release(v9.0.0)!: default-on flip (uc + parallel) + wave-parallel autopilot

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "simple-workflow",
   "description": "The Claude Code plugin for an end-to-end AI development workflow — ticket management, multi-agent code review, security audit, and automated PR creation — built on a Harness for long-running AI agents with strict context management and cross-session learning.",
-  "version": "8.7.0",
+  "version": "9.0.0",
   "author": {
     "name": "aimsise",
     "url": "https://github.com/aimsise"

CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [9.0.0] — 2026-06-25
+
+**TL;DR.** **BREAKING (default flips).** Two run-defaults flip from opt-in to **on** for a bare invocation: **ultracode orchestration** (`uc`) and **wave-parallel ticket execution** (`parallel`). A bare `/autopilot <slug>` (and `/brief <idea>` under the `chain=on` default) now writes `ultracode_mode: on` + `parallel_mode: on`, routes M+ tickets through the parallel multi-verifier eval panel, and executes a multi-ticket run wave-by-wave through one `ticket-executor` subagent per topologically-ready ticket (each in an isolated git worktree, merged at wave boundaries) instead of the inline serial loop. The safety guarantee inverts to the **opt-out** path: `uc=off` restores the v8.7.0 single-evaluator Agent path; `parallel=off` (or the `SW_PARALLEL_TICKETS_MODE=off` / `SW_PARALLEL_HOOKS_MODE=off` env kill switches) restores the v8.7.0 inline serial loop — **byte-identical** in artifacts, state, and verdict. The `parallel` flip rides on the full Phase 2 hook rework (T-004/5/6 wave-aware Stop / checkpoint / auto-compact), the wave scheduler (T-007), and worktree isolation + cross-wave integration (T-008), all landed in this release, AND on the **T-005 R-SUBSTOP spike resolving to RELOCATE** (the checkpoint guards relocate to `SubagentStop`, fire on the executor transcript, and enforce there). A fat-fingered `parallel=<garbage>` value fails **safe to `off`** (the proven serial path, uniform with `uc=` unknown→off), surfaced via `[PARALLEL-MODE] mode=off active=n reason=invocation-unknown-value-failsafe`.
+
+### Changed
+
+- **BREAKING — `uc` (ultracode orchestration) default flips off→on.** With no `uc=` token, `/autopilot` / `/impl` / (`chain=on`) `/brief` now resolve `UC_ORCH = on`: M+ tickets run their AC evaluation as a parallel multi-verifier panel via the Workflow tool. **Migration:** pass `uc=off` to restore the v8.7.0 single-evaluator Agent path (byte-identical — no Workflow dispatch, no UC-FLOOR raise). Token cost rises for every M+ ticket on a bare run because of the added panel lenses (see the README "Sub-agents consume API tokens" note); `uc=off` is the cost-revert. The `uc` flip has no hook dependency and is independent of the spike; it rides v9.0.0 for the "breaking when in doubt" bundling.
+- **BREAKING — `parallel` (wave-parallel ticket execution) default flips off→on.** With no `parallel=` token, `/autopilot` (and `/brief chain=on`) now resolve `PARALLEL_MODE = on` and execute a multi-ticket run wave-parallel through `ticket-executor` subagents in isolated worktrees. **Migration:** pass `parallel=off` (per-invocation) or set `SW_PARALLEL_TICKETS_MODE=off` / `SW_PARALLEL_HOOKS_MODE=off` (the env panic button for a `/brief`-chained invocation you cannot edit) to restore the v8.7.0 inline serial loop — byte-identical: no `ticket-executor` spawn, no wave cursor, no worktree machinery, the `parallel_mode:` state field omitted, every hook firing exactly as in v8.7.0. This flip is gated on the full Phase 2 rework + the T-005 spike verdict being RELOCATE (both satisfied in this release); defaulting parallel on before the rework — or with the checkpoint guards blind — would silently kill auto-compaction across long runs and/or blind the guards on every run, the precise failures Phase 2 prevents.
+- **Unknown-value posture is uniform fail-safe → off (L3 / R4).** An unknown `parallel=<garbage>` (and `uc=<garbage>`) invocation value coerces to **off** (the proven serial / Agent path), reconciling the argument-side parser with the hook-side `resolve_parallel_mode` (both fail closed to off). For `parallel`, the coercion is observable: `[PARALLEL-MODE] mode=off active=n reason=invocation-unknown-value-failsafe`. **Migration:** none — this only hardens the opt-out guarantee so a typo never silently opts INTO the less-proven parallel machinery; the prior "coerce unknown to the on default" posture is rejected as inverting the conservative direction.
+
+### Removed
+
+- **`mode=` alias removal — DEFERRED, NOT executed in v9.0.0.** The deprecated `/brief mode=auto|manual` alias (superseded by `chain=on|off`) was slated for removal in v9.0.0, but its removal is **out of scope for this release** (T-009 changes default *values*, not the alias surface). The alias and its `WARNING: 'mode=' is deprecated and will be removed in a future major version …` deprecation line still ship and remain functional. The removal is carried forward to a future major; every shipped reference to it (the runtime `/brief` WARNING, the README `/brief` signature, the `mode independence guard` note, and the `agent-spawn-prompts.md` precedence note) was corrected this release to name **"a future major"** rather than v9.0.0, so no v9.0.0 artifact claims its own removal in the version that is shipping. (Recorded honestly here rather than claiming a removal that did not happen — an R4 doc-truthfulness obligation.)
+
+### Verification
+
+- `bash tests/test-skill-contracts.sh` **900/900** (+ **CT-PARALLEL-7..12**: the parallel default off→on flip, the explicit `parallel=off` byte-identity opt-out, the bare-default-on-routes-to-wave-parallel anchor, the unknown→off fail-safe, the **`SW_PARALLEL_TICKETS_MODE` env-override** wiring [CT-PARALLEL-11], and the **metric-only → inline-serial-with-wave-log routing** [CT-PARALLEL-12]; the existing **CT-PARALLEL-1..6** / **CT-PARALLEL-CURSOR-*** / **CT-PARALLEL-SUBSTOP-*** / **CT-WAVE-*** / **CT-WORKTREE-1..12** greens carry; **CT-UC-ORCH-5** reaffirms the `uc=off` byte-identity); `bash tests/test-path-consistency.sh` **145/145**; `bash tests/test-accept-set-verify.sh` **32/32**; `bash tests/run-all.sh` reports **ALL TEST SUITES PASSED** (incl `test-phase-state-contracts.sh` **14/14** + `test-autopilot-continue.sh` **65/65**). `plugin.json` `9.0.0` == newest CHANGELOG `[9.0.0]` (CT-MODE-14, which reads the newest entry dynamically); the real ISO date is verified by the manual pre-flight (CT-MODE-13 is hardcoded to the `[6.0.0]` header and does NOT guard the `[9.0.0]` date).
+- **Opt-out byte-identity.** `/autopilot {slug} uc=off parallel=off` is byte-identical to v8.7.0 (inline serial loop + Agent-path evaluator): the `parallel=off` lane omits the `parallel_mode:` state field and adds no code path (the serial-fork literals `parallel=off … adds NO code path` / `the serial loop is untouched` survive verbatim); `uc=off` preserves the `byte-identical to v8.5.0` literal. The two args are a uniform 2-peer set (one `[*-MODE] mode=… active=… reason=…` emit shape, one opt-out-byte-identical contract, one `chain=off`-silent rule, one unknown→off fail-safe rule).
+- **Phase 2 rework + scheduler + worktree evidence (landed this release).** T-004/5/6 wave-aware hooks (autopilot-continue wave-aware continuation; checkpoint guards relocated to `SubagentStop` with the parallel main-`Stop` stand-down; per-wave-drained auto-compact re-key) ship green; T-007 wave scheduler + `parallel_max` cap + the H2 cascade-skip carve-out fix; T-008 worktree isolation + cross-wave integration via the shared-tree `.simple-workflow` symlink.
+- **R-SUBSTOP spike verdict = RELOCATE.** The T-005 spike resolved to RELOCATE (confirmed empirically: `SubagentStop` fires with the executor transcript and the checkpoint guards enforce on it), which is the first-class release input that gates the `parallel` default flip. Under RELOCATE the flip ships; had it resolved to STAND-DOWN, the parallel default would have stayed opt-in for v9.0.0 with a barrier-not-guards caveat.
+- **Documented limitation (T-008).** Under concurrency > 1 the `/ship` Step 6 `/tune` step read-modify-writes the shared `.simple-workflow/kb/` accumulator, racing to a bounded **KB-learning lost-update** — a tolerated best-effort-learning fidelity drop, NOT a correctness bug (ticket execution + status + `autopilot-state.yaml` are unaffected). Serializing `/tune` is the documented follow-up.
+- **Pre-release multi-angle branch review (4 cross-cutting criticals found + fixed).** A 25-agent / 6-dimension adversarial review of the whole branch (each finding independently re-verified) caught 4 critical bugs the per-ticket reviews missed; all fixed + re-verified clean before release. **(C1)** an empty-wave cursor stall — under parallel default-on, cascading dependency failures that empty later waves left `current_wave` un-advanced, so `hooks/autopilot-continue.sh` blocked "spawn next wave" until the loop guard fired; fixed with an all-terminal guard (the serial path already handled it; fixture `T-004-4b`, negative-control proven). **(C2)** the `SW_PARALLEL_TICKETS_MODE` kill switch was unwired — the resolver reads `SW_PARALLEL_HOOKS_MODE` and `/autopilot` never checked `SW_PARALLEL_TICKETS_MODE`, so the documented panic button did nothing; fixed by wiring an env-override (`env > arg > default`, unknown→off) into Argument Parsing + correcting the false "applied by the resolver helper" claim in `skills/autopilot/SKILL.md` + `CLAUDE.md`. **(C3)** `test-phase-state-contracts.sh` false-positive-FAILed on a dense prose line (`platfo`**`rm`** … `phase-state.yaml`) — the suite was RED on the branch; fixed by anchoring the `rm` grep to a shell-command boundary (genuine `rm phase-state.yaml` still caught; positive/negative controls verified). **(C4)** a metric-only routing contradiction (T-001 "`!= off` → executor" vs T-007 "metric-only = serial"); resolved by splitting the routing gate into three explicit cases (`off` / `metric-only` serial-with-wave-log / `on` executor-routed) + aligning `agents/ticket-executor.md` to `== on`. Guarded by `CT-PARALLEL-11`/`12` + `T-004-4b` + the tightened `test-phase-state-contracts.sh`.
+
 ## [8.7.0] — 2026-06-24
 
 **TL;DR.** Adds **forward-direction lossless verification (MR-ROUNDTRIP)** — the write-side counterpart to the parse-side MR-CANONICAL in the executed accept-set sweep. When a ticket pairs a reader (parse / decode) with a **canonical writer** (format / serialize / encode) that advertises a **round-trip / lossless / exact / canonical** guarantee, the `ac-evaluator` now drives exactly-representable values **through the real writer** and verifies `parse(format(x)) === x` over a grammar-derived **inter-anchor intermediate band** (including the just-below-promotion extremes where significant-figure rounding would fire), with an independent `parse∘format` oracle built from first principles — catching a writer that silently rounds an exactly-representable value to a lossy canonical string at `rc=0`, a class invisible to every parse-side relation. A deterministic **W-axis writer-pairing trigger** (`/impl` Step 3a) recognizes the paired reader+writer even when the only lexical cue sits on the reader, and a recognition-independent hook backstop (`P5` forward-depth, `P6` round-trip-mislabel) makes a shallow or mislabeled forward sweep un-shippable. Strictly **meet-or-beat**: the W-axis relation only ADDS coverage; absent a paired canonical-writer boundary it never triggers, and the same kill switches (`SW_ACCEPT_SET_CONFORMANCE_MODE=off` / `constraints.accept_set_conformance: off`) revert byte-for-byte. Validated dogfood58 → dogfood59: a paired `parse` + `format` subject drove `boundary=W roundtrip=y intermediate-sampled=y` end-to-end across three tickets (corpus 9190 IEC + 9004 SI, 0 divergences), shipped a correct + doc-truthful writer (the silent-loss regression class foreclosed in both code and README), and locked the round-trip + Unicode-digit complement RED in the committed test suite.