v3.21.6

v3.21.6 — Extension trust, tool-gate hardening, and service-knowledge project packs

Package: @jaggerxtrm/specialists · Version: 3.21.6 · Runtime: pi 3.21.6 (linked via sp --help; invoked for help text only)

Feeds release-notes bead xtrm-j8kcj.5. Narrative only — no dist/ or src/ changes.

Summary

3.21.6 is a trust-boundary and fail-closed hardening release. Dynamic extension sources, deny-list tool gating, prompt integrity, RPC lifecycle, mandatory-rules overlays, traversal containment, service-knowledge project-pack binding, pre-script handling, tool-catalog resolution, and doctor resilience all move to explicit fail-closed semantics. No new user-facing commands are added; previously shipped surfaces remain compatible. The bounded host-read waiver for sp script/sp serve remains in effect and expires at 3.21.7.

Dynamic extension sources

• execution.extensions is now a source-string map. Keys are trusted executable sources; only reviewed config files may set them.
• gitnexus: false opts out of the default GitNexus MCP injection. serena is retired and ignored (any value is accepted for legacy configs but has no effect). Every other key with true is forwarded to Pi as a repeated -e <source> argument in insertion order; false/null skips the source.
• Per-key merge across package, global, and repo layers preserves siblings. Fail-closed duplicate detection rejects two distinct npm: keys for the same package (for example a pinned canonical npm:@jaggerxtrm/pi-service-knowledge@1.10.0 plus a floating npm:@scope/pkg) before Pi spawns; fix by aligning to the exact pinned spec.
• Remote sources (npm:, git:, http:, https:) omit --offline for the entire Pi invocation; local-only runs retain --offline.
• See src/pi/session.ts:resolveExecutionExtensionSelection, docs/pi-session.md, and docs/overrides-guide.md.

Deny-list tool gate and fail-closed active-tool policy

• Configured extension sources are not equivalent to active tools. At session_start, the runtime advertises only the intersection of the requested permission tier and runtime-confirmed healthy extension tools.
• With extension sources enabled, the launch uses --no-builtin-tools and appends the bundled extension policy extension last (-e policy). The policy re-activates only the granted natives plus every tool registered by the enabled sources. Native restrictions stay fail-closed: anything not explicitly granted is never activated, and Pi rejects inactive tools at call time.
• Without extension sources, the launch keeps the strict --tools allowlist (byte-identical legacy behavior).
• Hard-fail: if extension sources are enabled and the bundled policy artifact is missing, the launch aborts with guidance to reinstall or rebuild the package. Warn-and-continue is never used.

Prompt-integrity fixes

• render-task never emits unresolved template placeholders (e.g. literal $bead_id or $pre_script_output). Missing placeholder data now surfaces as an error rather than a silent literal.
• Every turn-1 initial prompt carries the exact bead id, preventing drift when prompt variables are unset.

RPC fail-fast

• Pending Pi RPC calls are rejected immediately when the Pi child exits, rather than hanging until timeout. This closes the window where a dead child masked a launch failure as a stall.

Mandatory-rules template_sets and overlay hardening

• mandatory_rules.template_sets is now a user-selectable field: null inherits package defaults, [] clears specialist-specific sets (required/default index sets still load), and a non-empty array replaces them. mandatory_rules.inline_rules and mandatory_rules.disable_default_globals remain package-canonical only and are blocked at global/repo layers.
• Overlays validate kebab-case and path containment for set ids before merge, and sp list-rules reflects true layered merge with runtime parity for required/default sets.
• See docs/overrides-guide.md and config/mandatory-rules/README.md.

Traversal containment

• Mandatory-rules set ids and service-knowledge pack discovery enforce path containment: symlinked, escaping, unreadable, or malformed candidates fail instead of falling back.

Service-knowledge binding, pinning, and project-pack resolution

• service-knowledge-sync binds to a project-pack skill directory (.xtrm/skills/<pack>/service-knowledge/ with service-registry.json/services/) rather than a stale global install. Shared executable machinery remains at .xtrm/skills/default/service-knowledge/scripts/; the runtime does not copy scripts into each pack umbrella.
• Resolution is deterministic and fail-closed: one matching pack wins; multiple matches fail as ambiguous; malformed/unreadable/symlinked/escaping candidates fail; zero matches permit the home/global fallback chain. Direct/script paths are canonicalized against canonical allowed roots before Pi starts.
• The service-knowledge extension source is pinned to an exact reviewed npm spec; floating or range specs are rejected.

Pre-script fail-fast and output bounds

• Required pre-scripts are fail-fast: failures return pre_script_failed without model fallback or retry. Both raw and rendered preflight output are bounded before bead or prompt inclusion.

Runtime tool-catalog fail-closed

• Tool catalog resolution is fail-closed across tracked, script, serve, MCP, and pipeline paths. A missing, unreadable, malformed, or empty catalog aborts before Pi or model startup. The runtime never omits --tools for a requested tier. Reinstall or rebuild the Specialists package if config/catalog/index.json is unavailable.

Doctor fail-safes

• sp doctor --specialists survives malformed global ~/.config/specialists/user.json and surfaces guidance instead of crashing.

Compatibility notes

• Serena extension injection and the serena-pool pre-spawn hook remain retired. execution.extensions.serena is accepted for legacy files but ignored.
• sp list-rules --json and sp view now reflect the layered mandatory-rules state described above.
• sp serve remains READ_ONLY and rejects skills.scripts; sp script may opt in via --allow-local-scripts and --allow-write-capable for trusted single-tenant callers only.

Known limits

• Host-read waiver (3.21.6): --allow-skills and --allow-skills-roots do not create a filesystem read boundary. Allowed tools, extensions, MCP processes, and child processes can still read paths visible to the runtime identity. 3.21.6 permits only trusted single-tenant callers with private authenticated ingress, a dedicated container or OS account, minimal mounts, least-privilege credentials, trusted definitions, and reviewed extension sources. Untrusted, public, cross-tenant, and multi-tenant deployments are excluded. The waiver does not authorize publication and expires at 3.21.7, when host-read isolation is expected to be re-evaluated.
• Package/version: @jaggerxtrm/specialists@3.21.6, service-knowledge-sync 1.10.0, coordinated Core heads ef14bf44030ee6cd02d4dd21f0856f067baf54f3/f683f5f6172bdb7ab4a7b7324b7feabd9b918b31 as validation evidence (not a published compatibility guarantee).

Verification

• bun run changelog:check passes; bun run lint (tsc --noEmit) passes where defined. No dist/ or src/ edits, no tag, and no publish were performed in this campaign. Behavior claims above were verified against src/pi/session.ts, docs/pi-session.md, docs/overrides-guide.md, docs/specialists-service.md, docs/authoring.md, and sp --help output for the linked 3.21.6 runtime.

v3.21.5

[3.21.5] - 2026-08-20

Patch focused on observability truthfulness and Pi vendored-tooling parity. sp log default output now filters agent-internal events (turn/tool/model.token_usage) that were drowning the 2-3 real lifecycle rows per job; the corresponding monitor recipes in using-specialists/references/monitoring.md are corrected to read from .forensic_event and to distinguish terminal (job.completed|failed|cancelled) from attention (waiting, process_health.stale_detected, error.*) states — the prior recipe silently matched nothing and coordinators read the silence as "still running". Background specialist dispatch now surfaces launch errors instead of returning a misleading ok envelope. Two Pi extension vendored-fork fixes bring read-line-numbers behavior in line with the Core implementation (EOF model + real-blank-line handling).

Fixed

• Mirror Core read-line-numbers blank-line fix in vendored fork (unitAI-nx80v) (#265) (d2785cf)
• Correct vendored read-line-numbers fork to Pi EOF model (unitAI-gajax) (#266) (3760cf4)
• Surface launch errors in the background envelope (xtrm-5kwk2) (#267) (daba619)
• Sp log default forensic path emits every agent-internal event (unitAI-mkkjk) (#268) (7a13d63)

Project maintenance

• V3.21.4 release-path followups (unitAI-ip5jz) (588593d)
• Stop the boundary-rule test depending on bd + a real bead (1ce1006)
• Sp log --json envelope shape + correct monitor recipes (unitAI-nhl6x) (#269) (bcdbd30)

v3.21.4

[3.21.4] - 2026-08-14

Fixed

• Sp config show --resolved falls back to canonical catalog (6366058)
• Classify rate-limit / quota errors as transient (unitAI-63xi3.1) (8c1c797)
• Harden --bead lookup against shell injection (unitAI-eao44, CWE-78) (1add04a)

Project maintenance

• Regenerate v3.21.3 section via git-cliff (was incomplete) (8155e0d)
• Drop CHANGELOG-content assertion after v3.21.3 regeneration (462c090)

v3.21.3

[3.21.3] - 2026-08-14

Added

• Add native codex role/render surface (K3, experimental) (6c3ffe4)
• Complete codex role invocation and result parity (K4) (8641d36)
• Retire active Serena runtime integration (K4, unitAI-e67up.8) (7053236)
• Add bounded semantic review gates (92225bb)
• Add contextual exploitability method (772041e)
• Add semantic correctness gates (a79c072)
• Establish verified citation contract (b3f4fff)
• Consume read-line-numbers extension via pi -e alongside --no-extensions (9da21eb)

Fixed

• Ship CHANGELOG.md in the package, compact the changelog format (#242) (eaf044f)
• Enforce Core schema patterns in the launch-outcome consumer (K4 review) (ba3e8dc)
• Enforce required-property presence in the launch-outcome consumer (K4 review r3) (c026f40)
• Preserve native read fallback (5ed558a)
• Pin injected diff evidence to immutable head (5b79d47)
• Reuse resolved tool contract (25d4a70)
• Use resolved gitnexus contract (823aa51)
• Enforce mandatory rule budget floor (61b5019)
• Constrain citation paths to trusted roots (0880e4e)
• Fix package attestation payload gate (6779738)
• Enforce release attestation provenance in CI (0cd941e)
• Fix package payload attestation parity (23386dc)
• Pin SEC-001 workflow dependencies (1df5c76)
• Fix CI release boundary failures (da6a94b)

Other changes

• Restore native read tool fallbacks (3ef4168)
• Remove Pi session missing-contract GitNexus fallback (bd86f66)
• Fix obligations literal false positives (57c572f)
• Restore GitNexus counts in docs (efe26e2)
• Harden unstaged obligations snapshot reads (8dd9b9f)
• Restore final .4 release attestation gates (eb61776)
• Pin package artifact upload (949ff47)
• Pin package payload workflow actions (14a592f)

Project maintenance

• Reconcile roadmap pickup with the released XTRM trio (#244) (fce9e4d)
• Characterize K1 Codex surface boundary (c6eb842)
• Pin K1 external references (f2cbbd3)
• Clarify K1 Codex fixture provenance (ba5d803)
• Label K1 fixture evidence owners (0d1d944)
• Make K1 render evidence reproducible (502d0be)
• Pin K1 render error output (779d608)
• Correct GATE-IFACE ordering for the codex surface (review round 2) (eb74640)
• Pin prompt hardening contracts (ca30387)
• Add silent refusal regression fixture (704dd3b)
• Add green-chain refusal context fixture (8485662)
• Model silent refusal acceptance case (4fa71cd)
• Record Pi v0.84.1 compatibility audit (#251) (64f5ab3)
• Chore add to next pr (81c626a)
• Checkpoint script-runner contract coverage (cecc60c)
• Fix stale script-runner quarantine expectations (757277e)
• Cover safe snapshot reader branches (11299c7)
• Cover release attestation refusal paths (a75c5e8)
• Expect immutable attestation upload action (4b0fcf0)
• Cover v3.21.3 release candidate metadata (c7c1827)
• Anchor release attestation to tagged source (2619316)
• Commit reconciled beads export and ignore runtime skill links (4a6921f)
• Mark 5 operator-only skills as non-model-invocable (#253) (8331659)

v3.21.2

Added

• Notify parent on terminal jobs (0873ac2)

• Advance terminal bead assignee (f718df6)

Fixed

• Resolve docs review gate findings (ec64645)

• Align CLI honesty and coordinator prompt (4253782)

• Preserve terminal notification contract (54bf9f7)

• Retain active sibling assignee (f30d10b)

• Bound the attach integration pty and un-quarantine it (#226) (c3eca68)

• Restore monitoring doctrine lost in DOC-01 (#227) (0501e02)

• Document --background in sp run help and guard the drift (#228) (d410d9b)

• Reject --background --raw and tag the background launch schema (#229) (b1c00f9)

• Transition dead jobs to error so the parent is notified (#232) (e7d467a)

• Raise hono floor to 4.12.32 (xtrm-wiy5n.4.35) (#236) (8cd968c)

• Refuse Node runner with a clear one-line message (xtrm-wiy5n.4.34) (#237) (f2940d3)

Other changes

• **Fix pi-compatible JSON output for run and feed (#206)

• fix(cli): emit pi-compatible JSON events

• fix(cli): preserve replay cwd and sequence** (922d5d3)

• **Fix per-job ordering in JSON feed replay (#207)

• fix(feed): preserve per-job event sequence

• fix(feed): merge per-job streams transitively** (5fa36e0)

• Reference service-knowledge package (PR0 relocation) (#213) (cb79680)

• Service-skills-sync -> service-knowledge-sync specialist (#217) (7f7617e)

Project maintenance

• Auto-refresh CHANGELOG.md — pre-push hook (xtrm-reyem.12) (#208) (05c57e5)

• Chore (601cfa8)

• Reconcile enhanced PRD v3.1 (#209) (a11d5bc)

• Add pr-review-gate required-status-check workflow (cde9fd8)

• Set explicit job name for readable required-check context (ed10f80)

• Drop unsupported pull_request_review_thread trigger (3a79f3b)

• Tighten to Bot __typename + paginate threads/reviews (448f0a6)

• Scope tracked documentation and reconcile roadmap (02241c4)

• Clean README whitespace (d1afc58)

• Wave-2 — pull_request_review_comment trigger + preserve CR verdicts (91cf32d)

• Remove tracked open issues export (#218) (dc8cde3)

• Establish issue-linked baseline quarantine (3ce56be)

• Simplify specialist monitoring guidance (a2619d7)

• Retire completion marker consumer (5c48981)

• Route sp run dispatch form to the CLI help (#225) (844ae6c)

• Map all 58 quarantined suites and restore 10 (#230) (ba8526c)

• Run the test suite on every pull request (#231) (c95b35c)

• Pin bun to 1.3.14 in PR workflows (xtrm-wiy5n.4.30) (#233) (e7fadb8)

• Stop the progressive-disclosure doc stating counts that go stale (xtrm-wiy5n.4.23) (#235) (69daedd)

• Commit the injected block, conditioned on runtime support (xtrm-wiy5n.4.36) (#238) (731b423)

v3.21.1

Release v3.21.1

v3.21.0

[v3.21.0] — 2026-07-18

Added

• Wire verified-audit skill into reviewer.specialist.json (0a6895c)

• Isolate ambient pool + force turn-1 body load (unitAI-0o3pv, -qeguh, -uv1yg) (3d77800)

• Add --surface to sp view (#195) (ab88775)

• Help audit + cliff cleanup + repo metadata + release docs (r6g.3, WIP) (#196) (0f4a31d)

Fixed

• ESRCH crash in Background jobs check (76ce52a)

• Skip template specialists in model-configured check + skip null-id sqlite rows (0d450ed)

• Bump stall_timeout_ms + Phase 6 self-open-PR (xtrm-efa2a.1, xtrm-vu2ro.1) (#192) (7bcd3a0)

• Render Claude skill commands separately (2fbcabd)

• Rebuild Claude skill prefix distribution (d560314)

• Trust OSV verdict and preserve unknown launch mode (578ef90)

• Reject OSV scanner operational exits (4e37caa)

• Isolate pull request workflow trust boundary (797b8f3)

• Close PR 193 Ubuntu CI gaps (c5d46fe)

• Reject compound PR workflow guards (e93d8bd)

• Validate rendered skill names (e44b451)

Other changes

• Orphan releasing/SKILL.md — core owns it (455e123)

Project maintenance

• Record the post-release launcher smoke (670d213)

• Correlate xtmux coordination replies (#188) (a575696)

• Reviewer-path interaction with /skill: prefix (f6fdb90)

• Retire repo-local mirror checks, redirect to global vendored paths (d0ce4c2)

• Refresh [Unreleased] with verified-audit wire (ec36b3f)

• Resync task-prompt d.ts with source docstring (9f86070)

v3.20.0 — runtime-origin lineage

Highlights

• Added direct xtmux pane-to-specialist runtime-origin binding, background propagation, typed forensic links, and sp ps origin visibility (#185).
• Added descendant job lineage, inherited root origins, end-to-end reconstruction, and coverage for specialist chains (#186).

Full changelog: v3.19.0...v3.20.0

v3.18.0

[v3.18.0] — 2026-06-24

Added

• sp console v2 — full TUI rewrite (epic unitAI-ctb4u, PR #125). Replaces the original prototype console with a complete multi-view terminal UI built on @earendil-works/pi-tui. Views: ps (live process list with tree depth, context %, status glyphs, column-adaptive layout), feed (live/forensic event stream with follow mode), job (inspect fields + action list), result (full job output), bead (linked bead doc + live state), diff (worktree + commit SHA fallback), config (global user.json override editor), repoConfig (repo registry management). 24-bit ANSI palette sourced from mock-v2 design doc. Keybindings: ↑↓/j/k navigate, ↵ open feed, r result, i inspect, b bead, d diff, g config, R repos, h history, a all, / filter, x stop, tab/1-9 switch repo, 0 ALL view, q quit.
• ALL view — aggregated cross-repo dashboard with cursor navigation. Opening sp console now lands on an ALL view (0 to return from any tab) showing active jobs across all configured repos sorted by activity, with per-repo section headers. ↑↓/j/k moves a cursor through individual job rows; ↵ opens the selected job's feed, r/i/b/d/g/R/x work as in ps — automatically switching to the job's repo before opening the view. The stats bar always shows full ps-style metrics (health / rss / cpu / orphans) for the current repo on all tabs including ALL.
• x — stop job keybinding in ps and all views. Pressing x on any selected or cursor job sends SIGTERM via stopJob in control.ts, using the job's own repo jobsDir. A brief confirmation message (sent SIGTERM to <job-id>) appears in the status bar. Works in both ps (selected row) and all (cursor row, cross-repo).
• Multi-repo auto-discovery and console.json persistence (PRs #141, #143). sp console auto-discovers sibling repos up to depth 2 (worktree-safe: skips .git/ trees and the specialists package itself) on first launch and persists the list to ~/.config/specialists/console.json. Subsequent launches reload the saved list for instant startup. --add-repo <path> and --remove-repo <name> CLI flags manage the list without opening the TUI.
• RepoConfigView — interactive repo registry management inside the console (PR #142). R from ps opens an in-TUI editor for console.json: + add a repo (path → name two-step), d remove, e edit path, n edit name, r rescan (depth-2 inline), s toggle inactive rows. All mutations share the same RuntimeClient persistence surface as the CLI flags.
• DiffView SHA fallback for dead-worktree jobs (unitAI-ctb4u.29, PR #135). When a job's worktree has been removed, DiffView falls back to the recorded git_commit_sha from supervisor_status. The section title changes to diff summary · @<sha7> (commit) so operators know they are viewing a historical snapshot rather than a live worktree diff.
• sp ps gets TUI-themed rows and stats line (unitAI-ugw4s, PR #144). The sp ps shell command now renders job rows using the same 24-bit ANSI palette, status glyphs, and column-adaptive layout as sp console. The stats line (jobs N/M · running N waiting N · …) is appended below the table in dim text. Non-TTY output falls back to plain text as before.
• Snapshot-diff engine ported from gitboard (unitAI-ctb4u.19, PR #137). src/specialist/snapshot-diff.ts provides stable SHA-256 hashing of job snapshots (snapshotHash) and upsert/tombstone delta computation (snapshotDiff). The console poll loop uses the hash to skip no-op dispatches and the delta to expire paint-cache entries for tombstoned jobs only, avoiding full-cache invalidation on every tick.
• Interactive waiting_auto_close_ms global override (unitAI-pj2mm, PR #152). waiting_auto_close_ms is now settable via the global ~/.config/specialists/user.json overlay without editing each package specialist JSON. sp console's ConfigView (g) displays the effective default next to inherit (e.g. inherit (120000)) when no override is active. All 24 package specialist JSONs had their stale null placeholder removed (null triggered a schema validation error at dispatch; field is number | undefined).
• quant-methodologist and quant-researcher specialists (NEW, package tier). Two new quant-focused READ_ONLY specialists ship at config/specialists/ (v1.0.0). quant-methodologist audits and designs quantitative analytics methodology/pipelines for market-data systems — formulas, units, conventions, numerical probes, model assumptions, and creative-but-conservative pipeline proposals (thinking_level: high, LOW read/probe, no implementation edits). quant-researcher gathers source-backed evidence for mathematical finance, market microstructure, econometrics, exchange/product conventions, academic papers, package semantics, DeepWiki repo scans, and GitHub implementation snippets (LOW research, no local code edits). Both ship with model = null / fallback_model = null resolved via the KAN-90 global config layer (commit 78e0b53b).
• KAN-91 expanded global overrides. Phase 0 adds the nested execution and prompt override machinery that keeps loader allowlists and user.json schema in sync.
• KAN-91 user-environment overrides. Phase 1 allowlists prompt.system_prompt_mode, per-specialist Serena/GitNexus extension opt-outs, notes_mode, output_file, and prompt/stdout byte limits in the global user.json layer.
• KAN-91 fallback model chains. Phase 2 adds execution.fallback_models arrays, keeps legacy fallback_model, and walks fallback chains only on transient provider failures.
• KAN-91 preset references. Phase 3 adds @preset/<name> model and fallback references with package preset lookup, depth/cycle guards, telemetry, and type validation.
• KAN-91 global override upgrade notes. sp init --global now writes a _doc sentinel in strict JSON and points users to docs/upgrade-notes/kan-91-expanded-overrides.md for field semantics.
• Console-safe AgentOps operations surfaces. sp serve now exposes read-only per-job normalized forensic streams at GET /jobs/:job_id/feed-events and /api/specialists/jobs/:job_id/feed-events; Prometheus projection adds bounded xtrm_chains_total / xtrm_chain_duration_seconds, projects gate verdict and evidence-ref counters, forbids raw diff labels, keeps chain/job/file/diff drill-down in forensic events, and documents the console-facing telemetry contract updates (unitAI-5ljfu).
• AgentOps correlation and MCP telemetry pre-wiring. Forensic events now carry optional session_id, conversation_id, trace_id, span_id, and parent_span_id correlation fields through Pi session metadata, supervisor status, SQLite forensic writes, and sp feed/sp log JSON surfaces. MCP timeline events normalize to canonical mcp.* names, preserve MCP/JSON-RPC/trace identifiers as correlation/body data only, and project bounded xtrm_mcp_operations_total metrics without implying a live MCP emitter (unitAI-eoqxp.3.1, unitAI-eoqxp.3.2).
• Telemetry contract validation and token-first cost semantics. Forbidden Prometheus labels now include session/conversation/MCP/JSON-RPC/eval/policy/identity correlation IDs, AgentOps catalog fixtures cover job/MCP/identity/policy/eval/service-skills/pulse/token provenance examples, and the telemetry docs explicitly keep USD cost out of runtime metrics until billing/pricing provenance exists (unitAI-eoqxp.3.5, unitAI-v1fzu).
• AgentOps forensic telemetry bridge — xtrm.forensic.v1 runtime envelopes, persistence, and query surface. Specialist runtime events now dual-write canonical forensic envelopes into specialist_forensic_events, with deterministic redaction before persistence/output and additive forensic_event payloads on sp feed --json / sp log --json while preserving legacy fields. New sp forensic <job-id> --json emits persisted NDJSON evidence for a job; real-job smoke ddc421 validated 68 events across job, model, turn, tool, and git families (unitAI-60w93.2, .3, .4, .8, .9, .10, .14, unitAI-z2s17).
• AgentOps Prometheus projection — sp metrics --prometheus plus sp serve GET /metrics. Specialists now exports low-cardinality Prometheus/OpenMetrics text for job state, job totals, duration/wait histograms, turns, context usage, tool calls, LLM tokens, queue depth, process/worktree gauges, and projection timestamp. The projection is table-derived/replay-safe for current state, validates text syntax in CI, and keeps high-cardinality IDs (job_id, chain_id, participant_id) out of labels (unitAI-60w93.5, .6, .7, .11, .12, .13).
• AgentOps telemetry readiness smoke for gitboard handoff (unitAI-ub65d.4, PR #114). Closes the unitAI-ub65d epic by validating the shipped telemetry meets the gitboard materializer handoff contract: forensic stream carries normalized xtrm.forensic.v1 rows with body + redaction, job metrics carry turns/tools/model + token split + usage_source, evidence includes verdict/result and diff/commit refs where present, and sp metrics --prometheus stays bounded.
• sp setup CLI verb + benchmark data module (Epic unitAI-t86wh, PRs #119, #120). New top-level sp setup verb composes sp init --global / sp edit --global / sp doctor --specialists into a benchmark-driven model-assignment workflow: --discovery [--json], --fetch-benchmarks [--json], --plan <budget-preset>, --apply, and --probe-only. Backed by src/specialist/benchmarks.ts (PR #119) — a pinned SSOT snapshot from artificialanalysis.ai (primary) + lmarena.ai (secondary) plus an agentic-followthrough probe suite that catches model failure modes public leaderboards miss.
• sp list / specialists list — per-specialist version badge, package-version header, and new-release alert. Each row now renders the spec's own `metad...

v3.17.0 — QA chain (seconder fusion + test-engineer/test-runner)

[v3.17.0] — 2026-05-31

Added

• seconder specialist (NEW, package tier). The fused post-writer gate from canon docs/design/chain-templates.md §2.3 — collapses the old split between scope/compliance (reviewer phase-1) and code-quality smell (code-sanity) into one READ_ONLY dispatch (openai-codex/gpt-5.4-mini) emitting a structured dual-verdict JSON: scope_verdict + scope_findings + quality_verdict + quality_findings + overall_verdict. The chain reducer reads overall_verdict to advance or route back to the writer; the reviewer reads the dimension-tagged findings. Replaces code-sanity, which is removed this release (see Removed) (unitAI-4e194, unitAI-wz2ag, unitAI-321ir).
• test-engineer specialist (NEW, package tier). Post-implementation behavioral-test author from the actual diff (canon §2.5). MEDIUM, openai-codex/gpt-5.5, requires_worktree. Produces tests + fixtures + smoke/E2E harnesses + telemetry assertions and emits exact test-runner commands via a structured schema (status, files_changed, coverage_map, smoke_e2e_commands, telemetry_assertions, test_runner_commands, known_deferred_paths, source_bug_suspicions). Ambidextrous role (§3.16): the same spec is the primary writer in test-only chains and the secondary writer in code-with-tests chains — the system prompt is mode-agnostic and the position arrives via the dispatch-time mandate. Forbidden from patching production source by default (unitAI-sfwe1, unitAI-sfwe1.1).
• Two NEW chain-template formulas — code-with-tests (§3.14) and test-only (§3.15). code-with-tests: dual-writer production chain (executor writes the diff, test-engineer writes tests against it) at high/critical scrutiny. test-only: single-writer chain when scope is test-paths only (test-engineer as primary writer). Both carry the ambidextrous test-engineer mandate in the step description (pre-substrate position-injection mechanism, §3.16) (unitAI-f9kku).
• Seconder dual-verdict eval + QA-routing eval. .specialists/evals/seconder/ — a reproducible static eval with three fixtures (wrong-scope → scope_verdict FAIL, bad-quality → quality_verdict FAIL, clean → overall_verdict PASS) each carrying an expected-verdict.json, plus an operator-run run.sh and a token-cost note (unitAI-o7j1a). config/skills/using-specialists-v3/evals/ gained four QA-routing eval cases (test-engineer primary vs secondary writer, test-runner owner-routing, reviewer-consumes-QA-evidence) + a passing vitest harness (unitAI-sfwe1.5).
• transcriber specialist (NEW, package tier). Promotes the documentation-grade YouTube transcriber prompt to the shipped package catalog at config/specialists/transcriber.specialist.json. v1.6.0 uses openai-codex/gpt-5.3-codex, title-derived transcript/analysis filenames, narrow subtitle language extraction to avoid YouTube 429 fanout, immediate section-by-section writes, dense technical DETAILED SECTION ANALYSIS, TECHNICAL EXTRACTION TABLES, and a coverage/quality audit to prevent shallow “2-line per 5 minutes” outputs (unitAI-jfw26).
• sp log runtime/provenance stream — new operator-facing log command for specialist runtime debugging. It reads observability.db, shows dispatch/control/status/error/auto-commit provenance separate from sp feed, supports --json NDJSON for full payloads, --follow, --since, --limit, job/bead/specialist/node filters, and --all-events for raw feed-like internals (unitAI-gqpvw, unitAI-vfqgq).
• sp log parent-directory/global mode — when run outside a repo root with no local specialists DB, sp log discovers immediate child repos containing .specialists/db/observability.db and aggregates their runtime rows as one global log; --repo <name> narrows output to a single child repo (unitAI-v5xfu).
• obligations-scanner specialist (NEW) — READ_ONLY, cheap (openai-codex/gpt-5.4-mini, bare: true, ~30s target) pre-review marker scan. Scans executor/debugger diffs for newly-introduced TODO/FIXME/HACK/XXX/TEMP/WIP/NOTE(release) markers in production code. Distinguishes production vs test/fixture surfaces. Recognizes structured // TODO(<bead-id>): reason format and treats it as TRACKED when the linked bead is open. Verdict: CLEAN | OBLIGATIONS_FOUND | BLOCKED with a JSON output_schema the reviewer consumes directly. Iron-style obligations tracking (unitAI-kglvm.3).
• docs/design/iron-review-hardening.html — design doc visualizing the new pipeline (SCRUTINY taxonomy, old-vs-new chain flow, per-specialist changes, git-state precondition, manual execution plan). Mirrored to ~/second-mind/1-projects/Mercury/ for sync (unitAI-fpwbr, unitAI-1n56e, unitAI-ejdi1).
• service-skills-sync specialist (NEW, package tier). Promotes the Service Skills Librarian (previously a market-data user-tier override) to a shipped package specialist at config/specialists/service-skills-sync.specialist.json. MEDIUM, openai-codex/gpt-5.4-mini; keeps per-service expert-persona SKILL.md docs in sync with code drift using gitnexus (detect_changes/impact/context) + Serena, gated by a drift_detector.py pre-scan. The per-service knowledge layer the future devops agent reads (DevOps PRD §7.1) (unitAI-g8zr3).
• researcher specialist v1.2.0 → v1.3.0 — general-web pipeline (Mode 4). Adds a fourth research mode closing the web-research gap (previously the researcher reached library docs/repos/code/social but had no general web search or arbitrary-URL read): ddgs (DuckDuckGo search CLI, no API key — uv tool install ddgs) discovers authoritative URLs, then agent-browser (native Rust CLI + Chrome daemon — npm i -g agent-browser) reads any URL including JS-rendered pages. Documented in prompt.system Mode 4 + config/mandatory-rules/research-tool-routing.md. capabilities.external_commands deliberately left empty — it is a hard pre-run gate (runner.ts validateBeforeRun throws on a missing PATH binary), so declaring these heavy tools would break the shipped researcher in projects without them; documented as available-on-demand with install hints instead (unitAI-qgvld).
• notes_mode specialist field + markdown-native 3-state handoff. New top-level notes_mode enum (full-trail default | final-only) controls how each turn's handoff is persisted to BOTH the input bead notes and output_file. The supervisor renders a markdown-native 3-state handoff — ### <specialist> · <model> · [turn N · WAITING] trail blocks plus a canonical ## <specialist> · <model> · [FINAL · DONE] block — with the specialist's output verbatim, a single italic metadata footer (empty/zero/unknown fields omitted), and a provider-prefix-stripped model string; no divider rules or emoji. One shared content source feeds bead notes, output_file, and sp result. final-only persists only the canonical FINAL block and overwrites output_file, for non-coding/chained pipelines where the next specialist reads the previous one's note or file as input (unitAI-10y07, unitAI-yiazs).

Changed

• test-runner specialist — upgraded to the QA failure-routing contract (canon §2.5). Now prefers exact commands from test-engineer/orchestrator and falls back to manifest-detected runners only when none are supplied (clearly labeled as fallback). Classifies every failure by owner — test_engineer (test/fixture/harness wrong, or new untested feature), debugger_or_executor (missing telemetry / source behavior regression), infrastructure, pre_existing — and never writes tests or patches source (LOW). Backed by config/mandatory-rules/test-runner-execution-scope.md (unitAI-sfwe1.2).
• reviewer specialist — refactored to phase-2-only (seconder fusion, canon §2.3). The phase-1 compliance/scope check now lives in seconder's scope_verdict; the reviewer keeps only phase-2 (adversarial deep code-quality audit + machine-readable Release Checklist + ddiff re-review on PARTIAL) and treats a seconder PASS as the upstream scope gate. Two-phase framing removed from the prompt (unitAI-4e194, unitAI-sowpa).
• 13 chain-template formulas rewired for the canonical QA pipeline. Every production-diff template (code-standard, code-with-advisors, debug, security-deep, restitch) now wires writer → seconder → test-engineer → test-runner → [security-auditor if sensitive] → obligations-scanner → reviewer (canon §2.1) — code-sanity renamed to seconder, test-engineer + test-runner inserted. README overlay table + roadmap Opp 14/15 status updated (unitAI-f9kku).
• using-specialists-v3 skill — canonical seconder-fusion pipeline. SKILL.md now teaches writer → seconder → test-engineer → test-runner → [security] → obligations → reviewer, the QA failure-routing matrix (§2.5), and SCRUTINY reframed as a chain property that modulates structure, not quality (§2.2) — including the none tier for read-only chains and the required-at-creation rule. seconder replaces the code-sanity seconder slot; reviewer documented as phase-2-only (unitAI-096re, folds unitAI-sfwe1.3).
• sp log human output is leaner and calmer. Default output now hides agent-internal turn/tool/text/thinking/token rows already covered by sp feed, keeps runtime-owned rows only, collapses repo/path/branch/worktree metadata into one compact worktree=<repo>/<worktree> field, uses a restrained professional color palette (dim metadata, plain job ids, bold specialist names, color-coded status=<state>, green/yellow/red/cyan only for semantic state), and collapses adjacent duplicate display rows caused by duplicated runtime events while preserving full payloads in --json (unitAI-vfqgq, unitAI-npjlq, unitAI-f5k0p).
• reviewer specialist — Iron-inspired prompt overhaul. Five new system-prompt sections, additions only (existing source-of-truth priority and AUTHORITATIVE R...