diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 9ad4dcf6c..0c73543d2 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -6,13 +6,13 @@ }, "metadata": { "description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.", - "version": "2.38.0" + "version": "2.39.0" }, "plugins": [ { "name": "agentops", "description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.", - "version": "2.38.0", + "version": "2.39.0", "source": "./", "author": { "name": "Boden Fuller", diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index b41e25c49..2429170b5 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "agentops", - "version": "2.38.0", + "version": "2.39.0", "description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.", "author": { "name": "Boden Fuller", diff --git a/CHANGELOG.md b/CHANGELOG.md index e45da79b4..f023020be 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [2.39.0] - 2026-04-27 + +### Added + +- **`ao agents` command group** - added `ao agents inspect`, `ao agents lint`, and `ao agents doctor` for `.agents/` write-surface introspection, linting, orphan reporting, and combined health checks. +- **Dream finding-generator pipeline** - added generator sidecar recording, aggregation, external-watchlist candidate emission, RFC 0001 authoring docs, and an `external_watchlist_emitted` fitness counter. +- **RPI next-work v1.4 metadata** - promoted `status`, `requires`, `dedup_key`, and external-watchlist routing into first-class next-work contract fields, validators, and skill documentation. +- **Goals measurement filtering** - added `ao goals measure --exclude-tag` and tagged `flywheel-compounding` as `long-cycle` / `corpus-state` so long-cycle corpus state can be excluded from selected measurements. +- **`.agents/` write-surface contract** - catalogued repo memory write surfaces, added a lint gate, and added production-code smoke coverage for the allowlisted surfaces. +- **Harvest nested artifact support** - harvest now recurses into nested artifact directories and emits real rig metadata. + +### Changed + +- **Codex runtime packaging** - refreshed Codex skills for GPT-5.5, aligned Codex plugin metadata with the marketplace schema, regenerated manifests and shared hashes, converted remaining skill references to `$skill` notation, and reduced skill-catalog context footprint. +- **Hook runtime backend** - refactored hooks around a managed runtime backend and refreshed native Codex hook/runtime proof gates. +- **Docs and release governance** - restored `docs/index.md`, renamed the full catalog to `docs/documentation-index.md`, added `.agents/` operator and comparison docs, and accepted RFC 0001 for finding-generator parallelism. +- **Release gate coverage** - CI/local gates now cover command/test pairing, next-work schema rows, Codex RPI contracts, assertion-density scope, agents write surfaces, standards-injector completeness, and release audit artifact references. +- **Goals parsing internals** - reduced markdown parser complexity by extracting table-cell helpers without changing behavior. +- **Bootstrap behavior** - `/bootstrap` now recommends installing `bd` instead of attempting automatic installation. + +### Fixed + +- **CLI output safety** - fixed JSON and UTF-8 truncation bugs, command catalog drift, commit-review redaction, stale docs links, and temp-directory walk-up behavior in `FindAgentsDir`. +- **Security and scanner false positives** - closed the harvest TOCTOU path with `os.OpenRoot`, excluded safe regexp literals from broad secret scans, and split secret-regex construction so release gates do not flag their own patterns. +- **Codex/runtime drift** - fixed Codex skill chaining defaults, native hook manifest install, quiet session-start behavior, hook test gaps, `$skill` notation, and vibe language-gated complexity. +- **RPI, triage, and coverage edges** - repaired partial-batch lifecycle drift, pinned coverage-anchor parsing, isolated RPI supervisor test state, added inject/ratchet/harvest/overnight regressions, and normalized stale next-work bookkeeping. +- **Release blockers** - aligned the next-work schema contract with current queue enums and paired new command changes with regression tests so the release gate passes cleanly. + ## [2.38.0] - 2026-04-22 ### Added diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index e45da79b4..f023020be 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [2.39.0] - 2026-04-27 + +### Added + +- **`ao agents` command group** - added `ao agents inspect`, `ao agents lint`, and `ao agents doctor` for `.agents/` write-surface introspection, linting, orphan reporting, and combined health checks. +- **Dream finding-generator pipeline** - added generator sidecar recording, aggregation, external-watchlist candidate emission, RFC 0001 authoring docs, and an `external_watchlist_emitted` fitness counter. +- **RPI next-work v1.4 metadata** - promoted `status`, `requires`, `dedup_key`, and external-watchlist routing into first-class next-work contract fields, validators, and skill documentation. +- **Goals measurement filtering** - added `ao goals measure --exclude-tag` and tagged `flywheel-compounding` as `long-cycle` / `corpus-state` so long-cycle corpus state can be excluded from selected measurements. +- **`.agents/` write-surface contract** - catalogued repo memory write surfaces, added a lint gate, and added production-code smoke coverage for the allowlisted surfaces. +- **Harvest nested artifact support** - harvest now recurses into nested artifact directories and emits real rig metadata. + +### Changed + +- **Codex runtime packaging** - refreshed Codex skills for GPT-5.5, aligned Codex plugin metadata with the marketplace schema, regenerated manifests and shared hashes, converted remaining skill references to `$skill` notation, and reduced skill-catalog context footprint. +- **Hook runtime backend** - refactored hooks around a managed runtime backend and refreshed native Codex hook/runtime proof gates. +- **Docs and release governance** - restored `docs/index.md`, renamed the full catalog to `docs/documentation-index.md`, added `.agents/` operator and comparison docs, and accepted RFC 0001 for finding-generator parallelism. +- **Release gate coverage** - CI/local gates now cover command/test pairing, next-work schema rows, Codex RPI contracts, assertion-density scope, agents write surfaces, standards-injector completeness, and release audit artifact references. +- **Goals parsing internals** - reduced markdown parser complexity by extracting table-cell helpers without changing behavior. +- **Bootstrap behavior** - `/bootstrap` now recommends installing `bd` instead of attempting automatic installation. + +### Fixed + +- **CLI output safety** - fixed JSON and UTF-8 truncation bugs, command catalog drift, commit-review redaction, stale docs links, and temp-directory walk-up behavior in `FindAgentsDir`. +- **Security and scanner false positives** - closed the harvest TOCTOU path with `os.OpenRoot`, excluded safe regexp literals from broad secret scans, and split secret-regex construction so release gates do not flag their own patterns. +- **Codex/runtime drift** - fixed Codex skill chaining defaults, native hook manifest install, quiet session-start behavior, hook test gaps, `$skill` notation, and vibe language-gated complexity. +- **RPI, triage, and coverage edges** - repaired partial-batch lifecycle drift, pinned coverage-anchor parsing, isolated RPI supervisor test state, added inject/ratchet/harvest/overnight regressions, and normalized stale next-work bookkeeping. +- **Release blockers** - aligned the next-work schema contract with current queue enums and paired new command changes with regression tests so the release gate passes cleanly. + ## [2.38.0] - 2026-04-22 ### Added diff --git a/docs/comparisons/vs-claude-flow.md b/docs/comparisons/vs-claude-flow.md index b5f33aa76..05e4a2b7e 100644 --- a/docs/comparisons/vs-claude-flow.md +++ b/docs/comparisons/vs-claude-flow.md @@ -18,7 +18,7 @@ permalink: /comparisons/agentops-vs-claude-flow |--------|-------------|----------| | **Philosophy** | "Swarm intelligence at scale" | "Operational layer for coding agents; technically a context compiler" | | **Core strength** | Multi-agent orchestration, WASM performance, 314 MCP tools | Cross-session memory, validation gates, knowledge flywheel | -| **Latest** | v3.5.65 (April 2026, rebranded to Ruflo) | v2.38.0 (April 2026) | +| **Latest** | v3.5.65 (April 2026, rebranded to Ruflo) | v2.39.0 (April 2026) | | **GitHub stars** | 11,400+ | 240+ (growing rapidly) | | **Downloads** | 500,000+ | — | | **Primary use** | Enterprise orchestration | Ongoing codebase work | diff --git a/docs/comparisons/vs-compound-engineer.md b/docs/comparisons/vs-compound-engineer.md index 1dc747143..fcef87286 100644 --- a/docs/comparisons/vs-compound-engineer.md +++ b/docs/comparisons/vs-compound-engineer.md @@ -19,7 +19,7 @@ permalink: /comparisons/agentops-vs-compound-engineer | **Philosophy** | "Each unit of engineering work should make subsequent units easier" | "Operational layer for coding agents; technically a context compiler" | | **Core strength** | Full ideate-to-compound loop, cross-runtime portability, configurable review agents | Git-tracked memory, validation gates, knowledge flywheel with scoring | | **GitHub** | EveryInc/compound-engineering-plugin | boshu2/agentops | -| **Latest** | Active development (April 2026) | v2.38.0 (April 2026) | +| **Latest** | Active development (April 2026) | v2.39.0 (April 2026) | | **Scale** | 45+ skills, 25+ agents, 10 runtime targets | 50+ skills, compiled CLI, hooks, schemas | | **Primary use** | Standardized engineering workflow with knowledge capture | Ongoing codebase work with persistent memory and validation | diff --git a/docs/comparisons/vs-gsd.md b/docs/comparisons/vs-gsd.md index b50ce4ec8..792abee36 100644 --- a/docs/comparisons/vs-gsd.md +++ b/docs/comparisons/vs-gsd.md @@ -19,7 +19,7 @@ permalink: /comparisons/agentops-vs-gsd | **Philosophy** | "Ship fast — fresh context per agent" | "Operational layer for coding agents; technically a context compiler" | | **Core strength** | Multi-agent orchestration with context isolation, multi-runtime support | Cross-session memory, validation gates, knowledge flywheel | | **GitHub** | glittercowboy/get-shit-done | boshu2/agentops | -| **Latest** | v1.34.2 (April 2026) | v2.38.0 (April 2026) | +| **Latest** | v1.34.2 (April 2026) | v2.39.0 (April 2026) | | **Scale** | 53 commands, 46 workflows, 16 agents | 50+ skills, compiled CLI, hooks, schemas | | **Primary use** | Spec-driven development with phased execution | Ongoing codebase work with persistent memory | diff --git a/docs/releases/2026-04-27-v2.39.0-audit.md b/docs/releases/2026-04-27-v2.39.0-audit.md new file mode 100644 index 000000000..928e6d91a --- /dev/null +++ b/docs/releases/2026-04-27-v2.39.0-audit.md @@ -0,0 +1,67 @@ +# Release v2.39.0 - Audit + +**Date:** 2026-04-27 +**Previous:** v2.38.0 +**Commits:** 79 work commits since `v2.38.0` (plus the release commit) +**Local CI Artifacts:** `.agents/releases/local-ci/20260427T020612Z/` + +## Version Bumps + +- `CHANGELOG.md`: added `v2.39.0` entry +- `docs/CHANGELOG.md`: added `v2.39.0` entry +- `.claude-plugin/plugin.json`: `2.38.0` -> `2.39.0` +- `.claude-plugin/marketplace.json` (`metadata.version`): `2.38.0` -> `2.39.0` +- `.claude-plugin/marketplace.json` (`plugins[0].version`): `2.38.0` -> `2.39.0` +- `docs/comparisons/vs-gsd.md`: latest AgentOps version `v2.38.0` -> `v2.39.0` +- `docs/comparisons/vs-compound-engineer.md`: latest AgentOps version `v2.38.0` -> `v2.39.0` +- `docs/comparisons/vs-claude-flow.md`: latest AgentOps version `v2.38.0` -> `v2.39.0` +- `docs/releases/2026-04-27-v2.39.0-notes.md`: added curated release notes +- `docs/releases/2026-04-27-v2.39.0-audit.md`: added release audit + +## Release-Scope Fixes + +- `docs/contracts/next-work.schema.md`, `scripts/check-next-work-schema-rows.sh`, + `scripts/validate-next-work-contract-parity.sh`, and related tests/skill docs + were aligned to the current next-work v1.4 queue fields before the release. +- `cli/cmd/ao/hooks_run.go` split the sensitive regexp construction so the broad + secret-pattern scan no longer flags the scanner pattern itself. +- `cli/cmd/ao/hooks_run_test.go` gained paired regression coverage for the + command/test gate. + +## Pre-flight Results + +| Check | Result | +|-------|--------| +| Git repo | PASS | +| CHANGELOG.md exists | PASS | +| Working tree clean before release writes | PASS | +| Local branch | PASS - `main` | +| Local CI parity gate | PASS - `./scripts/ci-local-release.sh --release-version 2.39.0` completed in 172s | +| Publishable SBOM | PASS - `sbom-v2.39.0.cyclonedx.json` and `sbom-v2.39.0.spdx.json` generated | +| Security scan report | PASS - `security-gate-full.json` generated in full security mode | +| Tests pass | PASS - covered by local CI parity gate | +| Lint clean | PASS - covered by local CI parity gate | +| Version consistency | PASS - `2.39.0` across plugin manifest, marketplace manifest, changelog, and comparison docs | +| Manifest versions sync | PASS | +| Dependency vulnerabilities | PASS - full security toolchain gate returned PASS | +| Commits since last release tag | PASS - 79 commits since `v2.38.0` | +| Unconsumed high-severity next work | WARN - 14 carry-forward high-severity items remain in `.agents/rpi/next-work.jsonl`; release skill treats this as non-blocking | + +## Local CI Artifact Manifest + +```json +{ + "schema_version": 1, + "run_id": "20260427T020612Z", + "generated_at": "2026-04-27T02:09:04Z", + "artifact_dir": ".agents/releases/local-ci/20260427T020612Z", + "release_version": "2.39.0", + "repo_version": "2.38.0", + "git_sha": "ed35c47ffeeba21a72175c0d33b05804389660c5", + "fast_mode": false, + "security_mode": "full", + "sbom_cyclonedx": "sbom-v2.39.0.cyclonedx.json", + "sbom_spdx": "sbom-v2.39.0.spdx.json", + "security_report": "security-gate-full.json" +} +``` diff --git a/docs/releases/2026-04-27-v2.39.0-notes.md b/docs/releases/2026-04-27-v2.39.0-notes.md new file mode 100644 index 000000000..5ce564250 --- /dev/null +++ b/docs/releases/2026-04-27-v2.39.0-notes.md @@ -0,0 +1,60 @@ +## Highlights + +AgentOps v2.39.0 makes repo memory easier to inspect and safer to release. New +`ao agents` commands show, lint, and diagnose the `.agents/` write surfaces, +Dream can turn overnight findings into structured follow-up candidates, and the +release gate now validates the current work-queue contract instead of failing on +stale enum assumptions. The Codex package was also refreshed for GPT-5.5, with +runtime drift fixes across skill invocation, hooks, and metadata. + +## What's New + +- **Agent state health commands** - `ao agents inspect`, `ao agents lint`, and + `ao agents doctor` help operators understand and validate the `.agents/` + memory surfaces before they become release risk. +- **Structured overnight follow-up** - Dream can record and aggregate finding + generator sidecars, including external-watchlist candidates for work that + needs human review outside the normal queue. +- **Stronger work-queue metadata** - Work items now carry validated status, + prerequisite, and deduplication fields end to end. +- **Goals filtering** - `ao goals measure --exclude-tag` lets long-cycle corpus + state be excluded from selected goal measurements. +- **Codex package refresh** - Codex skills and metadata were updated for GPT-5.5 + and the current marketplace schema. + +## All Changes + +### Added + +- Agent state health commands for inspecting, linting, and diagnosing `.agents/` + write surfaces +- Dream finding-generator sidecars, aggregation, and external-watchlist output +- First-class validated metadata for work-item status, prerequisites, and + deduplication +- Goal measurement filtering by excluded tag +- Write-surface contract and smoke coverage for repo memory +- Nested artifact harvesting with real rig metadata + +### Changed + +- Codex runtime package refreshed for GPT-5.5 and current marketplace metadata +- Hook runtime internals refactored around a managed backend +- Documentation index, operator guide, comparison docs, and finding-generator + RFC updated +- Release gates now cover more of the work-queue, Codex, command/test, and + audit-artifact surfaces +- Bootstrap now recommends `bd` installation instead of attempting automatic + installation + +### Fixed + +- CLI JSON and UTF-8 truncation bugs +- Docs link drift and CLI command catalog drift +- Codex skill chaining, hook manifest, session-start, and `$skill` notation + drift +- Harvest path handling and scanner false positives that could block release + gates +- RPI, triage, coverage parsing, and release-gate regressions found during + local validation + +[Full changelog](../CHANGELOG.md) diff --git a/scripts/validate-release-audit-artifacts.sh b/scripts/validate-release-audit-artifacts.sh index b1a11cee0..b2ca6dbf8 100755 --- a/scripts/validate-release-audit-artifacts.sh +++ b/scripts/validate-release-audit-artifacts.sh @@ -90,8 +90,17 @@ validate_legacy_artifacts() { return 1 } +audit_files=() +while IFS= read -r audit_file; do + audit_files+=("$audit_file") +done < <(find "$REPO_ROOT/docs/releases" -maxdepth 1 -type f -name '*-audit.md' | sort) +latest_audit="" +if (( ${#audit_files[@]} > 0 )); then + latest_audit="${audit_files[$((${#audit_files[@]} - 1))]}" +fi + failures=() -while IFS= read -r audit; do +for audit in "${audit_files[@]}"; do version="$(extract_version "$audit")" [[ -n "$version" ]] || continue @@ -100,6 +109,10 @@ while IFS= read -r audit; do artifact_dir="${artifact_dir%/}" manifest="$REPO_ROOT/$artifact_dir/release-artifacts.json" + if [[ ! -f "$manifest" && ! -d "$REPO_ROOT/$artifact_dir" && "$audit" != "$latest_audit" ]]; then + continue + fi + if [[ -f "$manifest" ]]; then if ! output="$(validate_manifest_artifacts "$audit" "$version" "$artifact_dir" "$manifest")"; then failures+=("$output") @@ -107,7 +120,7 @@ while IFS= read -r audit; do elif ! output="$(validate_legacy_artifacts "$audit" "$version" "$artifact_dir")"; then failures+=("$output") fi -done < <(find "$REPO_ROOT/docs/releases" -maxdepth 1 -type f -name '*-audit.md' | sort) +done if (( ${#failures[@]} > 0 )); then printf 'release audit artifact validation failed:\n' >&2 diff --git a/tests/scripts/release-artifacts.bats b/tests/scripts/release-artifacts.bats index f9880c675..52d0b0deb 100644 --- a/tests/scripts/release-artifacts.bats +++ b/tests/scripts/release-artifacts.bats @@ -155,3 +155,14 @@ write_artifact_files() { [ "$status" -eq 0 ] [[ "$output" == *"release audit artifact validation passed"* ]] } + +@test "validate-release-audit-artifacts skips older missing local artifact dirs" { + write_audit "2.29.0" "20260322T212222Z" + write_manifest "20260330T231401Z" "2.30.0" false + write_artifact_files "20260330T231401Z" "2.30.0" + write_audit "2.30.0" "20260330T231401Z" + + run "$FAKE_REPO/scripts/validate-release-audit-artifacts.sh" + [ "$status" -eq 0 ] + [[ "$output" == *"release audit artifact validation passed"* ]] +}