diff --git a/.github/release-notes/v0.30.0.md b/.github/release-notes/v0.30.0.md new file mode 100644 index 0000000..fadb568 --- /dev/null +++ b/.github/release-notes/v0.30.0.md @@ -0,0 +1,82 @@ +## Highlights + +- The built-in `agy` advisory route no longer places task text in command-line arguments. agy reads + the prompt from one NDJSON message on standard input under `--input-format stream-json`, and the + CLI itself rejects an argv prompt in that mode, so the documented local process-inspection + exposure is closed rather than merely narrowed. No built-in advisory route now carries a task in + argv. +- `wclass-advisory ask --council` starts its members together instead of one after another. Wall + clock is the slowest member rather than the sum of all members, and the whole-council deadline is + shared by every member instead of starving the ones requested last. +- Egress consent can be granted once for a shell with `WCLASS_ADVISORY_EGRESS=session` instead of + once per invocation. Nothing is written to disk and the grant dies with the shell. +- `--human` preview output is an actual summary. It previously printed the raw receipt, whose + inlined JSON schema pushed every reviewable flag off the screen. +- Advisory Skill onboarding generation 18 removes the now-false argv-delivery instruction, states + the parallel council contract, and documents the session grant. + +## Advisory task delivery + +- Both `agy` route builders drop `--print {{task}}` for + `--input-format stream-json --output-format stream-json`. Verified against agy 1.1.23. +- The standard-input payload is wrapped as one NDJSON user message only when a route *declares* + that input format, judged by argv token position rather than by executable name or substring. +- A route that declares NDJSON standard input while also carrying a `{{task}}` or `{{task_file}}` + slot is rejected instead of being resolved in one direction, because that route describes two + destinations for the same task. +- Route review and `--preview` now report `task_stdin_encoding`, so the reviewed argv is no longer + the only description of what bytes the child receives. +- The `agy` local capability check now requires `--input-format`. An agy build without stream-json + input fails closed before any task is read rather than during execution. + +## Council execution + +- Members run in one bounded thread pool over the existing per-member runner. Each child keeps its + own process group and is reaped by its own pid, so members cannot take each other's exit status. +- Each member's timeout is fixed once at submission, so identical input does not produce different + budgets across runs. +- Results are always reported in the requested vendor order, never in completion order. +- A failed peer is not cancelled, matching the existing campaign coordinator: cancelling would + discard work the vendor has already charged for. +- The target worktree is compared once before the members start and once after all of them finish. + +## Consent and output + +- `WCLASS_ADVISORY_EGRESS` must equal exactly `session`; any other value, including an empty one, + does not grant. The receipt records `task_egress_confirmation_source` as `flag`, + `session_environment`, or `terminal`, and `--preview` reports `session_egress_grant_active`. +- Skipping the question does not skip the disclosure. The vendor list, per-member delivery mode, + and the context warning still print on the controlling terminal under a session grant. +- The variable is absent from the vendor child environment allowlist, so no vendor CLI receives it. +- Preview rendering summarizes workflow, context, child counts and limits, repository behavior, + consent state, and per-route delivery. Arguments longer than 120 characters render as a length + and a SHA-256 prefix; `--json` still carries exact bytes. + +## Compatibility and safety + +**Breaking change — schema-1 `agy` advisory routes.** The `agy` argv changed, so every schema-1 +`agy` profile digest and advisory route fingerprint changes with it. A sealed campaign population +bound to an older `agy` route must complete the documented `migrate-routes --vendor agy` step +before its next dispatch. No existing record is rewritten or merged. Claude and Codex profile +digests, and Grok's `{{task_file}}` delivery, are unchanged. + +**Breaking change — consent becomes expressible as configuration state.** Before this release the +egress gate was strictly per action: a flag on the command, or an answer at the terminal. A shell +variable now authorizes every later call in that shell and every descendant process, so a wrapper +script or agent harness inherits it, and exporting it from a shell rc file makes the prompt +permanently unreachable. This is deliberate and is what makes non-interactive use possible, but it +is a change in the nature of the gate, not only in its ergonomics. + +Core `wclass` routing, the one-foreground-child contract, campaign records, statistical gates, and +every sealed manifest are unchanged. The core native `agy` and `grok` routes still deliver the task +in argv; that boundary is unchanged and still documented in `AGENTS.md`. + +Advisory Skill onboarding advances from generation 17 to 18. The exact published 0.29.0 four-file +bundle is registered in the upgrade ledger, so an installed 0.29.0 bundle upgrades without a +conflict. + +## Known limitation + +The `agy` CLI applies its own `--print-timeout`, which defaults to five minutes, while the advisory +per-child ceiling is 3,600 seconds. A long agy review can therefore be cut off by the vendor CLI +before the reviewed ceiling is reached. This predates the release and is not changed by it. diff --git a/src/weightclass/__init__.py b/src/weightclass/__init__.py index 685dd60..e41485a 100644 --- a/src/weightclass/__init__.py +++ b/src/weightclass/__init__.py @@ -1,3 +1,3 @@ """weightclass: local, policy-driven routing for supported native agent CLIs.""" -__version__ = "0.29.0" +__version__ = "0.30.0"