AgentOps 3.2 is the **verification-keystone** minor: the cross-family review loop became the product's front door. `ao verify` is the canonical verb over the pawl engine (with `init` making the pre-push verdict ratchet portable to any repo, `stats` pricing the cost of verified-done, and `receipts` rendering the proof), `ao done` makes bead closes verdict-referenced, and the reviewer hardened into a standing multi-model service with honest degradation — outage-only failover, REBOUND re-authorization for byte-identical rebases, and an opt-in strict two-family quorum that reports honest-UNAVAILABLE rather than fake redundancy. The membrane gained memory (`ao membrane catch/recall/triage`) and its escape→derived-check loop is proven end-to-end on the shipped binary, including constraint travel to CI. Around that core the CLI shed the cathedral: the default build is the verification + bookkeeping spine (corpus-flywheel and legacy families behind `-tags "flywheel legacy"`, ADR-0012), the `ao rpi` surface and v1 memory experiment are removed, the bd/Dolt tracker is retired for `br`+`bv`, and the skill catalog consolidated 105→63. See [docs/3.2.md](https://github.com/boshu2/agentops/blob/main/docs/3.2.md) for the release narrative.
### Added
- **`ao verify` — the verification front door** (age-wedge-all-in-dyr0, age-rk3r): `ao verify` reviews a change and binds the verdict to the provenance ledger; `ao verify init` installs the portable pre-push verdict ratchet + chain verify in any repo; `ao verify stats` reports dispositions, refute rate, rounds, duration, degraded share, and re-review waste from the ledger; `ao verify receipts` renders the proof page from the embedded bundle; per-repo config file + `--show-config`.
- **`ao done`** — verdict-referenced bead close with a warn-first close-rate gate, falling back to the origin/main ledger when the local one lags (age-wedge-all-in-dyr0.4, age-lw4c); **`ao provenance show`** (per-SHA/bead verdict lineage) and **`ao provenance mine-session`**.
- **Standing pawl service** (age-standing-pawl-service-ml8): `ao pawl up/down/health/route/metrics` with warm tri-model panes (Claude + Codex + AGY), capability-adaptive routing, self-healing respawn/reroute, p50/p95 + agreement SLOs; `ao pawl review` runs zero-config on a stranger's repo (age-a9iv).
- **Verdict-integrity layers** (age-rk3r): REBOUND patch-id verdicts authorize byte-identical rebases without a re-review (honored by the portable push-gate and CI with Go-side lineage+proof re-validation, plus a keep-ref so CI can re-verify an orphaned reviewed commit); opt-in strict two-family cold quorum that refuses to degrade (honest-UNAVAILABLE); outage-only cold reviewer failover chain with explicit degraded labels; evidence-quality floor for CONFIRMED; live-smoke verify mode; provenance v1.1 verdict-edge enrichment (reviewer_family, degraded, rounds, duration_s, evidence_path).
- **Membrane memory** (age-zpj5, age-membrane-memory-arch-tz2s): `ao membrane catch` records panel catches (class key + affected paths), `ao membrane recall --include-catches` retrieves them by domain into prompts, `ao membrane triage` reports honest two-axis recurrence; the escape→derived-check loop is proven end-to-end on the shipped binary (`scripts/em-loop-donetest.sh`) with learned constraints traveling to CI and clean clones.
- **`ao wiki`** — the OpenKB port (age-port-openkb-into-agentops-go-5qw): `init/use/add/remove/recompile/lint/status`, gold-wiki compilation from `.agents/` with sanitize+mine, and verdict-gated publish bound to a content digest; retrieval integration via `ao lookup --gold` and `--pointers` bounded retrieval with a cold-start ε-exploration floor.
- **Plan-pawl duel** (age-plan-pawl-9yib): `ao plan-pawl decide` deterministic duel decider; `/discovery` gains `--duel/--no-duel/--duel-rounds`; pre-mortem gains the duel checklist; ApprovalEdge records two judge panes.
- **Real token accounting + governor**: per-bead token capture kills the hardcoded zeros, `ao yield tokens` parses Claude and Codex transcripts (deduped by response id, loud on absent usage), and `ao governor budget` adds an SPC error-budget with a two-sided noise band (age-membrane-memory-arch-tz2s.3, .7).
- **Gate wave** (age-gate-the-ungated-egwt, age-push-equals-ci-0ua): full `-race` suite on push-to-main, provenance hash-chain gate at the pre-push boundary, `docs.cli-snippets` (live docs resolve against the cobra tree), `docs.skill-refs --all-docs`, `docs.demoted-claims` honesty lexicon, script-preamble ratchet, ADR-registry check, fail-closed pinned golangci-lint, static shell-portability gate, jsonl-scanner ratchet, and a report-only CI verdict backstop (age-wedge-all-in-dyr0.9).
- **Land pipeline** (agentops-2pl, age-genn, age-qeqv, age-tkxq): single-writer land lane with branch submit queue and default-deny gh shim, deterministic land wrapper, staged-scope pre-commit guard against concurrent-lane contamination, first-class per-item consumed markers in next-work.
- **Codex runtime hardening** (ag-p273x, ag-codex-runtime-enhancement-o0nds): task-packet and run-receipt JSON Schemas enforced at runtime, `required_commands` executed and recorded, dispatch paths bounded to cwd/`allowed_paths`, packet-injected auth env rejected, dispatch receipts, image health doctor with per-check timeouts.
- **ms integration**: the `ms` skill (meta_skill search/load doctrine), session-bootstrap surfacing, `ms-reindex` wrapper + post-merge hook installer, and "ms search first" folded into discovery/plan/skill-builder (age-l6y3, age-22g0, age-50pr).
- **15-skill spine partition**: `spine: true` frontmatter with a behavioral GOALS gate, plus `flywheel`/`legacy` archive build tags — the default `ao` build omits archived families (age-focus-membrane-bookkeeper-m1wg.12/.23, ADR-0012).
- **The ship path routes to the Go release authority** — `ao gate check` is the default gate on the ship path (age-fkps), `#trivial` waivers verify the diff is genuinely provenance-only (age-u43w), and non-trivial commits hidden behind a `#trivial` tip are gated individually (age-8ais).
- **The default pawl routes through the standing service** when it is up, with size-scaled review timeouts for large read-files packets (age-standing-pawl-service-ml8.7, age-wedge-all-in-dyr0.11).
- **Skill catalog consolidated hard**: the corpus prune folded 39 sources into 21 targets (105→65, ag-s43tg), then 70→63 with six skills folded into canonical owners (#889); six corpus-flywheel skills plus `evolve`/`autodev`/`acfs` demoted to a new experimental tier; substrate skills folded 13→5; `ao skills retire` makes retirement deterministic via the dispositions ledger; all 50 trigger-marker offenders cleared behind a new `skill.triggers` gate.
- **Codex twins are generated self-contained** from source with pointer exemptions, a byte-verify drift gate, and content-divergence gates extended to SKILL.md bodies and references; twin regeneration scoped to the spine set (~70% regen cut) (age-8wm, age-codex-twin-generator-qlj, age-k2ag, age-focus-membrane-bookkeeper-m1wg.18).
- **CLI consolidation**: session-continuity commands under `ao session`, eval-family commands under `ao eval`, an experimental help group for corpus/flywheel surfaces, and a quick-start that lands the first verdict in one command (age-focus-membrane-bookkeeper-m1wg.16/.17, age-h4y3, age-wedge-all-in-dyr0.5).
- **Storage discipline**: canonical `storage.AtomicWriteFile` (quest/llmwiki/doctor/wiki delegate), exported JSONL helpers with a loud-failure buffer policy, fsync-safe atomic writes + parent-dir fsync, and tar extraction containment (age-3azc, age-uja6, age-storage-hardening-roxg, age-y9jy).
- **Out-of-session substrate wording reconciled (Wave F).** Live multi-agent orchestration is documented as **NTM/ATM + Agent Mail**; Gas City remains an optional reference SDK, not the default operator substrate. Historical 3.0.0 CHANGELOG entries that name Gas City as primary orchestration are superseded by this note for current doctrine — see [`docs/3.0.md`](https://github.com/boshu2/agentops/blob/main/docs/3.0.md) and [`docs/architecture/codebase-overview.md`](https://github.com/boshu2/agentops/blob/main/docs/architecture/codebase-overview.md).
- **Doc-debt reconciliation waves A–F (2026-06-16)**: `cli/AGENTS.md` br pointer stub + `cli.agents-tracker` drift gate; RPI terminology glossary; `ports-and-adapters.md` + BC5 + hookless framing with a `docs.architecture-drift` gate; worktree disposition audit (dry-run); `skill-probe-i0.sh` + `check-provenance-orphans.sh` registered in the Go gate registry; skill-disposition triage checklist.
- **Root agent docs reconciled to executable truth** (age-2d8m) — source-of-truth precedence stated inline; stale hook-era/`bd` wording swept; README claims PMF-linted with evidence citations (age-ejk).
### Fixed
- **Pawl truthfulness arc**: each pane's ACTUAL verdict is recorded (no fabricated REFUTED from timeouts), all verdicts are collected (no first-REFUTE guillotine), cc/agy sends are delivery-based (the unreliable atm-wait engagement gate removed), cold codex reviews are echo-safe with a hardened shared `codex-exec` runner, a hijack guard refuses verdict binds when the worktree HEAD moved mid-review, and backgrounding-reap failures self-explain (age-pawl-good-bar, age-55qz.10/.11, age-sylz, age-wjp0, age-gate-the-ungated-egwt.8/.13).
- **Full-tier gate reds greened** (age-hl9q): the flywheel proof builds its sandbox `ao` with the ADR-0012 archive tags (`PROOF_BUILD_TAGS`), `heal.sh --strict` resolves skill CLI references against the full command surface via the shared snippet resolver (third instance of the archived-command escape class), and `computeVerifyStats` was split under the gocyclo budget.
- **macOS portability sweep**: bats suites and release scripts fixed for BSD `wc`/`stat`/`find`/`sed`/`touch` divergences; a static shell-portability gate guards regressions (age-qzvm, age-lz4b, age-m9rf, age-jtz0, age-i0ky, age-7jm6).
- **Test isolation hardening** in `cli/cmd/ao`: cobra flag/writer state restored via `t.Cleanup`, tmux socket isolation, deterministic process-group tests, os.Setenv ratchet, and the trustworthy cmd/ao test floor restored with the gate blindness that shipped it red closed.
- **Regen determinism**: `registry.json` drops wall-clock `generated_at` (age-9itj), the skill catalog regen folded into `regen-all`/`regen-check` (age-biop), and the catalog/registry inventory surfaces agree at 64 skills (age-61ci).
- **Provenance integrity**: strict bead-id extraction kills false edges from prose, post-land emit is race-proof via disposable worktrees, merge_sha is trunk-bound, and ledger appends serialize under a cross-process lock.
### Removed
- **The `ao rpi` command surface** — ADR-0009 executed; the operating loop + process skills are the navigation path, and the engine's live helpers were extracted to `internal/worktree`, `internal/runtimecmd`, and `internal/rpi` (age-tlj6, age-3pdt).
- **`ao recall` and `ao memory ingest-claude`** — the v1 unified-memory experiment retired; recall is consumed from the coexisting open-source tools (cass / cass-memory) rather than rebuilt in-tree (age-5nvy, age-7grl).
- **The bd/Dolt tracker lane** — `br` (beads_rust) + `bv` are canonical over a git-JSONL ledger; bd wrappers, docs, and workflow references swept with regression gates (ag-joto6, age-m44f, age-u1u6).
- **Archived command families** — `turn`, `harness`, `operator`, `harvest`, `refinery`, `mind`, and `curate` moved behind the `flywheel`/`legacy` build tags; the dead `ao cron` compat shim deleted (age-focus-membrane-bookkeeper-m1wg.13/.14/.15).
- **The unproven memory-moat machinery** — retired per ADR-0004 honesty; the membrane stays, the moat claims went (age-7grl).
AgentOps 3.1 is the **packaging-and-gate-discipline** minor on top of the hookless 3.0 core. The headline is not a new feature — it is that the release pipeline itself became the product. Three things hardened together: the **release gate moved native** (the inline bash checks were ported to a single Go gate that the pre-push hook runs as the release authority, with workflow-parity enforcement so a check can't pass locally while drifting in CI); **close-admission tightened** (the verdict gate now counts distinct validator *families* with author exclusion, so a self-graded "looks good" no longer admits a close); and the **skill corpus was canonicalized** (ghost skills materialized into the tree, registries/counts regenerated from one source, and bundled image copies forced back to byte identity with that source). On top of that discipline, the three IMAGE-CORE recipes (Claude / Codex / Gemini-AGY) ship as real, smoke-proven install paths. See [docs/3.1.md](https://github.com/boshu2/agentops/blob/main/docs/3.1.md) for the release narrative.
- **Installable image artifacts for the 3.1 runtime set.** Claude Code now has a dedicated marketplace installer wrapper, Codex keeps the native plugin curl installer, and Gemini/Antigravity now has a curl installer that validates and installs `images/gemini` through `agy plugin`. The three documented one-liners are in [README §Install](https://github.com/boshu2/agentops/blob/main/README.md#install); the recipes are materialized as `images/{claude,codex,gemini}/` (each with a manifest, `README.md`, and `verify.sh`).
- **Day-2 install operations are productized.** Added [docs/install-day2-ops.md](https://github.com/boshu2/agentops/blob/main/docs/install-day2-ops.md) — operator guidance for install, update, backup, permission repair, recovery, and escalation across Claude, Codex, and Gemini/AGY (the AT&O "make Day-2 part of the product, not an afterthought" doctrine).
- **Claude installer release-pinning.** `scripts/install-claude.sh` now accepts `--ref <ref>` (or `AGENTOPS_INSTALL_REF`) to pin the marketplace source to a tagged release (e.g. `v3.1.0`), reaching parity with `install-agy.sh`.
- **Claude image version guard.** `images/claude/verify.sh` now asserts `.claude-plugin/plugin.json` declares the expected release version (default `3.1.0`, override via `AGENTOPS_EXPECTED_VERSION`), so a stale-version drift in the marketplace manifest fails the gate.
- **`ao skills resolve` — MECE corpus audit** (`c9c3e2706`). Reports skill overlap and coverage gaps so the corpus can be kept mutually-exclusive / collectively-exhaustive.
- **`ao refinery` backstop daemon** (`cba058c6a`, ag-qidx) — a refinery surface for the gate/registry regen path, with a `cli-skills-map` regenerated for it.
- **Go gate workflow coverage + parity reporting** (`390695b65`, `281d46d34`, `283e60e78`) — the gate now reports which CI workflows back each check and *requires* workflow parity, so a locally-green check that has drifted out of CI fails the gate.
### Changed
- **Pre-push gate flipped to the native Go gate** (`c97efcc36` PB2, `efbcf7e90`, `ca9366ccb`) — the inline bash checks were ported to native Go checks (`643e7ade1`, `b720a72cd`, `bcaae4b02`, `5b93b4814`, `6814e377c` — PB1 batches) and the pre-push hook now runs `ao gate check` as the release authority. Local validation is the routine shipping path; GitHub Actions is an optional/manual backstop.
- **Push-to-main cockpit doctrine** (`d90ff1d09`, `0f501beae`, `a023dc4df`) — workflow rewritten for push-to-main with a concurrency-scoped push lock (`push-serial.sh`); dead merge-machinery scripts deleted.
- **Local validation is the release authority** (`3d4fc1299`, `ac5664c56`, ag-3l86) — local-CI made viable as a DSR fallback when GitHub Actions quota is exhausted.
- **Skill corpus canonicalized + triggers added.** 4 ghost `codebase-*` skills materialized into the tree and registered across catalog surfaces (`dd34f8688`, `584701af8`, `61421cdb9`, `0580f7303`, `cp-801l`); explicit "Use-when" triggers added to weak-trigger skills (`5cdd8e792`, `5895422cd`, `e0932310d`); `using-ntm` renamed to `using-atm` (`5c4e7f07a`); 2026-06-10 operational lessons encoded into 4 canonical skills (`d286a5fc2`).
- **Verdict gate now enforces distinct families + author exclusion** (`ef63eec78` (cherry-pick of 5f7120ff6), `d6576b359`, `94181cc89`, `9c1398671`) — `council_judge` counted files, not distinct validator families, and did not exclude the author; a self-graded verdict could admit a close (LAW-3 gap). `ef63eec78` adds `tickVerdictIdentity` (author, judge name, judge program, judge model family) and the `tickCouncilGate` family-count check to `tick.go`; `d6576b359`/`94181cc89`/`9c1398671` seal the skill-edit contract surfaces that the gate now audits.
- **Removed Claude `--print` probes from headless paths** (`267f378a0`, `dee7a3502`, ag-eli0) — the headless checks and the team-runner path no longer shell out to `claude --print` (LAW 0 compliance).
- **Distribution install contract aligned** (`29b919f92`) — the `agentops-core.distribution-install-update` canary was failing on main; the contract was realigned so `claude plugin update` and the install/update path stay green.
- **Gemini image bundle drift** (`3e0f8f4e8`, `0e5d07211`) — refreshed the bundled Gemini/AGY `SKILL.md` copies so `images/gemini/verify.sh` proves byte identity against the canonical source corpus. The residual `validate` and `vibing-with-ntm` drift left by the 2026-06-10 4-skill lesson encoding was resynced so both `images/gemini/verify.sh` and `scripts/validate-agy-plugin.sh` pass byte-identity.
Patch release. No runtime behavior change — it advances the plugin/marketplace version so existing `3.0.0` installs can `claude plugin update` cleanly (the `3.0.0` version label never moved across the 15 commits that landed the skill consolidation and doc reconciliation, so a plain update reported "already latest"). Also reconciles two release-engineering surfaces the per-PR gate did not exercise:
- **`claude plugin update` now works for early 3.0.0 installs.** Version bumped to 3.0.1 across `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json` (metadata + plugin), and the `install-ao.sh` pin.
- **Nightly Static Validation is green again.** Removed the Nightly step that ran the deleted `scripts/validate-hooks-doc-parity.sh` (hooks were removed in 3.0). Repointed/retired two stale `tests/docs/validate-skill-count.sh` extraction patterns that grepped PRODUCT.md for hook-era phrasing ("runtime hook event sections", the "### 1. Skills (N across 4 runtimes)" heading) that the 3.0 restructure removed.
AgentOps 3.0 is the **hookless-first** major. The headline: AgentOps is what runs **in-session** — skills + the `ao` CLI + the RPI/evolve/crank/swarm loops + the context-compiler. Out-of-session orchestration (scheduling, daemons, autonomous dispatch) is delegated to Gas City (a reference City ships in this release) or Olympus. The default install registers **zero hooks**; the lifecycle is driven by skills and CI gates. See `docs/3.0.md` for the north star.
### ⚠️ Breaking Changes
- **Hookless by default** (`soc-57b7f`) — the default install registers no hooks. All 53 runtime hooks were audited and removed; capabilities that lived in hooks (standards injection, commit-review gating, noise injectors) are now CLI ports + CI gates. Opt back in with `--with-hooks` (`AGENTOPS_INSTALL_HOOKS=1`) or `ao hooks install --force`. **Migration:** if you relied on hook-driven behavior, switch to the CI gate or the equivalent `ao` subcommand.
- **Daemon carved out** (`soc-2rtm0`, daemon-carve wave 5) — `internal/daemon` + the `agentopsd` binary were deleted. AgentOps no longer ships an out-of-session daemon; Gas City is the orchestration substrate. Builder cores that previously ran as daemon jobs (wiki build, llmwiki loop) keep their in-process / GC-callable core but lose the daemon-job-executor wrapper.
- **Scheduling/plans/watch/overnight commands removed** (`soc-2rtm0`, kill-schedule-overnight) — `ao schedule`, `ao plans`, `ao watch`, and the overnight engines were deleted. Gas City owns scheduling. The phased RPI engine keeps its non-gc backends (`auto`/`direct`/`stream`/`tmux`); `runtime=gc` is no longer a valid mode.
- **`factory` command + contract corpus retired** (`soc-2rtm0`, cascade-rip) — the `ao factory` command and its contract corpus were removed.
- **Gas City (gc) bridge severed** (`soc-2rtm0`, wave 2) — the CLI gc-bridge glue (`gc_bridge.go`, `gc_events.go`, `rpi_phased_gc.go`) was deleted; the daemon-side GasCity client is a separate, retained surface.
- **AgentOps reference Gas City** — a turnkey City (`city.toml` + `agentops` pack + overlay) that demonstrates out-of-session orchestration on top of AgentOps skills.
- **`ao validate --gate`** — exit-code verdict for Gas City retry loops and CI; PASS/WARN/FAIL collapses to a process exit code.
- **Real hexagonal port adapters** — `corpus_fs` CorpusReader/Writer, a bd-backed TrackerPort, and a git-backed WorkspacePort, each wired to its core consumer. Port-realness audit in `docs/architecture/`.
- **BDD acceptance layer** — scenario→test linkage runner + CI gate (`soc-63xfx`); canonical `.feature` acceptance added across skills (research/plan/validation/trace/handoff/readme/autodev/flywheel/inject and more) and daemon-lifecycle Gherkin linked to tests.
- **`scripts/ship.sh`** (#346, `soc-33uy`) — single-command wrapper that auto-detects inventory-touching diffs and routes through the full pre-push gate (no `--fast` skip on skill/contract changes), preemptively running the regen sweep (sync-skill-counts, codex-hashes, domain-map, context-map, registry, sync-hooks). Mechanical fix for ship-loop anti-pattern #1.
- **Honest 3.0 doctrine** — `docs/3.0.md` is the canonical north star: AgentOps is in-session; Gas City and Olympus own out-of-session. Doctrine, PRODUCT, and README were reconciled to the in-session core (skills + rpi + evolve + crank + swarm + context-compiler), with the out-of-session autonomous-dispatch gap explicitly labeled (`soc-5jwah`).
- **Version sync to 3.0.0** — `.claude-plugin/plugin.json`, `.claude-plugin/marketplace.json` (metadata + plugins[0]), and the City pack's pinned `AO_VERSION` (`packs/agentops/assets/scripts/install-ao.sh`) all bump to 3.0.0.
- **Coherent-arc PR rule** (#348, `soc-1lp1`) — replaces "one scenario per PR" default in `CLAUDE.md` + `AGENTS.md`. The unit of a PR is one closable bead (or small-epic slice) with a single rollback semantic. Small epics (≤5 child beads, same surface) ship as one PR with N commits; large epics ship as N PRs sliced by scenario or wave. Updates `ship-loop` skill (Claude + Codex twins). Derived from the 2026-05-19 8-PR merge-arc burn-through.
- **6 pre-existing shellcheck warnings** (#349, `soc-j026`) cleaned across `validate-codex-api-conformance.sh`, `goal-failure-taxonomy.sh`, `purge-global-garbage.sh`, `nightly-pr-digest.sh`, `add-validate-job.sh`, `check-skill-size.sh`. All in scripts unchanged from base — atomic side-quest per anti-pattern #2.
- **Local pre-push gate eval-canary strictness mismatch** (#350, `soc-nmhp`) — full-mode eval-canaries now respect the same path filter as CI's `eval-workbench-verify` (`HAS_EVAL=1 || is_ci_env`). Previously `needs_check eval` short-circuited to true in full mode, producing 5 spurious FAILs on doc/script PRs against a baseline-less local env. Closes the "Local-vs-CI environment drift" learning (`docs/learnings/2026-05-07-ci-push-gate-toil-pattern.md`).
- **Release CI shipped red in v2.41.0** — the v2.41.0 tag was cut on a commit where three `Validate` checks were already failing; they were masked because the path-filtered CI marks untriggered jobs `skipped` (not `failed`). This patch clears all three: `registry.json` regenerated after the v2.41 arc added 10 `ao` subcommands; `skills/validation/SKILL.md` links `references/flags.md` with a real markdown link so `heal.sh --strict` passes; the `cli-command-surface-matrix` eval baseline + fixture updated to the current heading count (`top=70 sub=173 all=243`); and 7 `/skillname` slash-command references in `skills-codex/{evolve,validation}/SKILL.md` converted to Codex `$skillname` notation so the codex-native install canary passes.
- **`--oscillation-sweep` removal was incomplete in v2.41.0** — `soc-1q1x` deleted the `ao defrag --oscillation-sweep` flag but the cycle-181 audit only checked Go callers. Seven shell/YAML/doc callsites still referenced the removed flag, breaking the `validate-flywheel-proof` CI gate (`scripts/nightly-dream-cycle.sh` shelled the dead flag). Cleared from `.github/workflows/nightly.yml`, `scripts/nightly-dream-cycle.sh`, `scripts/check-compile-oscillation.sh`, `docs/contracts/dream-run-contract.md`, and the `compile` skill phase docs.
- **`extract-release-notes.sh` double-blank line** — the awk extractor captured the blank line after the `## [VERSION]` heading; wrapped in the `<details>` boilerplate it produced a double-blank between `<summary>` and the first subsection. Now strips leading/trailing blank lines from the changelog section.
- **`ci-local-release.sh` secret-scan false positive** — the secret-pattern scan recursively grepped the gitignored `_site/` MkDocs build directory, matching `password:!0` inside minified JS bundles. Added `_site` and `site` to the scan's `--exclude-dir` list.
- **BC ports — 14/14 production-complete.** `FactoryAdmissionPort` (13th, `soc-2klg.1`) + `productionFactoryAdmission` (cycle 139–140) and `ClaimEvidencePort` (14th, `soc-2klg.2`) + `productionClaimEvidence` (cycle 141–142) land the last two BC4 ports, closing the 14-port BC inventory begun in the v2.40.0 cycle. Each port follows the `<port>.go` + `inmemory_<port>.go` + `inmemory_<port>_test.go` triplet plus a `productionX` production adapter, with compile-time interface assertions as drift guards.
- **10 typed-port-backed `ao` subcommands** — operator-facing CLI now exposes every BC port that needs a script-side surface: `ao loop history` (`productionLoopReader`, cycle 144, slice 1 of `soc-y5vh.5`), `ao ci latest`/`recent` (`productionCIStatus`, cycle 145, slice 2), `ao corpus inject` (`productionCorpusReader`, cycle 146, slice 3; closes `soc-y5vh.5`), `ao operator record`/`list` (cycle 147 — template-applied 1st of 7), `ao harness status` (cycle 148), `ao gate run` (cycle 149), `ao corpus capture` (cycle 150, BC1 R/W pair complete on CLI), `ao loop append` (cycle 151, BC3 R/W pair complete on CLI), `ao citation verify` (cycle 152, BC1 round-trip), `ao claim bind`/`list` (cycle 153, 10th adapter CLI-exposed). Establishes a reusable cycle-shape captured in `docs/learnings/2026-05-13-cli-wiring-cycle-shape.md`.
- **`ao loop verify`** — audits `.agents/evolve/cycle-history.jsonl` integrity via the typed BC3 `LoopReaderPort` (uses cycle-161 widening). Operator-facing health check on the loop ledger.
- **`CycleEntry.StartedAt` + `Title` fields** (`soc-ckc4`, ports widening at cycle 161 + writer-side round-trip at cycle 162). Enables the `ao loop verify` audit and richer downstream consumers of the cycle ledger.
- **Supergate Gap 3 (loop-closure) bats coverage** — `tests/scripts/check-three-gap-supergate.bats` extended with three tests (happy-path PASS, `goals-validate` FAIL, `flywheel-proof` SKIP) using a PATH-shimmed `go` that produces a controlled `/tmp/ao-sg` (`soc-wxh5.3`). Suite goes 15 → 18 tests; closes the cycle-63 Gap 3 deferral.
- **Mandatory STEP 1.7.5 release-readiness gates** in `/validation` — auto-detects release context from branch name (`release/*`, `v*-prep`, `v*-evolve-run`, `v\d+\.\d+*`) or `--release-context` flag and requires `scripts/pre-push-gate.sh` (full, not `--fast`), `scripts/ci-local-release.sh`, and `scripts/generate-cli-reference.sh` cleanliness check when CLI surface changed. Validation refuses to recommend `/release` until all three pass. Codex parity synced.
- **`/evolve` teardown pre-release checklist** — when the loop runs on a release-shaped branch, the teardown report emits an explicit unchecked checklist (regen CLI docs, full pre-push, `ci-local-release.sh`, optional smoke run) instead of recommending `/release`. The handoff artifact carries the checklist verbatim; "ready to tag" means boxes checked, not cycles green.
- **Acceptance-Text vs Delivered Drift audit** in `/post-mortem` closure-integrity check — for each closed child, parses the bead `Acceptance:` section, extracts named gates, and WARNs when the close-note does not confirm the gate ran green. Catches the failure mode where a bead's acceptance language drifts from delivered evidence (origin: cycle 182 `soc-w6vh.4`).
- **`.agents/operator/` write-surface contract entry** — `docs/contracts/agents-write-surfaces.md` now documents the BC4 `OperatorPort` durable-intent log (allowlist + classification row, lifecycle=`rolling`, writer=`cli`).
### Changed
- **`/evolve` Step 0 prior-knowledge retrieval** now routes through the typed BC1 `CorpusReaderPort` (`cli/cmd/ao/corpus_reader_adapter.go`, cycle 112 `productionCorpusReader`) via `ao corpus inject` instead of the legacy `ao lookup` shell-out (`soc-y5vh.1`). Skill text in `skills/evolve/SKILL.md` and `skills-codex/evolve/SKILL.md` synced; codex hashes regenerated.
- **`/evolve` Step 1.5 healing-first classifier** now routes through the typed BC2 `CIStatusPort` (`cli/cmd/ao/ci_status_adapter.go`, cycle 117 `productionCIStatus`) via `ao ci recent --limit 1` instead of an inline `gh run list --workflow validate.yml --json conclusion` (`soc-y5vh.2`). Both callsites (`skills/evolve/SKILL.md` + `skills/evolve/references/convergence-mechanics.md`) updated in lockstep. Zero remaining inline `gh` shell-outs in `/evolve`'s hot read path.
- **`cli/cmd/ao` coverage floor** raised back to 76 % in `scripts/check-cmd-ao-coverage.sh` after real statement coverage climbed to 76.1 % (23553/30953) on the v2.41-evolve-run baseline (`soc-wxh5.1`). The cycle-60 recalibration to 75 % is reversed.
- **`/evolve` session-state refresh at Step 0** so the dormancy gate stays correct after long-running cycles harvest follow-ups (cycle 171 retrospective fix).
- **`/release` skill refactor** — moved Examples + Troubleshooting + the non-HEAD cut-version logic into `references/release-workflow-detail.md` to bring `SKILL.md` back under the `tier=execution` size limit. Behavioral surface unchanged; cycle 169 post-mortem restoration commit restored Examples and Troubleshooting after the initial extraction.
- **`three-gap-supergate` goals-validate sub-gate** — `scripts/check-three-gap-supergate.sh` now `rm -f /tmp/ao-sg` before `go build -o /tmp/ao-sg`. Go refuses to overwrite a non-object file at the build-output path, so any prior process that wrote a non-binary to `/tmp/ao-sg` (including the bats-test shim go) would otherwise wedge the gate. The bats teardown in `tests/scripts/check-three-gap-supergate.bats` also cleans `/tmp/ao-sg` to remove test pollution. Caught by `ao goals measure` (1 failing → 0 failing) — first validation that the new STEP 1.7.5 mechanical gate works on real drift.
- **Dead `defrag.SweepOscillatingGoals` function** and all callers (`soc-1q1x` path 1). The function read `.agents/evolve/cycle-history.jsonl` for entries with a `target` field; zero entries have ever had one in production, so callers (`runCompileDefrag`, `runDefragPhases`, `runDreamDefragPreview`) always got empty results. Net removal: 6 files, 17 insertions / 465 deletions — `SweepOscillatingGoals` + 5 helpers + `CountAlternations` + `CycleRecord` + `OscillationResult` + `OscillatingGoal` types + `DefragReport.Oscillation` field + `defragOscillationSweep` flag + `--oscillation-sweep` CLI flag + 9 tests. Build green; 11924 tests pass.
- **43 dead-code findings swept from `cli/`** — across multiple cycles (156 cleared 10 `staticcheck` U1000 findings, 157 swept 18 more, 158 swept 10 more, 159 swept 5 more from `soc-k083`). Closes long-standing static-analysis backlog; `LoadCycleHistory` deletion (cycle 156) was the canonical example of the dead-code pattern that `soc-1q1x` later applied to oscillation-sweep.
- **Practice-citation derivation graph** — `PRACTICE-REGISTRY.md` becomes the derivation root for every primitive in the repo. A new `practice-citation derivation graph + advisory CI gate` enforces that every skill, hook, eval suite, CLI command, and schema declares its `practices:` lineage. Twelve backfill passes (`pass-1` through `pass-12`, four `pass-12` waves across `cli/`) reached **756/756 declared** primitives — full repo coverage. Touches `skills/`, `hooks/`, `schemas/`, `evals/agentops-core/`, and `cli/` via `// practice:` comment carriers.
- **Three-gap supergate (E5 epic)** — `scripts/check-three-gap-supergate.sh` consolidates three release-blocking gates into one entry point with Gap 1 `--strict-coverage` opt-in, wired into `scripts/pre-push-gate.sh` and the `validate-three-gap-supergate` CI workflow. Closes `soc-m47k` and three child gaps.
- **Contract enforcement gates** — `contracts-structural-floor` (covering all 38 contracts), plus dedicated CI-blocking gates for `factory-admission`, `finding-registry`, `factory-yield-ledger`, `flywheel-compounding-snapshot`, `wiring-closure`, `goals-validate`, `flywheel-proof`, `quarantine-empty`, and `contract-canaries` (`check 24e`). `feat(gate) --two-pass mode` and local-scope default added.
- **Behavioral eval workbench** — 12 eval tasks, first suite, three fixture components (Go CLI, Python FastAPI, DevOps scripts). Live-agent eval suite with 3 workbench cases, `scripts/eval-agent-harness.sh` wired into the eval CLI, and the suite expanded to all 12 workbench tasks.
- **Eval CI gates** — `eval-skill-delta` CI gate + nightly schedule template, `eval-workbench-verify` gate (GOALS.md Directive 10), head-to-head delta gate against the baseline scorecard (D10). Run records upload as CI artifacts for triage; Python venv bootstrapped in `agentops-eval-advisory`.
- **Eval harness primitives** — `context_comprehension` dimension, CDLC identity field, observability feedback loop, and industry-proven eval patterns added to the agent harness.
- **Unified registry** — Phase 1 added `scripts/generate-registry.sh` + `registry.json` source-of-truth. Phase 2 added a job type, CLI surface, and CI gate (`registry-check`).
- **`security` domain in eval-suite manifests** — `$defs/domain` enum in `schemas/eval-suite.v1.schema.json` now accepts `security` alongside the existing eight domains. Paired updates land in `cli/internal/eval/coverage.go` (`DefaultCoverageDomains`) and `cli/cmd/ao/cobra_commands_test.go` (`evalCoverageDomains`) so schema, production default, and test fixture stay in lock-step. `ao eval coverage` will report `security` as a missing required domain until a security-domain manifest is authored.
- **Three-layer product model adopted across surfaces** — README, `PRODUCT.md`, `docs/index.md`, and downstream positioning docs aligned to the three-layer (substrate / assurance / bookkeeping) framing with the software-factory + TSMC + in/on-the-loop framing. Eight `docs(positioning)` commits cover the thesis polish, lineage cleanup, link to `vs-compound-engineer.md`, and the closure of `soc-yjzp.9` with empirical Δ=0.
- **`/release` skill refactored under the size limit + non-HEAD cut support** — `skills/release/SKILL.md` and the Codex twin shrank from 545 lines to a 141-line flow index, with the detail extracted to `references/release-workflow-detail.md`. A new `references/release-cut-and-bump.md` documents the `release/v<ver>` branch pattern for cutting at a non-HEAD SHA. (This is the commit that prepared the v2.40 cut itself.)
- **CI workflow path-filters** — added path-filter conditions to 28 CI jobs (the remaining tail); bats path-filter wired so `.bats` changes gate bats-test jobs; `bats` prints captured output on failure.
- **Documentation reorg** — `docs(claims)` introduced a public evidence manifest for v2.39 README claims (PG4); `docs(parity)` updated four times; `docs(cdlc)`, `docs(readme)`, `docs(eval)`, `docs(release)`, `docs(positioning)` swept across the catalog.
- **Dependencies bumped** — `chore(deps)` updates for `mkdocs-material` v9.7.6, `mkdocs-section-index` v0.3.12, `mkdocs-literate-nav` v0.6.3, `mkdocs-include-markdown-plugin` v7, `mkdocs-git-revision-date-localized-plugin` v1.5.1, `mkdocs-gen-files` v0.6.1, `linkchecker` v10.6.0, `pymdown-extensions` v10.21.2, Python 3.14, `dorny/paths-filter` v4. `deps(go)`: `pgregory.net/rapid` minor bump in `cli/` plus a go-minor-patch group bump (#268).
- **`fix(ci)`** — registry non-determinism + pre-push goals-validate fallback; structural CI failures from cycles 45-47; `registry.json` knowledge_stores and schedules must match gitignored-state regen (epic `soc-sx99`); refreshed registry generation; bumped CLI surface counts after `patterns repair-filenames` addition; close practice-provenance validator gaps; `--single-pass` on pre-push-gate tests broken by `--two-pass` default.
- **`fix(eval)`** — six fixes covering eval canary refresh, advisory job stabilization, run-record upload reliability, and miscellaneous workbench-suite drift.
- **`fix(hooks)`** — reconcile stale `.agents/.gitignore` deny-all with parent allowlist (`soc-rv5p`, #263); prove `pre-push` transmits refs (#254).
- **`fix(codex)`** — migrate deprecated hooks flag; remove dead Claude-specific references and runtime markers from the codex research skill.
- **`fix(cli/rpi)`** — three correctness fixes around RPI scoping and isolation enforcement.
- **`fix(daemon)`** — bound daemon RPI GasCity sessions; close unused-variable in `generate-registry.sh`; refresh CI registry after worker-spec additions.
- **`fix(flywheel-lifecycle)`** — survive sparse corpus in Stage 5.
- **`fix(next-work)`** — add `dream-degraded` to the source enum.
- **`fix(nightly)`**, **`fix(harvest)`**, **`fix(audit-truth)`**, **`fix(evolve)`**, **`fix(parity)`**, **`fix(worktree)`**, **`fix(coverage)`**, **`fix(skills)`**, **`fix(quickstart)`**, **`fix(scripts)`**, **`fix(docs)`**, **`fix(gates)`**, **`fix(pre-push)`**, **`fix(heal,lint)`**, **`fix(rpi)`** — a long tail of single-file fixes touching individual gates, scripts, and surfaces during the nightly close-loop cycles.
- **GitHub eval advisory setup** — the `agentops-eval-advisory` job now installs the deterministic canary toolchain (`jq`, `ripgrep`, `bats`, `bd`, and `gocyclo`) and initializes a disposable bd database before running `scripts/eval-agentops.sh --fast`, matching the local environment expected by the public canaries.
- **RPI loop pass consumption** — 10 `chore(rpi)` consumption commits drove the practice-citation backfill epic through 12 passes, closing the `cli/` design pass and exhausting the schemas/hooks/evals pools en route to `756/756 declared`.
- **Refactors** — `refactor(daemon)` extracted routing-lane validators to drop cyclomatic complexity (two commits); `refactor(dream)` promoted probe shapes to the registry.
- **Codex artifact hashes** regenerated after enum updates and after merges.
- **Skill counts synced** to 71 after the consolidation passes.
- **AgentOps daemon runtime** - landed opt-in `agentopsd` as the local control plane for durable jobs, queueing, worker execution, projections, health/readiness/status, event tailing, mutation tokens, and product soak proofs. New CLI surfaces include `ao daemon run`, `ready`, `status`, `events tail`, `jobs list/show/submit/wait/cancel`, `service install`, and `soak`.
- **Daemon-backed workflows and scheduling** - RPI, Dream, wiki/forge, and plans now have migration paths into the daemon via explicit daemon flags, `plans.projection`, worker policies, and projections. `.agents/schedule.yaml`, `ao schedule add/list/run/remove`, daemon `--schedule-file`, cron validation, backpressure controls, schedule mutation routes, and recurrence ledger events make recurring work a daemon-owned primitive.
- **Dream and work-queue metadata** - added finding-generator sidecars, aggregation, external-watchlist output, end-user coverage fitness gates, and first-class next-work `status`, `requires`, `dedup_key`, and routing metadata.
- **`.agents/` write-surface governance** - catalogued repo memory write surfaces, added lint/smoke coverage, introduced the no-tracked-`.agents` policy, and added operator docs for working with runtime state.
- **Harvest and knowledge surfaces** - harvest now recurses into nested artifact directories, emits real rig metadata, and gained native Go extraction support.
- **CLI architecture refactor** - reorganized large parts of the Go CLI around focused internal packages for daemon state, worker execution, GasCity, schedule parsing, eval, path resolution, lifecycle, harvest, OpenClaw, LLM wiki execution, safety, and quality checks.
- **Daemon migration model** - foreground RPI, Dream, plans, and wiki/forge paths remain compatible, while daemon submission/read paths move runtime ownership toward the durable ledger and rebuildable projections.
- **Hook runtime and context flow** - re-architected hooks around JIT context and a managed runtime backend, added Claude/Codex PreToolUse output parity checks, quieted Codex session-start behavior, and added edit/write hash-audit hooks.
- **Path resolution** - moved `.agents` and repo-state path logic toward shared Go/shell resolvers (`cli/internal/paths`, `lib/ao-paths.sh`) and migrated representative CLI commands and hooks to the new helpers.
- **Codex runtime packaging** - refreshed Codex skills for GPT-5.5, aligned native plugin metadata with the marketplace schema, regenerated manifests and hashes, converted remaining skill references to `$skill` notation, tightened native hook installation, and reduced skill-catalog context footprint.
- **Release and CI governance** - CI/local gates now cover daemon product proofs, contract canaries, eval baselines, command/test pairing, Codex runtime sections, pre-push wiring, release audit artifacts, Windows smoke, advisory policy, and nightly knowledge-cycle dedupe.
- **Docs and operator contracts** - added or expanded daemon, scheduling, control-plane, GasCity, OpenClaw, local compute routing, operator guide, and release governance documentation.
- **Daemon API and execution hardening** - capped request bodies, bounded event limits, normalized wait timeout errors, rejected bad cursors and malformed schedule payloads, hardened wiki source-path containment and schedule name traversal, tolerated oversized ledger lines, preserved Dream log permissions, and routed Dream/wiki execution through the foreground supervisor.
- **Security and scanner false positives** - closed the harvest TOCTOU path with `os.OpenRoot`, excluded safe regexp literals from broad secret scans, split secret-regex construction so release gates do not flag their own patterns, and removed pipe-to-shell patterns from the ripgrep builder.
- **CI/nightly/release blockers** - repaired eval advisory fixtures, baseline-audit drift-only behavior, Windows smoke paths, shellcheck/pre-push gate regressions, knowledge-cycle dormant-corpus handling, release audit validation, and the canary count drift found during final v2.39.0 validation.
- **Strict Delegation Contract** for `/rpi`, `/discovery`, and `/validation` — top-level orchestrator skills now declare strict sub-skill delegation as the default. Each skill points to the new canonical reference `skills/shared/references/strict-delegation-contract.md` which documents the contract, anti-pattern rationalizations, and supported compression escapes (`--quick`, `--fast-path`, `--no-retro`, `--no-forge`, `--skip-brainstorm`, `--no-scaffold`, `--no-behavioral`, `--allow-critical-deps`). There is no `--full` flag — strict delegation is always on.
- **Orchestrator Compression Anti-Pattern learning** at `docs/learnings/orchestrator-compression-anti-pattern.md`, surfaced through the orchestrator skill contracts. Includes detection phrases, corrective actions, and rationalizations to reject.
- **Orchestrator-owned step markers** in `skills/crank/SKILL.md` (STEP 3a.3, STEP 6.5 slop-scan, STEP 8.7) plus an "Inline Work Policy" footer documenting which steps are intentionally inline vs delegated.
- **MkDocs Material documentation site** — Pages site rebuilt on MkDocs Material (slate dark palette). Skill catalog and CLI reference are generated at build from `skills/*/SKILL.md` and `cli/docs/`. `mkdocs build --strict` wired into the pre-push gate (Check 25a). New dedicated pages for hooks, schemas, and upgrading, plus an expanded glossary. Theme tuned to the agentops-showcase terracotta-on-near-black palette; landing page leads with the primary use case and a headline skills table; flywheel diagram ASCII art realigned; doctrine back-links added to `12factoragentops.com`.
- **Shell completion for enumerated-value flags** — `ao <cmd> --<flag> <TAB>` now suggests the valid values instead of falling back to file completion. Covers `ao --output` (`json`/`table`/`yaml`), `ao seed --template`, `ao goals init --template`, `ao inject --format` and `--session-type`.
- **`ao doctor` stale-reference scan** now covers `skills-codex/*/SKILL.md` and `skills/*/references/*.md` in addition to the primary skill docs, catching drift in Codex mirrors and skill reference content.
- **Nightly close-loop throughput alarm** — the dream close-loop gate now fails loudly when `ingested > 0 && promoted == 0`, replacing the silent zero-throughput mode that previously masked citation-gate deadlocks.
- **`--no-lifecycle` in `/discovery` renamed to `--no-scaffold`** for semantic clarity — the flag controls STEP 4.5 scaffold auto-invocation only, not broader lifecycle checks. `--no-lifecycle` is honored as a deprecated alias through v2.40.0; when both flags are passed, they are equivalent. Other skills (`/crank`, `/validation`, `/implement`, `/evolve`) retain `--no-lifecycle` with its existing lifecycle-skill-invocation semantics.
- **`/discovery` flags table** expanded: `--auto` is now explicitly documented (was transitively honored but undocumented); `--interactive` scope clarified ("research + plan gates, not pre-mortem").
- **`/validation` flags table** expanded: `--complexity=<level>` syntax formalized to match `/rpi` and `/discovery`; `--interactive` scope documented.
- **`/rpi``--interactive` flag** scope note added: applies to discovery (research + plan) and validation (Gate 1, Gate 2); does NOT override pre-mortem or vibe council autonomy.
- **ASCII fast-path performance sweep** across rune-aware truncation call sites in `cli/` (`TruncateText`, `TruncateRunes`, `truncateForError`, plus goals/pool/search/rpi/parser call sites) — ASCII inputs now skip the full UTF-8 rune scan.
- **Compile and overnight internals refactored** — `runCompile` split into phase + preflight helpers; article scan, inbound count, and prune extracted from `repair`; dream packet corroboration split per source epic; dream yield emptiness guard extracted into a dedicated helper. No behavior change; lower cyclomatic complexity and tighter test surfaces.
- **Skills-codex DAG bodies converted to `$skill` notation** for the Codex runtime.
- **Orchestrator compression vulnerability** — a live compression was observed 2026-04-19 where `/rpi` was invoked but phases were inlined instead of delegated. This release **documents** the anti-pattern (forged learning + loud skill text), **scaffolds** future enforcement (shared contract reference used by all 6 orchestrator skills), and explicitly **defers** runtime hook enforcement to a follow-up initiative. It does not mechanically prevent compression yet — the durable fix depends on `ao inject` surfacing the forged learning on future session starts. See `.agents/research/2026-04-19-rpi-skill-dag-audit.md` for the audit and `.agents/plans/2026-04-19-rpi-dag-hardening.md` for the remediation plan.
- **Close-loop promotion deadlock** — `flywheel` close-loop auto-promotion and the loop-dominance signal are unblocked; citation-gate cycles no longer silently zero throughput.
- **Overnight findings router** now emits schema-compliant `next-work` v1.3 enums — valid `claim_status=available` (was `pending`), severity collapsed to `high` for `critical` and `blocker` inputs — with a build-time guard that fails on future drift.
- **Quality stale-refs scan** skips rename-doc lines so it no longer false-positives on deliberate rename notes.
- **Release and compile gates** — `go-complexity-ceiling` self-heals a missing `gocyclo`; `compile-*` gates fall back to Dream defrag preview when the primary path is unavailable.
- **Proof-run Phase 2** calls `pool ingest` before `close-loop` so the downstream stage has input to consume.
- **Hooks** — `git-worker-guard` narrowed to avoid false blocks on selective flags; test-hook harness tolerates environments without a locally built `ao`.
- **Scripts** — `goal-staleness`, `pillar-coverage`, `goal-quality`, and `bootstrap-maturity` now skip cleanly after the `GOALS.yaml → GOALS.md` migration and preserve existing JSONL maturity with compact output.
- **CI** — resolved 7 failures from the MkDocs rebuild, committed the forged-learning artifacts, and regenerated the codex shared hash.
- **Docs markdownlint** — unresolved `+ 9 findings).` continuation in the cross-disk harvest plan now reads as prose instead of tripping MD004.
- **Swarm evidence validation** — AgentOps now ships a swarm-evidence schema and validator, and wires that proof surface into validation and release gates.
- **Lead-only worker git guard** — worker sessions now have an explicit lead-only git guard in the hook chain, reducing accidental write authority in multi-agent runs.
- **Compile and harvest operator controls** — `ao compile` adds runtime preference plus `--reset` and `--repair` controls, while harvest now reports excluded low-confidence candidates and top near-misses.
### Changed
- **Release and pre-push validation** — local release, pre-push, and command coverage gates now validate more of the hook, evidence, and Codex runtime surface before publish.
- **Codex/runtime artifacts and docs** — compile, evolve, post-mortem, swarm, and related runtime docs and artifacts were decomposed and synchronized to better match shipped behavior.
- **Flywheel backlog bookkeeping** — next-work aggregates, consumed markers, and enum normalization were cleaned up so carry-forward work is recorded consistently.
### Fixed
- **Pre-mortem gate ambiguity** — the crank pre-mortem gate now denies ambiguous state by default instead of failing open.
- **CLI and shell reliability edges** — `ao rpi serve --run-id` now accepts legacy 8-hex IDs, `ao mine --dry-run` emits a single clean JSON payload, and bash invocations are sanitized to bypass unsafe shell aliases.
- **Compile, harvest, and release drift** — compile repair defaults, malformed frontmatter salvage, YAML parse error surfacing, CI fixture drift, shellcheck drift, and Codex artifact metadata drift were corrected.
- **Dream morning packets** — Dream can now emit ranked morning work packets with evidence, target files, exact follow-up commands, and queue/bead handoff metadata.
- **Dream yield telemetry and long-haul corroboration** — overnight reports now record packet-confidence telemetry and can trigger a bounded long-haul corroboration pass when the first pass produces weak morning output.
### Changed
- **Dream decision flow** — overnight runs now prefer cheaper evidence corroboration before slower council fan-out, so strong runs stay short and extended runtime is reserved for genuinely weak output.
### Fixed
- **Headless Claude Dream council** — Dream now uses Claude's working JSON output contract for headless council runs and normalizes the returned envelope before validation.
- **Dream close-loop and report surfaces** — overnight runs now write real close-loop callbacks and post-loop report artifacts instead of leaving placeholder `pending` steps.
- **Retrieval ratchet release gate fallback** — the retrieval-quality release check now falls back to checked-in eval data when a local manifest is absent.
- **Windows install and smoke coverage** — `scripts/install-ao.ps1` adds a first-class Windows install path, and the blocking `windows-smoke` gate exercises PowerShell install, local `ao doctor`, and Windows-sensitive Go packages.
- **Compile command** — `ao compile` makes knowledge compilation a first-class CLI surface with docs and tests.
- **Local LLM forge pipeline** — `ao forge` can now redact, summarize, structurally review, and queue transcript-derived wiki pages with Dream worker integration.
- **Dream curator and evolve sub-cycle** — Dream gained a local curator adapter plus `ao evolve --dream-first|--dream-only`, allowing overnight knowledge passes to feed the daytime improvement loop.
- **`.agents` wiki surfaces** — INDEX, LOG, wiki directories, and search integration formalize `.agents/` as a Karpathy-style knowledge wiki with index-first navigation.
- **Operational quality surfaces** — beads audit/cluster commands, swarm preflight advice, status quality signals, retrieval eval queries, and a retrieval-quality CI ratchet broaden release-time proof.
### Changed
- **Knowledge scoring and search behavior** — inject now deduplicates by content hash, boosts indexed pages, weights stability, and search can pull Dream vault and wiki sources with stronger local recall.
- **Overnight and RPI internals** — overnight, lifecycle, search, inject, harvest, and RPI flows were decomposed into smaller helpers while tightening proof paths, mixed-mode provenance, and worktree cleanup.
- **Public framing and contributor docs** — README, philosophy, planning/post-mortem docs, and reference surfaces now better match the context-compiler and operational-layer story.
- **Windows overnight liveness** — Windows process checks no longer rely on Unix `signal(0)` semantics.
- **Dream RunLoop status invariants** — live-tree hash coverage now exercises every terminal RunLoop status, and `degraded` reflects the current rollback semantics.
- **Release retag safety** — release tooling now preserves annotated tags, validates audit artifact manifests and refs, and cancels stale reruns before duplicate publish attempts.
- **Post-mortem and closure audits** — metadata links, evidence-only closure packets, parser-path handling, and closure packet evidence modes were normalized.
- **Codex and runtime reliability** — same-thread lifecycle restart, root-scoped fallback reads, JSON config writes, bridge contract validation, and next-work proof-path handling were hardened.
- **Evolve operator command** — `ao evolve` now exposes the v2 autonomous improvement loop directly in the CLI, including `--max-cycles`, `--queue`, `--beads-only`, `--quality`, `--compile`, and strict-quality passthrough flags.
- **Autodev program contract** — root `PROGRAM.md` gives evolve/autodev a repo-local operating contract with mutable and immutable scope, validation commands, escalation policy, and stop conditions.
- **Beads stale-scope tooling** — `ao beads verify|lint|harvest` adds first-class stale-citation checks for bead-driven planning and RPI recovery.
- **RPI discovery artifacts** — RPI can now persist and consume discovery artifacts, with tests and docs covering the `--discovery-artifact` path.
- **Dream failed-summary contract coverage** — regression tests now lock the `finalizeOvernightSummary` contract for MEASURE consecutive-failure halts and persisted iteration history.
- **Nightly live retrieval proof** — the dream-cycle now runs `ao eval bench --live --json`, emits retrieval proof in nightly summaries, and keeps a visible artifact trail for flywheel health
- **Pattern-to-skill drafts** — repeated patterns can now generate review-only skill drafts under `.agents/skill-drafts/` during flywheel close-loop
- **Fresh-repo onboarding welcome** — new session-start routing helps first-time repos enter discovery, implementation, or validation without needing the full RPI lane first
- **Docs-site and contribution proof surfaces** — GitHub Pages navigation, comparison pages, behavioral-discipline guidance, strategic-doc validation patterns, and a first-skill guide expand the public proof surface
- **RPI wave recovery integrated** — recovered RPI wave work landed across Dream, council, stale-scope planning, discovery artifacts, CI hardening, and Codex runtime surfaces.
- **Council `--mixed` strict contract documented** — `skills/council/references/cli-spawning.md` documents that `/council --mixed` requires Codex CLI and emits a hard error instead of silently falling back to Claude-only.
- **Plan and pre-mortem skill bodies decomposed** — focused reference files now carry the detailed pre-decomposition, scope-mode, mandatory-check, output, wave-matrix, and task-creation guidance while keeping the top-level skills within lint budgets.
- **Bead-input pre-flight wired into planning skills** — `/plan` and `/pre-mortem` invoke `ao beads verify <bead-id>` for full-complexity, aged, or prior-session bead inputs before decomposition or validation.
- **Operational-layer framing** — README, onboarding, docs, comparisons, and linked surfaces now consistently explain AgentOps as bookkeeping, validation, primitives, and flows for coding agents
- **Dream runtime positioning** — the public GitHub nightly is now documented as a proof harness, while `ao overnight` is documented as the private local compounding engine
- **Codex default path** — native hooks, install copy, runtime smoke coverage, and checked-in Codex artifacts are aligned around the native-plugin path on supported Codex versions
- **Validation guidance** — behavioral-discipline and strategic-doc review are now first-class references alongside code review and runtime validation
- **Windows Codex installer** — Codex installation now has a Windows path instead of assuming Unix shell behavior.
- **golangci-lint v2 contract** — the local lint wrapper and CI configuration now pin the v2 behavior expected by the repository.
- **security-toolchain-gate CI** — deterministic fixture generation in `cli/internal/overnight/fixture/gen_fixture.go` is annotated as a non-cryptographic seeded-random use, avoiding a false-positive semgrep blocker.
- **Recovered RPI validation blockers** — validation drift from the recovered RPI wave was cleared before retagging the release.
- **Stale-scope reference placement** — shared stale-scope validation guidance now lives under `skills/shared/references/` so `heal.sh --strict` can resolve it consistently.
- **Release and CI drift** — resolved docs-site Liquid/frontmatter issues, headless runtime smoke portability problems, pre-push shim test drift, and compile-skill headless command drift caught during release prep
- **Codex install and artifact drift** — fixed stale slash-command references, refreshed checked-in artifact metadata, added a Codex compile wrapper, and corrected plugin/marketplace mismatches exercised by smoke coverage
- **Runtime proof stability** — promoted Codex runtime smoke into the blocking smoke path and fixed related shellcheck and install-surface rough edges
### Removed
- **DevOps-rooted tagline** — public framing no longer leads with the old DevOps-layer tagline; the Three Ways lineage remains supporting doctrine instead of the category label
- **Test shuffle in CI** — `-shuffle=on` added to `validate.yml` and `Makefile` test targets, exposing and fixing 6 ordering-dependent tests (cobra flag leaks, maturity var leaks, env var leaks)
### Changed
- **CLI internal extraction (waves 5-13)** — business logic extracted from `cmd/ao` monolith into 15 `internal/` domain packages (`rpi`, `search`, `context`, `quality`, `goals`, `lifecycle`, `bridge`, `forge`, `mine`, `plans`, `knowledge`, `storage`, `pool`, `taxonomy`, `worker`) using Options struct pattern for dependency injection
- **Goals test migration** — 7 goals test files moved from `cmd/ao` to `internal/goals` as external test package (`goals_test`) with `t.Parallel()` and direct `goals.Run*()` calls replacing cobra command wiring
- **Test isolation** — `resetCommandState` now saves/restores 10 maturity globals; `resetFlagChangesRecursive` resets flag values to defaults; RPILoop and toolchain tests clear `AGENTOPS_RPI_RUNTIME*` env vars via `t.Setenv`
### Fixed
- **Defrag test flag leak** — `TestDefragOutputDirFlag` used `cmd.Flags().Lookup("output")` which matched the root persistent `--output` flag; changed to `cmd.LocalFlags().Lookup("output")`
- **Goroutine leak false positive** — `TestRunGoals_GoroutineLeak` used `goleak.VerifyNone` which caught goroutines from parallel tests; switched to `goleak.IgnoreCurrent()` to only detect leaks within the test itself
- **Secret scan false positives** — excluded `.gc/` directory and `Getenv`/`os.Environ` patterns from secret pattern scan
- **Codex skill validation** — added `output_contract` as valid schema key, `cross-vendor`/`knowledge` as valid tiers, fixed `$/` prefix in codex forge/post-mortem/scenario skills
- **Coverage percentage CI gates** — removed `coverage-ratchet` job, `check-cmdao-coverage-floor.sh`, `.coverage-baseline.json`, and associated BATS tests; percentage gates blocked CI during architectural refactors without catching bugs
- **`fire.go`** — FIRE loop (find-ignite-reap-escalate) superseded by gc sling + bead dispatch; `formatAge` helper moved to `inject_predecessor.go`
- **`rpi_workers.go`** — per-worker health display superseded by gc agent health patrol; `ao rpi workers` subcommand removed from CLI and docs
- **Knowledge activation skill** — new `/knowledge-activation` skill and CLI surfaces for activating cross-domain knowledge at runtime, with operator surface consumption and ranked intelligence context
- **Session intelligence engine** — complete runtime engine with explainability, ranked context assembly, and trust policy enforcement
- **Runtime selection for `ao rpi serve`** — serve now supports explicit runtime selection for Claude and Codex execution modes
- **Quality signals hook** — new `quality-signals.sh` hook with test coverage for session quality telemetry
- **Pre-push gate expansion** — 9 checks migrated from CI-only to the local pre-push gate for faster feedback
- **Inject stability warnings and status dashboard** — closed 3 harvest items with signal tests and dashboard improvements
### Changed
- **README refresh** — product-minded rewrite with gain-framing and Strunk-style prose fixes
- **Philosophy doc** — new `docs/philosophy.md` and observations section added to README
- **Documentation alignment** — repo front doors and codex artifact guidance unified across entry points
- **Claude Code architecture lessons** — retry budgets, stability flags, quality signals, and orchestration patterns applied to skills
- **Homebrew formula** — updated to v2.31.0 with pre-built binaries
- **9 lifecycle skills** — bootstrap, deps, design, harvest, perf, refactor, review, scaffold, and test skills wired into RPI with auto-invocation and mechanical gates
- **`ao harvest`** — cross-rig knowledge consolidation extracts and catalogs learnings from sibling crew workspaces
- **`ao context packet`** — inspect stigmergic context packets for debugging inter-session handoff state
- **Codex hookless lifecycle support** — `ao codex` runtime commands, lifecycle fallback, and Codex skill orchestration now cover hookless sessions end to end
- **PROGRAM.md autodev contract** — Added a first-class `PROGRAM.md` contract for autodev flows and taught `/evolve` and related RPI paths to use it
- **Long-running RPI artifact visibility** — Mission control now exposes run artifacts and evaluator output so long-running RPI sessions are replayable and easier to inspect
### Changed
- **Codex runtime maintenance flow** — Refreshed Codex bundle hashes, lifecycle guards, runtime docs, and release validation coverage around the expanded Codex execution path
### Fixed
- **Codex RPI scoping and closeout** — Tightened objective scope, epic scope, closeout ownership, and validation gaps in the Codex RPI lifecycle
- **Release gate reliability** — Restored headless runtime coverage, runtime-aware Claude inventory checks, and release-gate coherence validation
- **Reverse-engineer repo hygiene** — Repo-mode reverse engineer now ignores generated and temp trees when identifying CLI and module surfaces
- **Model cost tiers and config writes** — `ao config` can now assign per-agent models by cost tier and persist repo configuration changes directly
- **Search brokerage over session history and repo knowledge** — `ao search` now wraps upstream `cass` results with repo-local AgentOps artifacts by default
- **Reviewer and post-mortem reference packs** — Added model-routing, iterative-retrieval, confidence-scoring, write-time-quality, and conflict-recovery guidance across council, research, swarm, vibe, compile, and related skills
- **Competitive comparison and CLI docs** — Refreshed comparison docs, release smoke coverage, and command documentation around the expanded search/config surface
### Fixed
- **Flywheel proof and citation loop** — Added deterministic proof fixtures, preserved exact research provenance, and made citation feedback artifact-specific so flywheel health reflects real closure state
- **Search alignment with forged session history** — Search now stays aligned with forged session artifacts and fallback behavior
- **Hook-launched validation** — Pre-push and release gates now isolate inherited git env/stdin correctly and cover newer hook scripts in integration tests
- **Codex council profile parity** — Source and checked-in Codex council docs are back in sync for the shared profile contract
- **Flywheel golden signals always shown** — Golden signals were gated behind `--golden` flag, causing `ao flywheel status` to report "COMPOUNDING" while the hidden golden signals analysis showed "accumulating". Golden signals now compute and display by default.
- **Flywheel golden signals** — Four derived health indicators (velocity trend, citation pipeline, research closure, reuse concentration) that distinguish knowledge compounding from noise accumulation; accessible via `ao flywheel status --golden`
- **Forge-to-pool bridge** — Forge auto-writes pending learnings as markdown to `.agents/knowledge/pending/` for close-loop pool ingestion
- **SessionStart citation priming** — `ao lookup` wired into SessionStart hook to close the citation gap between inject and session context
- **Skill catalog quality** — Improved descriptions, extraction patterns, and reference linking across skill catalog
### Fixed
- **`.agents/.gitignore` scope** — Replaced broad `!*/` pattern with explicit subdirectory list to prevent accidental tracking
- **RPI stops after Phase 2** — Restructured rpi, discovery, and validation orchestrator skills as compact DAGs with execution sequence in a single code block; eliminates LLM stopping between phases due to `###` section headings acting as natural breakpoints
- **Test grep patterns for DAG headings** — Updated `test-tuning-defaults.sh` to match new complexity-scaled gate headings after DAG restructure
### Changed
- **Goals reimagined** — GOALS.md rebuilt from first principles with fitness gate fixes
- **README progressive disclosure** — Lead with moats, collapse detail into expandable sections
- **CLI reference docs** — Regenerated with updated date stamps
- **Doctor + findings helpers** — Added CLI test coverage for extracted helpers
- **BF6–BF9 test pyramid levels** — Regression (bug-specific replay), Performance/Benchmark, Backward Compatibility, and Security (in-test) bug-finding levels with language-specific patterns for Go and Python
- **Test pyramid decision tree expansion** — 4 new routing questions for BF6–BF9 in the "When to Use" guide
- **Codex skill API contract** — `docs/contracts/codex-skill-api.md` with conformance validator
- **Output contract declarations** — `output_contract` field on council, vibe, pre-mortem, research skills with canonical finding-item schema
### Changed
- **Codex converter rewrite** — Strips Claude primitives instead of mapping to unavailable tools; rewrites reference files through `codex_rewrite_text`
- **CI pipeline** — Removed codex skill parity check (skills-codex/ now manually maintained); fixed shellcheck and embedded sync issues
### Fixed
- **Converter primitive stripping** — Task primitives (TaskCreate, TeamCreate, SendMessage) properly stripped instead of mapped to non-existent Codex equivalents
- **Embedded hook sync** — Added missing `test-pyramid.md` and `codex-skill.md` to CLI embedded references
- **ShellCheck SC1125** — Fixed em-dash in shellcheck disable directive in smoke test script
- **Skill line limits** — Moved verbose autonomy rules to reference files to stay under tier-specific line budgets
- README highlights `ao search` (built on CASS) — indexes all chat sessions from every runtime unconditionally; adds Second Brain + Obsidian vault section with Smart Connections local/GPU embeddings and MCP semantic retrieval
- Quickstart skill rewritten from 275 lines to 68 lines — removes 90-line ASCII diagram and 50-line intent router that caused 3+ minute runtime; now outputs ~8 lines and completes in under 30 seconds
-`truncateText` edge case: maxLen 1–3 now returns `"..."[:maxLen]` instead of the original string unchanged
- Dead anti-pattern promotion functions removed from `ao maturity` (`promoteAntiPatternsCmd`, `filterTransitionsByNewMaturity`, `displayAntiPatternCandidates`, ~99 LOC)
- Windows file-lock and signal support — replace no-op `filelock_windows.go` with real `LockFileEx`/`UnlockFileEx` via kernel32.dll; extract `syscall.Flock` and `syscall.Kill` into platform-specific helpers so the binary compiles on Windows without POSIX-only syscalls
-`heal.sh` Check 7 false positive — script reference integrity check now strips URLs before pattern matching, preventing remote `https://…/scripts/foo.sh` references from being validated as local files
- Security gate `BLOCKED_HIGH` — three persistent findings resolved: gosec G118 false positive (context cancel func returned to caller), golangci-lint nolint syntax (space in `// nolint:` directive), radon double-counting `reverse_engineer_rpi.py` from `skills-codex/` copy
-`ao seed` now creates `.gitignore` and storage directories — reuses `setupGitProtection`, `ensureNestedAgentsGitignore`, and `initStorage` from `ao init`
-`ao seed` text updated from stale `ao inject`/`ao forge` to current MEMORY.md + session hooks paradigm
