chore(release): 0.30.0

.github/release-notes/v0.30.0.md

@@ -0,0 +1,82 @@
+## Highlights
+
+- The built-in `agy` advisory route no longer places task text in command-line arguments. agy reads
+  the prompt from one NDJSON message on standard input under `--input-format stream-json`, and the
+  CLI itself rejects an argv prompt in that mode, so the documented local process-inspection
+  exposure is closed rather than merely narrowed. No built-in advisory route now carries a task in
+  argv.
+- `wclass-advisory ask --council` starts its members together instead of one after another. Wall
+  clock is the slowest member rather than the sum of all members, and the whole-council deadline is
+  shared by every member instead of starving the ones requested last.
+- Egress consent can be granted once for a shell with `WCLASS_ADVISORY_EGRESS=session` instead of
+  once per invocation. Nothing is written to disk and the grant dies with the shell.
+- `--human` preview output is an actual summary. It previously printed the raw receipt, whose
+  inlined JSON schema pushed every reviewable flag off the screen.
+- Advisory Skill onboarding generation 18 removes the now-false argv-delivery instruction, states
+  the parallel council contract, and documents the session grant.
+
+## Advisory task delivery
+
+- Both `agy` route builders drop `--print {{task}}` for
+  `--input-format stream-json --output-format stream-json`. Verified against agy 1.1.23.
+- The standard-input payload is wrapped as one NDJSON user message only when a route *declares*
+  that input format, judged by argv token position rather than by executable name or substring.
+- A route that declares NDJSON standard input while also carrying a `{{task}}` or `{{task_file}}`
+  slot is rejected instead of being resolved in one direction, because that route describes two
+  destinations for the same task.
+- Route review and `--preview` now report `task_stdin_encoding`, so the reviewed argv is no longer
+  the only description of what bytes the child receives.
+- The `agy` local capability check now requires `--input-format`. An agy build without stream-json
+  input fails closed before any task is read rather than during execution.
+
+## Council execution
+
+- Members run in one bounded thread pool over the existing per-member runner. Each child keeps its
+  own process group and is reaped by its own pid, so members cannot take each other's exit status.
+- Each member's timeout is fixed once at submission, so identical input does not produce different
+  budgets across runs.
+- Results are always reported in the requested vendor order, never in completion order.
+- A failed peer is not cancelled, matching the existing campaign coordinator: cancelling would
+  discard work the vendor has already charged for.
+- The target worktree is compared once before the members start and once after all of them finish.
+
+## Consent and output
+
+- `WCLASS_ADVISORY_EGRESS` must equal exactly `session`; any other value, including an empty one,
+  does not grant. The receipt records `task_egress_confirmation_source` as `flag`,
+  `session_environment`, or `terminal`, and `--preview` reports `session_egress_grant_active`.
+- Skipping the question does not skip the disclosure. The vendor list, per-member delivery mode,
+  and the context warning still print on the controlling terminal under a session grant.
+- The variable is absent from the vendor child environment allowlist, so no vendor CLI receives it.
+- Preview rendering summarizes workflow, context, child counts and limits, repository behavior,
+  consent state, and per-route delivery. Arguments longer than 120 characters render as a length
+  and a SHA-256 prefix; `--json` still carries exact bytes.
+
+## Compatibility and safety
+
+**Breaking change — schema-1 `agy` advisory routes.** The `agy` argv changed, so every schema-1
+`agy` profile digest and advisory route fingerprint changes with it. A sealed campaign population
+bound to an older `agy` route must complete the documented `migrate-routes --vendor agy` step
+before its next dispatch. No existing record is rewritten or merged. Claude and Codex profile
+digests, and Grok's `{{task_file}}` delivery, are unchanged.
+
+**Breaking change — consent becomes expressible as configuration state.** Before this release the
+egress gate was strictly per action: a flag on the command, or an answer at the terminal. A shell
+variable now authorizes every later call in that shell and every descendant process, so a wrapper
+script or agent harness inherits it, and exporting it from a shell rc file makes the prompt
+permanently unreachable. This is deliberate and is what makes non-interactive use possible, but it
+is a change in the nature of the gate, not only in its ergonomics.
+
+Core `wclass` routing, the one-foreground-child contract, campaign records, statistical gates, and
+every sealed manifest are unchanged. The core native `agy` and `grok` routes still deliver the task
+in argv; that boundary is unchanged and still documented in `AGENTS.md`.
+
+Advisory Skill onboarding advances from generation 17 to 18. The exact published 0.29.0 four-file
+bundle is registered in the upgrade ledger, so an installed 0.29.0 bundle upgrades without a
+conflict.
+
+## Known limitation
+
+The `agy` CLI applies its own `--print-timeout`, which defaults to five minutes, while the advisory
+per-child ceiling is 3,600 seconds. A long agy review can therefore be cut off by the vendor CLI
+before the reviewed ceiling is reached. This predates the release and is not changed by it.

src/weightclass/__init__.py

@@ -1,3 +1,3 @@
 """weightclass: local, policy-driven routing for supported native agent CLIs."""
 
-__version__ = "0.29.0"
+__version__ = "0.30.0"