a proxy, Agent loop, tool
  execution, or vendor service.
• Redaction is not anonymization. Review structured model content, tool
  arguments, reports, and evidence bundles before sharing them.
• There is no project-operated hosted verifier, public Registry, compatibility
  matrix, telemetry service, verified external adopter set, or long-term
  support commitment.

Support window

Support for this release candidate begins when its GitHub Release becomes
public and ends on 2026-08-13 or when a newer release candidate or stable
release supersedes it, whichever occurs first. Security reports remain welcome
after that date, but fixes may require upgrading to a newer release.

Publication of v0.1.0-rc.3 supersedes the v0.1.0-rc.2 release-candidate support
window. The immutable rc.1 and rc.2 artifacts remain available for historical
reproduction.

Verification

The release tag identifies the exact source commit. doctor version --json
inside every archive reports the release version and that full commit ID.

Product tests freeze the twelve per-scenario request values, the 704/256 default
reservations, pre-network token-budget enforcement, output-limit INCONCLUSIVE
semantics, reasoning-detail diagnostics, conservative unknown-usage
accounting, and last-scenario run-budget exhaustion aggregation. The
complete local gate includes all Go tests, race tests, schema/catalog checks,
documentation links, integration tests, static analysis, and vendored-license
checks.

The tag workflow reconstructs the hash-locked Python environment and repeats
all four pinned real-SDK cases twice. It then builds six native Doctor archives,
publishes checksums.txt and one SPDX JSON SBOM, signs the checksum manifest
with Sigstore keyless signing, and records GitHub build-provenance attestations
for every file. Linux amd64, macOS arm64, and Windows amd64 runners verify the
asset set, archive identity, version, and credential-free demo before and
after publication; Linux also exercises the fixed-tag installer.

The canonical artifact-verification commands and certificate identity are in
docs/operations/release-verification.md. A failed workflow does not justify a
compatibility or publication claim.

v0.1.0-rc.2

AgentAPI Doctor v0.1.0-rc.2

Summary

This release candidate adds one reproducible raw wire → pinned SDK case to
the existing fast endpoint checks. On Linux amd64, doctor reproduce openai-python-responses runs OpenAI Python SDK 2.38.0 with CPython 3.12.12
against a task-owned loopback Responses fixture and writes a deterministic,
checksummed evidence ZIP.

The four frozen cases cover a valid reference stream, a missing terminal event,
a duplicate terminal event, and a terminal response whose SDK-modeled output
array is null. They correlate the raw SSE with the real SDK observation from
the same request. The command never contacts a provider or reads an API key.

Before the SDK request, the helper verifies CPython, platform, and the exact
installed distribution names and versions from the lock. The evidence bundle
separates observed and expected environment data and binds the result to the
Doctor and Python executable digests, release build identity, source revision,
and canonical fixture, runner, and lock digests.

The ordinary doctor test command remains a cross-platform, bounded raw-HTTP
checker for authorized OpenAI Chat Completions, OpenAI Responses, and Anthropic
Messages endpoints. This release is not a vendor certification or a claim of
general SDK or Agent compatibility.

Compatibility and breaking changes

The new doctor reproduce command is additive. Existing doctor test, demo,
report, baseline, configuration, run-store, and exit-code behavior remains
pre-1.0 and unchanged by this slice.

The synthetic reference server now exposes 13 targeted mutation modes. Its
Responses fixtures include the stable envelope fields required by the pinned
SDK, and the new null-completed-output mutation changes only the terminal
response's output field. These local fixtures are test inputs, not public
provider behavior.

The pinned reproducer supports Linux amd64 only. Release archives remain
available for Linux, macOS, and Windows on amd64 and arm64 because the normal
endpoint checker and credential-free demo remain cross-platform. On other
platforms, doctor reproduce fails clearly without starting a fixture.

Migration

Replace an older binary with the exact archive for this release and confirm
doctor version --json reports 0.1.0-rc.2. Existing local run records and
baselines remain private local state and do not need to be moved into the
installation directory.

The real-SDK reproducer does not bundle Python or third-party wheels. To use
it, create a separate CPython 3.12.12 environment from the checked-in
Linux-x86_64 wheel-only hash lock, then pass that environment's executable with
--python. The reproducible case documentation shows a two-stage wheelhouse
download and --no-index install. The CLI refuses to overwrite an existing
bundle path.

No Registry, reference-server, OCI image, Homebrew tap, Scoop bucket, composite
Action, reusable workflow, Python package, or hosted service is published as a
supported v0.1.0-rc.2 installation channel.

Known issues

• The pinned SDK command is a frozen loopback regression baseline, not an
  arbitrary-endpoint SDK driver. It does not run a proxy, Agent loop, tool
  execution, or vendor service.
• openai==2.38.0 accepts the duplicate-terminal fixture and yields both
  terminal events. Doctor preserves that SDK observation alongside the raw
  count; it does not rewrite it into a client exception.
• A client exception alone is not attributed to an endpoint. If the controlled
  wire identity or frozen SDK observation differs, the result is UNKNOWN
  rather than a provider fault.
• A normal endpoint PASS still covers four selected raw-HTTP checks for one
  exact endpoint, model, and artifact set. It is not complete SDK or Agent
  compatibility.
• Redaction is not anonymization. Review structured model content, tool
  arguments, and every evidence bundle before sharing.
• Runtime dependency attestation checks installed distribution metadata. The
  checked-in hashes protect wheel download and installation; Doctor does not
  rehash every installed package file afterward.
• There is no project-operated hosted verifier, public Registry, compatibility
  matrix, telemetry service, verified external adopter set, or long-term
  support commitment.

Support window

Support for this release candidate begins when its GitHub Release becomes
public and ends on 2026-08-13 or when a newer release candidate or stable
release supersedes it, whichever occurs first. Security reports remain welcome
after that date, but fixes may require upgrading to a newer release.

Publication of v0.1.0-rc.2 supersedes the v0.1.0-rc.1 release-candidate support
window; the immutable rc.1 artifacts remain available for reproduction.

Verification

The release tag identifies the exact source commit. doctor version --json
inside every archive reports the release version and that full commit ID.

The release workflow builds six native Doctor archives, publishes
checksums.txt and one SPDX JSON SBOM, signs the checksum manifest with
Sigstore keyless signing, and records GitHub build-provenance attestations for
every published file. Linux amd64, macOS arm64, and Windows amd64 runners verify
the asset set, checksum, archive identity, version, and credential-free demo
before publication. After publication they repeat the checks through anonymous
public downloads; Linux also exercises the fixed-tag installer.

Before building those archives, the exact tag workflow reconstructs the
hash-locked Python environment and repeats all four real-SDK cases twice.

Protected Product CI separately creates the pinned Python wheelhouse from the
checked-in hashes, installs it with --no-index, and runs all four real-SDK
cases twice on a clean Ubuntu runner. That check is part of Product CI / aggregate; the release does not imply real-SDK coverage on macOS, Windows, or
arm64.

The canonical artifact-verification commands and certificate identity are in
docs/operations/release-verification.md. A failed workflow does not justify a
compatibility or publication claim.

v0.1.0-rc.1

AgentAPI Doctor v0.1.0-rc.1

Summary

This first release candidate packages the doctor command as a native binary
for Linux, macOS, and Windows on amd64 and arm64. It provides a credential-free
offline demo and bounded raw-HTTP checks for the OpenAI Chat Completions,
OpenAI Responses, and Anthropic Messages API shapes.

This is an evaluation release for early users. It is not a vendor
certification, a complete protocol conformance suite, or proof that a specific
SDK or Agent works with an endpoint.

Compatibility and breaking changes

There is no earlier tagged AgentAPI Doctor release to remain compatible with.
The CLI, configuration, report, evidence, pack, and profile schemas are
pre-1.0 contracts and may change in a later release candidate with documented
migration guidance.

Each endpoint run selects four candidate raw-HTTP checks for one configured API
shape. The larger Requirement Catalog is metadata and does not represent an
equal number of executable tests. Real SDK and Agent execution is not included
in this release candidate.

Migration

Users of an untagged source build should replace that binary with the exact
archive for this release and confirm doctor version --json reports
0.1.0-rc.1. Existing local run records remain private local state; archive or
remove them according to the data policy rather than copying them into the
installation directory.

No Registry, reference-server, OCI image, Homebrew tap, Scoop bucket, composite
Action, or reusable workflow is published as a supported v0.1.0-rc.1 install
channel. Their repository files remain development candidates.

Known issues

• The release executes raw HTTP checks only; it does not run a real OpenAI,
  Anthropic, Vercel AI, or Agent client.
• A PASS is bound to the exact endpoint, model, built-in profile and pack
  digests, and four executed checks. It is not a broad compatibility claim.
• Each request asks the provider for at most 64 output tokens, but the provider
  may reject or ignore that field. It is not an enforced cost ceiling.
• The CLI stores redacted evidence under .agentapi/. Redaction is not
  anonymization: structured model output and tool arguments may remain and
  must be reviewed before sharing.
• There is no project-operated hosted verifier, public Registry, compatibility
  matrix, telemetry service, or long-term support commitment.
• Windows release archives use ZIP; Linux and macOS archives use tar.gz.

Support window

Support for this release candidate begins when the GitHub Release becomes
public and ends on 2026-08-13 or when a newer release candidate or stable
release supersedes it, whichever occurs first. Security reports remain welcome
after that date, but fixes may require upgrading to a newer release.

Verification

The release tag identifies the exact source commit. doctor version --json
inside every archive reports the release version and that full commit ID.

The release workflow builds six archives, publishes checksums.txt and one
SPDX JSON SBOM, signs the checksum manifest with Sigstore keyless signing, and
records GitHub build-provenance attestations for every published file. Before
publication it verifies the signature against the exact tag-bound workflow
identity. Linux amd64, macOS arm64, and Windows amd64 runners verify the
complete asset set, extract their native archive, run version --json, and run
the credential-free demo. After publication, the same representative
platforms download the archive, checksum manifest, and signature bundle without
an authorization header, verify the signature and checksum, and repeat the
smoke test within a two-minute packaging budget. Linux also executes the
public fixed-tag installer into a temporary user directory.

The canonical verification commands and certificate identity are documented in
docs/operations/release-verification.md. A failed workflow does not justify a
compatibility or publication claim.