$ cat ./products/af.md

Authority compatibility

Committed .af/ policy valid under 0.13.0 needs no hand edit. Run af onboard –refresh-lock to pin 0.14.0-rc.3 and its signed bytes. State written by other releases remains unsupported under ADR-0145.

Changes

• release: v0.14.0-rc.2 (#458)
• tests: the TUI hand-off tests wait for the panes’ re-read to settle before reading the bar; on the macOS release runner the spinner frame was still showing, which stopped v0.14.0-rc.2
• CI: a release/ pull request runs the macOS leg the release runs, so a macOS-only failure stops the pull request before its merge cuts the tag

Validation scope

Profile: fast; version 0.14.0-rc.3; exact SHA 698625df2f468750b656b605c9a8ad9369a7b82c.

• e2e: SELECTED (profile default)
• functional: SELECTED (profile default)
• perf: NOT RUN (outside profile default)
• uix: SELECTED (profile default)

All selected Linux/macOS class gates and mandatory binary/archive/signature/architecture smoke passed. A fast/custom release does not claim full tests. Published-release measurement is asynchronous, not awaited.

Validation plan, per-class JUnit and step evidence

Authority compatibility

Committed .af/ policy valid under 0.13.0-rc.2 needs no hand edit. Run af onboard –refresh-lock to pin 0.13.0 and its signed bytes. State written by other releases remains unsupported under ADR-0145.

Changes

• release: v0.13.0-rc.2 (#337)
• chore(deps): bump actions/setup-python from 7.0.0 to 7.1.0 in the actions-minor-and-patch group (#339)

Known limitations deferred to 0.14.0

The owner authorized this release on 2026-10-26 with the remaining readiness gaps scheduled for 0.14.0. These limitations are not fixed by this release:

• Continued Tasks can bind standing rules from a different Snapshot than the Worker reads; the binding needs an explicit rules-tree identity.
• An implementer Attempt that reaches its wall can lose unsealed edits and report a malformed Provider reply. Check-wall failures also need accurate typed diagnostics.
• Recurring concurrent-load failures still require the recorded 20/20 stress proofs.
• Complete release-specific performance evidence remains outstanding; a successful workflow with an incomplete/bootstrap report is not a complete measured pass.

Correctness, recovery and stress follow-ups: #331. Performance evidence: #343.

0.13.0-rc.1 was tagged but never published. Its release notes are carried forward into 0.13.0-rc.2 below. The latest published signed release remains 0.12.0-rc.5, so .af/af.lock continues to pin it until 0.13.0-rc.2 is published, as required by ADR-0138.

Authority compatibility

Existing committed .af/ policy that validates under 0.12.0-rc.5 needs no hand edit. Run af onboard –refresh-lock to pin 0.13.0-rc.2 and its signed bytes; a pipeline opting into recovery_attempts uses af.pipeline/3 and needs its refreshed lock.

Changes

• release: v0.13.0-rc.1 (#335)
• fix(perf): show verdicts and reports in PR checks (#330)
• Isolate CLI usage test from release pin (#336)

Show actual performance verdicts in the PR check list and render each planned comparison’s coverage and rounded case table in its Details summary, including bootstrap reports when the full primary is unavailable. Link the retained HTML report artifact and annotate verdicts without changing advisory enforcement or granting a workflow write token. Valid no-perf exemptions show EXEMPT (no-perf; not measured); failed scope decisions remain unavailable and cannot appear as an exemption or a measured pass.

• Isolate the CLI usage-error fixture from the repository release pin so prerelease source checks preserve exact JSON and stderr assertions while the signed pin awaits publication (ADR-0213).

Changes carried forward from unpublished 0.13.0-rc.1

• release: v0.12.0-rc.5 (#300)

• Fix every finding of the 2026-10-20 GA and security audit (#299)

• Fix clock-skewed warm Cargo targets after PR297 light review (#301)

• Integrate the continuous performance laboratory into the SDLC (#304)

• fix: sanitize missing review keys in terminal errors (#306)

• Fix hosted performance artifact layouts and offline CLI fixtures (#308)

• perf: complete hosted suite coverage and calibrate mixed CPU shards (#309)

• perf: predeclare hosted calibration for 23–29 October (#311)

• Telemetry P2–P5: recording, spans, storage kind, accounting, ledger, bench (#294)

• State the lines a pull request adds per directory, and check them in CI (#312)

• Telemetry P6–P7: harness streams, turns and tools, content blobs (#313)

• Give the af task report tests’ body the lines block the check now requires (#314)

• Count a capped stream’s gaps by the observer’s runs, not by one chunking (#315)

• fix: supersede stale unavailable optimization gaps (#318)

• build(deps): bump the actions-minor-and-patch group across 1 directory with 2 updates (#253)

• perf(store): avoid redundant plan dependency decoding (#326)

• feat: skip PR performance measurements with no-perf label (#325)

• ci: use latest Python and model-based Task independence (#329)

• feat: disable Providers temporarily with automatic expiry (#334)

• GA polish: provider detection, first run, one outcome model, agent loop and kernel resilience (#332)

• Telemetry, second package: the commands that run a kernel run (af task run, af task start --execute, af review run, af provider doctor, af self optimize --execute) now record af.command > af.run > af.authority.load, af.plan (one af/TelemetryNode@1 record per plan node), af.node > af.attempt with the kernel’s exact accounting, and the run’s af.sweep; every other command, and every command at off, opens no telemetry directory. From the first af.run until the seal one consumer thread is the segment’s only writer and makes every record visible within flush_latency_ms; the command’s end and the seal are one request to it, bounded at 2 s, after which it is abandoned and publishes nothing, leaving the segment for the next reader to recover. Every lease that begins kernel execution now commits an execution marker to its Task’s log, the event TaskExecutionStarted@1 (af/TaskExecutionStarted@1) beside TaskTransition@5, at every telemetry level. af telemetry runs, show, tail and gc (`–

Authority compatibility

Committed .af/ policy keeps working as is relative to 0.12.0-rc.4; no authority migration is required. Every existing pipeline stays af.pipeline/1; only a pipeline that declares a Project Brief root port is af.pipeline/2, pinned like any new pipeline by af onboard --refresh-lock. Machine state needs no hand edit: $XDG_STATE_HOME/af/stores.toml is now version 2, and a version-1 file is refused with its way out (delete it; Stores register again as commands use them); af storage --json is af/storage@3 and a Survey record is af/ProjectSurvey@2, their superseded versions refused; telemetry records under $XDG_STATE_HOME/af/telemetry/ at level spans unless the machine’s [telemetry] table sets level = "off", and nothing leaves the machine unless an OTLP sink is configured.

Changes

• release: v0.12.0-rc.4 (#269)

• fix: reject explicit zero unknown usage in collected tasks (#273)

• fix: reject PR report content hidden by HTML, comments and code (#275)

• fix: preserve copyable preview commands for maximum-length task IDs (#274)

• fix(tui): preserve error reasons for paths with spaces (#276)

• docs: align setup help with current CLI behavior (#277)

• ci: push the release pin with a deploy key that bypasses main’s ruleset (#281)

• docs: record the 0.12.0-rc.2 Task startup profile from issue #255 (#282)

• Telemetry P1: the review-telemetry crate, levels, index and status (#286)

• fix: check for updates in headless and JSON commands (#285)

• Project: identity, Workspaces, Surveys and their collection (#291)

• A task_collected tombstone (af/TaskCollected@1) that spells unknown_usage_attempts: 0 is now refused on admission, event validation and replay, as its schema already refused it; a tombstone without the field still reads as no unknown usage, and written bytes are unchanged (#194).

• af task start and af task explain no longer wrap a suggested af task run action or Details hint inside a Task ID. With a 128-character Task ID, the copied command keeps every shell token, the exact --confirm-plan ID and a valid \ continuation. Prose rows still wrap at 96 columns, and command rows are still sanitized (ADR-0149).

• The PR report check no longer accepts an af task report block GitHub does not render as the report: a block wrapped in a raw HTML block (, , or, indented or not, closed or left open), whose markers are its text, and a pipeline line or round table, between visible markers, that sits in a code block, inside an HTML block, which a fence inside it does not end before its blank line, inside an HTML comment, or inside the quoted attribute value of a tag an HTML block leaves open, or a pipeline line that starts inside a code span opened on a paragraph line above it. A comment stays hidden from its of raw HTML. A raw block ends at the closing tag of any of the four names, a nested in another HTML block opens none, and a is one, is not (issue #193, ADR-0142).

• af browser: :scope project from a long start outside any repository and :cd into a repository whose configuration file does not parse now keep their reason visible on the status line at 80 columns. Before, a path with spaces could hide the reason. The error carries the exact span of the path it names, so a path with spaces is shortened from the left as one path. The error text is unchanged, and a message that fits is unchanged (#232, ADR-0150).

• Setup help and guides now describe what the CLI does. af onboard --help and the generated .af/README.md say that --refresh-lock re-pins every route and oversized-policy pipeline as well as the selected one, with their Workers, and drops stale pins. The Task prerequisites say that install.sh checks the release signa

Authority compatibility

Committed .af/ policy keeps working as is relative to 0.12.0-rc.3; no authority migration is required. Model bindings are now validated before any Provider process starts: a binding that names an alias (opus, fable), an effort level the model does not list, or a misspelt ID is refused with the exact spellings to use (af provider models ); custom IDs that pass the spelling rule are accepted as unverified.

Changes

• release: v0.12.0-rc.3 (#261)

• ci: authenticate gh in the release pin job (#262)

• Stop the Claude model fallback and name the model that answered (#264)

• Model discovery: af provider models, one validation authority, hints and TUI (#268)

• Claude Task Attempts now run with CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK=1, so Claude Code no longer answers with another model when the bound model’s safety classifier flags a request. A refusal is classified model_refused, charged what it reports and not retried; a reply from a model the Worker did not bind is still refused, now naming both models, their output tokens, safety_stops and num_turns; a model ID Claude Code does not know is model_unavailable. af task run and af review run print the reason and the next step on stderr for each such failed Attempt, the switch first even when the result’s usage is also malformed or lists more than 32 models, with those accounting reasons after it in the diagnostic; an entry for another model that reports no activity, or only malformed counters, is never a switch. An error result whose result carries Claude Code’s safeguards text is model_refused whatever its errors holds. A model or effort binding outside the one spelling af prints (an ASCII letter or digit, then at most 127 letters, digits, -, ., _ or :) is refused before any process starts, naming only its byte length, ahead of the versioned-model rule, and every Worker’s binding is checked before the first Provider is probed; a reported model ID outside it reads [not printable] (ADR-0147). The Provider admission probe, which af provider doctor also sends, now says what it is for (a Provider admission check by the af review tool that needs no file and no tool) before asking for exactly OK, because Claude Fable 5.1’s safety classifier refused the bare instruction every time from an empty directory.

• af provider models [ID …] [--json] [--resolve SPELLING[/EFFORT]] lists each Provider’s model catalog token-free, from the harness’s own protocol (Claude Code’s list_models on a stream-json session closed before any turn, Codex’s model/list on a bare app-server), with its source, harness version and freshness, one row per exact ID with its display name, aliases and effort levels, and what the list proves; only the charged af provider doctor proves that an account can run a model. --resolve 'Fable 5.1/xhigh' names the exact ID, checks the effort level and prints the reviewer.toml [runner], the worker.toml [runner] and the bindings [providers] blocks, each a TOML document that parses on its own; --json prints af/provider-models@1; exit 4 when a CLI cannot serve af, 7 when a catalog is unavailable. One validation module now checks every model and effort level before anything is charged: an alias is refused with the exact ID it resolves to, an effort level the Provider or model does not list with the levels it lists, a misspelling of a known ID with the nearest IDs, and a custom ID that passes the spelling rule is accepted as unverified against the catalog. af task plan and af review plan print a model line per Model Worker and refuse before any Provider process starts; both adapters refuse such packages too, so a reviewer package naming --model opus must name claude-opus-5-5. Every refusal names the Provider, the rule, the nearest accepted spellings and af provider models . The TUI’s Providers pane shows each Provider’s own models

Authority compatibility

Committed .af/ policy keeps working as is relative to 0.12.0-rc.2; no authority migration is required. af provider status --json now emits af/provider-status@2 (new state incompatible); readers of the @1 document need updating.

Changes

• release: v0.12.0-rc.2 (#238)

• test: replace redundant stale-view repair process case with contract coverage (#242)

• Remove dormant session protocol and obsolete compatibility code (#256)

• Detect incompatible Claude Code and Codex CLIs before dispatching Workers (#260)

• Tests: the real-process task_repair case for a fix verifier that names a stale Finding view is replaced by the stale_snapshot_view contract case, which applies the same mutation to the shared validate_context predicate behind validate_fix_output and repair_acceptance; exit 4, 8 Attempts and an unchanged replay stay asserted by the stale-subject case. The claim-less receipt case stays real-process, because the Worker output schema rejects it before validate_context.

• A release now reads only the state, configuration and flags it writes itself: no reader, migration or fallback is kept for anything an earlier release wrote, and a changed persisted shape takes a new version whose predecessor is refused (ADR-0145). Finish or discard in-flight Campaigns and Tasks before upgrading. The Warm Set is now review.kernel/WarmSet@2, selected by WarmSetSelected@2, with no session layer; a Campaign that recorded WarmSetSelected@1 is refused by its replay error. The never-hosted Claude session layer and Cold Closeout are removed with their events, so a pipeline that sets warm.session, warm.session_max_age_secs or convergence.cold_closeout no longer loads: delete the key. A Campaign the pre-Task executor wrote is refused by the same replay error as any other record this release does not write, instead of a dedicated message. The .af/ layout no longer declares task-compat/, so a tracked copy is reported as undeclared.

• af now checks, token-free, that the installed claude or codex accepts its invocation before af provider status, af provider setup or Task Provider admission asks about a login (ADR-0146). It reads claude --help or codex exec --help and refuses a CLI that does not declare every option af passes, such as Claude Code before 2.1.248, which has no --restricted. No isolation flag is ever dropped to make a CLI run. The report names the Provider, the path, the version, every missing option and the upgrade command. af provider status shows the new state incompatible and exits 4, and --json now emits af/provider-status@2. Task admission refuses before any Worker runs or any token is charged.

• The Codex app-server is started without --stdio, so codex-cli 0.121.0 works again. For Codex the check also starts the bare codex app-server and asks it to initialize; only an answer whose result is a JSON object proves it. An app-server that exits first, rejects the request, answers {"id":1}, or writes a line that is neither a response (an id and exactly one of result or error) nor a notification or request is incompatible at once on plain status, --usage, setup and admission alike, reported with its exit status (or was stopped by af) and the line it answered with. The identity and usage probes judge every line by the same grammar and accept only an answer read after af wrote the request, so a response written early never binds an account or shows limits.

• A Worker that exits without a parsable result (for Claude, anything but an object with a boolean is_error and its result; for Codex, anything but the -o final message after a clean exit) now reports its exit status and a bounded stderr excerpt whatever its failure is classified as, and one whose CLI refused af’s arguments is classified `un

Authority compatibility

Committed .af/ policy keeps working as is relative to 0.12.0-rc.1; no authority migration is required.

Changes

• chore: pin af 0.12.0-rc.1 in .af/af.lock (#227)

• Keep a long path’s reason on the TUI status line (fixes a test that failed every Task gate) (#233)

• Report slow tests and suite totals from every nextest run (#218)

• Run only the self-optimizer’s timed phase alone (#222)

• Wait once, not per case, in looping lease and deadline tests (#204) (#234)

• Judge the same Task writer at its later recorded time everywhere (#231) (#235)

• Fix main: check the real nextest config against its own text, not a pinned exclusive list (#236)

• Give non-timeout tests a load-safe wall so a loaded machine cannot fail them (#206 part 1) (#237)

• make test now prints where test time goes after every nextest run, passing or failing: nextest’s wall time and test count, summed test-seconds, achieved parallelism, the time spent in the exclusive block that .config/nextest.toml runs alone (ADR-0124), failures, a duration histogram and the slowest tests. CI also writes it to the step summary. A Task gate (scripts/verify.sh) records every make check step’s time beside its nextest reports and ends its output with the same summary. The JUnit an earlier run left is removed before nextest starts, and a JUnit whose testcases do not add up to its declared counts gets a warning instead of totals; the report never changes the test step’s exit status. It runs under Python 3.9 and reads .config/nextest.toml without tomllib. scripts/test-time-report.py compare BASE_JUNIT... -- HEAD_JUNIT... compares runs by their per-side medians and lists per-test changes of at least 1 s and added or removed tests, as a Markdown table for a pull request description. --base-nextest-config PATH and --head-nextest-config PATH give each side its own nextest config (each defaults to --nextest-config, which still sets both), so each side’s exclusive block counts exactly the tests its own config runs alone, and the output names both configs when they differ.

• The self-optimizer light-strategy test no longer holds every test thread for its whole run (#203, ADR-0124). It is split into two tests in crates/af/tests/it/self_optimizer.rs. Each builds its own repository and Store with the same af commands through shared helpers. Of the two, only light_cache_candidate_measures_real_latency_and_grounds_later_adoption_evidence stays in the exclusive override of .config/nextest.toml. It first runs, delivers and adopts the light candidate without asserting on it, then runs every phase from line 719 to line 1277 of the original test in order: the cache latency comparison (8 trials, 3 s baseline) with its replay, delivery, adoption and ordinary cache-consuming Task (719-1090), the unknown-toolchain comparison and refused delivery (1092-1228), and the light adoption observed with the cache Task as evidence (1230-1277). light_strategy_generates_one_candidate_without_exposing_source_to_author_workers runs in parallel and keeps every other phase in the original order on one repository: plan review without source (186-259), the approved five-Attempt run and its replay (260-376), delivery and adoption observations (378-530), source invalidation (532-571), the uneconomic recommendation (573-669), the unexecuted binding (671-717) and, after the same cache configuration and toolchain removal, the unsupported recipe (1279-1322). Every assertion of the original is in exactly one of the two, unchanged. The original repeated its git exit-status checks inline; they now live in one commit helper, so both tests check the setup commits they both make. No sleep, trial count, budget, retry or slow-timeout changed. The previous seven-test split had dropped the original’s restore of the baseline worker without its sleep before the

Authority compatibility

Committed .af/ policy keeps working as is. Machine files: the remote-checks mapping no longer takes checks (a pipeline’s remote_checks chooses), and [storage] is new machine-only configuration (budget-only by default).

Changes

• release: v0.11.0 (#183)

• Remote Checks: the pipeline chooses where a check runs (#186)

• Leave out a logged-out CLI default context once its kind is registered (#182)

• Bump jsonschema, num-bigint, minisign-verify and minisign; test damaged signatures (#188)

• build(deps): bump minisign from 0.9.1 to 0.10.0 (#177)

• build(deps): bump minisign-verify from 0.2.5 to 0.3.0 (#176)

• build(deps): bump num-bigint from 0.4.8 to 0.5.1 (#175)

• Bump jsonschema from 0.57.0 to 0.58.4 (#174)

• Add af task report, and require its block in every pull request (#192)

• Pin af 0.11.0 in .af/af.lock (#184)

• Charge zero and record unknown usage when a Provider reports none (#165) (#195)

• Hold af’s disk use to a machine budget (#213)

• Remote Checks are chosen by the pipeline, not by the machine. A Task pipeline’s check node lists checks (run on this machine) and remote_checks (run through the check’s declared remote executor); a project that wants both gates keeps two pipeline variants, and there is no per-machine switch. The machine-local mapping ($XDG_CONFIG_HOME/af/remote-checks.toml or AF_TASK_REMOTE_CHECK_POLICY_FILE) now names only where this machine may push gate branches for a repository: its checks key is gone, and a file that still carries it is refused. A pipeline with remote checks cannot be planned without a target, and its plan carries the effect publish-gate and the destination github:, which af task plan prints on EFFECTS and SEND, so confirming the plan is the consent; the target is read again before the check Attempt pushes. A pipeline without remote_checks plans and runs exactly as before (ADR-0140, amended).

• af provider status and the browser’s Providers pane no longer list the Claude or Codex CLI’s default context (claude-ambient, codex-ambient) when it has no login and a Provider of its kind is registered; it still shows on a machine with no Provider of that kind yet, and when it holds a login (ADR-0141).

• af task report TASK_ID... summarizes how recorded Tasks ran and what they cost, as one Markdown block between and, ready for a pull request description, or with --json one af/task-report@1 document (schemas/task-report-v1.json). The block leads with one line per pipeline the Tasks ran, its steps in dependency order with each step’s Worker by Provider kind and model and the gate’s check names, parallel steps of one role grouped (review (bugs, correctness: codex gpt-6-sol/high)), and **unknown pipeline**: not retained once for Tasks whose plan was collected or never made; then one row per Task, each a round, with its outcome, its review findings by severity (6 major, 1 minor, none, unknown when a round has no complete finding set, gate failed, or — without a review, and how many reviewers failed), tokens with thousands separators (205,295) and active time, and a Total: row of Attempts (failed), tokens and active time; then per round its runs, wall time, failed Attempts by reason class and charged tokens, and per node the Worker, Attempts, tokens, elapsed time and check results. Findings are counted once each as the round’s reduce step recorded them, and review rounds come from the Task’s log, so a round recorded before af task refresh still counts. Active time sums the Task’s runs, the leases in which an Attempt started, so waiting between af task runs, a refresh, the recovery of a pending Attempt and a resume that only publishes a settled result are not counted; a figure the Store does not record is shown as unknown. Each Attempt is charged to the Worker of t

Authority compatibility

Committed .af/ policy from v0.10.0 keeps working as is. Remote Checks are opt-in twice: a check’s [checks..remote] table is optional, and without an operator’s machine-local mapping every check still runs locally. To move a project pin to v0.11.0, run af onboard --refresh-lock --af 0.11.0. This is a public alpha: compatibility guarantees begin at 1.0; persisted pre-GA Task and Campaign state is unsupported across upgrades, so finish or inspect a Task with the release that started it.

Changes

• release: v0.10.0 (#154)

• Add af provider remove, and a d key for it in the Providers pane (#168)

• Sweep the sandbox directories a killed af process leaves in $TMPDIR (#169)

• Show TUI state in the brand’s colours, as chips (#172)

• Pin af 0.10.0, and pin every release the workflow publishes (#173)

• Pin af 0.10.0 in .af/af.lock (#164)

• Fix executable onboarding and first-run guidance (#156)

• Open the TUI on a splash of three workers while it loads (#181)

• Add private-host Provider authentication (stage 1 of #122) (#171)

• Remote Checks: run a declared Task check in CI through a draft gate pull request (#178)

• Make the first review walkthrough executable with reviewed, locally committed authority and explicit policy, Base and candidate selectors; no remote push or Provider login is needed to inspect a plan. Clarify empty Change Sets and source-build versus signed-release pins.

• Select the software catalog profile explicitly in implementation entrypoints and keep tutorial Task requests outside committed source Snapshots. Exercise the documented Quickstart and generated tutorial through token-free planning in regression tests.

• Sandbox directories are named af-sandbox--… under $TMPDIR, and every command that runs review or Task work (af review run, af task start --execute, af task run, af provider doctor) begins by removing the ones whose process no longer exists, finishing the removal before it exits. A sandbox is removed by the handle that owns it, so only a killed or aborted process leaves one behind, and a leftover tree that a Gate built into carries a whole target/: one development machine held 15 GB of them. The sweep keeps every directory whose process is still running and every directory the kernel preserved on purpose after an unconfirmed container cleanup (now marked preserved beside the tree), removes a tree only through directory descriptors opened without following links, touches nothing else under $TMPDIR, and reports what it removed in one stderr line.

• af provider remove ID... drops named Providers from the machine-local registry through the same locked, atomic publication add uses. Auth directories and their logins are left untouched, and the previous registry is preserved. It also repairs a registry made invalid by a deleted auth directory, runs in the invoking release from any repository, and refuses ambient IDs by name. In the browser, d on a registered Provider fills the : line with the command (ADR-0136).

• Add explicitly permissioned, private-host Provider authentication for browser-only setup and reauthentication, with Codex device approval, Claude code/callback support, bounded session state, recipient fencing and secret-free status. Generic setup login remains terminal-only; login never implicitly spends a model budget or resumes a Task (ADR-0137).

• Include a runnable, consent-bound personal-chat host for validated one-time browser challenges, native Codex headless device login and Claude 2.1.289’s exact unterminated prompt; reusable credentials remain native and ordinary af status stays challenge-free (ADR-0139).

• Preserve native authentication failure categories alongside usage diagnostics and suppress credential-bearing failed output before ordinary capture, re

Authority compatibility

Committed .af/ policy keeps working as is.

Changes

• release: v0.9.1 (#152)

• Fix Task writer lease under load, interrupted Workers, and unstartable Provider CLIs (#134, #135, #136) (#153)

• Research pipelines: warm checks, measure and compare, report Tasks, port bindings, store hygiene, and two verified research Tasks (#132)

• Ctrl-C (SIGINT) or SIGTERM during af task run, af task start --execute, af review run or af provider doctor no longer leaves Worker processes running after af exits. af stops and reaps every Worker process group, then ends by the same signal, so the shell reports 130 (SIGINT) or 143 (SIGTERM). The interrupted Attempt is recorded as a failed, cancelled Attempt and keeps its charge. The Task is not finished; stderr says to resume it with af task run TASK_ID. A second Ctrl-C while stopping kills the remaining Worker groups and exits at once (ADR-0129).

• A live Task writer no longer fences itself with Task writer lease is expired or fenced on a loaded machine. The lease heartbeat now observes the lease through its own Store connection. It renews through that connection when the work still holds the shared one with 4 s of lease left. That connection waits at most 1 s for SQLite’s write lock and retries with backoff, so neither a slow Store operation nor its write lock can outlast the lease. A renewal that commits after its lease expired is now refused inside the write transaction. A successor or an expired lease still fences and cancels the old writer, and is now seen without waiting for the held Store (ADR-0128).

• A Provider CLI that cannot start is reported as a Provider installation failure instead of surfacing later as an unrelated Worker or credential error. A CLI cannot start when it is missing, not executable, or exits non-zero on its own --version check. af provider status marks the context installation_failed and exits 4, and af provider setup returns provider_cli_missing. Task Provider admission refuses the binding before any Worker is dispatched or any Attempt is charged. Each report names the Provider ID, the program path, the CLI’s own first error line and the fix it suggests. A CLI that breaks after admission fails its Attempt as a Provider environment failure, not a model or credential failure (ADR-0130).

• A Worker’s draft reply may spell its citations and repository_citations in any order: the runner admits both sets in canonical order (sorted, unique) before validating the reply, so an author is judged on what it cited rather than on the order it listed it. This repository’s kernel/report gives its author two Attempts.

• Store hygiene and the warm cache’s two bounds (ADR-0135, package R5 of docs/design/research-pipelines.md; amends ADR-0131). af task list --sizes prints each Task’s CAS bytes — those only it reaches and those it shares with another Task or Campaign record — and the Store’s total; --json adds sizes to each entry and store to the document. af task gc --older-than DAYS --keep N previews, writing nothing, which finished Tasks beyond the newest N it would collect and why every other Task stays (running, unfinished, writer_lease, bound_by, kept_newest, kept_recent); --apply takes the Store’s writer lock, is refused while any writer lease is live, appends one task_collected transition carrying af/TaskCollected@1 per Task — referencing no artifact — and then removes every CAS object no uncollected record reaches, by a conservative walk through every digest a record spells. A stopped sweep is finished by the next run. A collected Task’s projection stops at its tombstone: af task list and af task show print collected with the retained summary (af/task-collected-inspection@1 for show --json,

Authority compatibility

Current-shape committed .af/ authority needs no edit for these fixes; updating the installed default does not change project pins. To adopt 0.9.1 deliberately, run af onboard –refresh-lock –af 0.9.1 online and review/commit the authority. Native Rust snapshots require an explicit captured request and operator mapping; absent mappings preserve cold setup. Pre-GA (0.x) Task/Campaign state has no cross-release compatibility guarantee and is not migrated; retain its original release to finish or inspect it.

Changes

• Explain Task verification budget rejections (#145)

• fix: clarify review timeout scope and externalize read-only gate reports (#146)

• Keep Claude Task Workers running on Claude Code 2.1.285 and across its updates (#147)

• feat(tasks): pinned private Rust snapshots for native checks (#151)

• Infeasible Task verification reserves now report required and available tokens, Attempts and wall milliseconds, identify exceeded resources, and list each protected node’s contribution, including Provider admission. These are declared allowances, not estimated runtime; admission rules and configured budgets are unchanged.

• Keep nextest CI JUnit reports outside read-only source trees during scripts/verify.sh, alongside the existing external Cargo target. Unique per-run report directories preserve failed-run evidence; temporary store-only tool configuration is removed afterward. Direct make test retains its existing report location and all test/profile settings are unchanged.

• Run make check and scripts/verify.sh as an unprivileged user, including in containers. The new sealed-source regression requires mode bits to deny writes; root or CAP_DAC_OVERRIDE bypasses that seal and fails the explicit precondition rather than silently skipping the regression.

• Correct the af review run --timeout-secs help: without --file (including the default routed run and explicit --campaign/--pipeline) it bounds each reviewer Attempt (default 1800 seconds, pinned in the Campaign manifest as reviewer_timeout_seconds), not the whole run; with --file it caps the whole Task at the lower of the flag and the file’s limits.wall_ms. Timeout behaviour is unchanged.

• Claude Task Workers no longer fail with Native billing usage is incomplete on Claude Code 2.1.285, whose final result counts requests in modelUsage that its top-level usage leaves out. A breakdown that no top-level counter exceeds is charged as the complete bill; a top-level counter above the breakdown is still refused (ADR-0125).

• An Attempt refused for incomplete billing now names the cause in its diagnostic, for example Native billing usage is incomplete: Claude top-level and per-model usage cannot be reconciled.

• A Claude Code or Codex update in the middle of a Task no longer refuses the Task’s next model Worker with Captured Task Provider identity is no longer current. The Task keeps running the client executable it captured when it started, and moves to the installed client if the update removed that file; the account is still proven before every invocation (ADR-0126).

• Native code checks can opt into pinned Rust from an explicit operator mapping; AF verifies and privately copies only that toolchain before dispatch, avoiding repeated rustup downloads in fresh check homes. Host Cargo/Rustup homes are not passed through, inherited Cargo subcommands remain available, and check writes are never promoted. Missing mappings preserve cold setup; invalid mappings fail closed. Trusted-local isolation is unchanged (ADR-0127).

Authority compatibility

Committed .af/ policy from v0.9.0-rc.9 keeps working as is. To move a project pin to v0.9.0, run af onboard --refresh-lock --af 0.9.0. This is a public alpha: compatibility guarantees begin at 1.0; persisted pre-GA state is unsupported across upgrades.

Changes

• Publish the tested v0.9.0-rc.9 CLI as the public alpha, available through the standard installer and af self update. Includes Task execution, sandboxed Review and the terminal browser.

• Mark the README as public alpha and document security support for the latest alpha.

• Add advisory Task preflight for lineage, budgets, and evidence (#142)

• Add an offline advisory orchestration helper, scripts/task-preflight.py, for original-source identity, declared admission/Worker allowances and explicit acceptance-evidence mappings. It reads native inspection exports without changing Task authority, budgets or acceptance; ambiguous replay, live reservations and semantic completeness remain explicitly unverified.

Authority compatibility

Committed .af/ policy keeps working as is.

Changes

• release: v0.9.0-rc.8 (#126)

• af self update: keep unverified –version out of the latest cache; make a failed update unmistakable (#128)

• brand: the afactory design system for the README, the website and the TUI (#127)

• Bump jsonschema from 0.56.0 to 0.57.0 (#125)

• TUI: fast Workers open; list old-release Stores once; uix measures latency (#130)

• tui: the bare ? help opens with the pixel worker; CHANGELOG entry for the brand (#129)

• Halve the gate: parallel test processes, linked-once test binaries, a compile cache that hits (#131)

• Change notes per pull request under changelog.d/; CHANGELOG.md never conflicts (#140)

• providers: a 15-second Codex probe budget (#133)

• TUI: Pipelines read in batches; spawn-count guard; index flags do not hide drift (#138)

• The design system: brand/ keeps the designer’s wordmark (AFACTORY with three workers) and derives every asset from it with brand/gen.py; brand/tokens.css and tokens.json carry the palette, type, spacing and radii; brand/README.md is the brand book. The README opens with the banner; the tagline is “agent pipelines made fast”. The browser paints its status line ink on the brand’s blue and its errors pink where COLORTERM says the terminal takes truecolor, and as before otherwise (#127).

• The browser’s bare ? help opens with the pixel worker, the version and the tagline above the key reference.

• make check runs its tests one process per test across every test binary at once (cargo nextest run --profile ci), with TEST_THREADS set from the machine’s cores; the five tests that assert against a fixed real-time budget run alone and first, listed in .config/nextest.toml. The longest tests are split one case per test, the eight largest crates link their integration tests as one binary under tests/it/, doctests are off (there are none), and debug information is line tables only. CI compiles through sccache keyed by rustc inputs, caches only the crate registry, links with lld on Linux, and lints in a job beside the tests (ADR-0124). Measured on a 14-core developer machine: the test step 661 s to 289 s, a cold test build 58 s to 46 s with 122 to 48 executables and 5.7 GB to 3.5 GB, the doctest step 22 s to none.

• The browser’s Workers pane opens in a tenth of a second instead of most of one: it reads every committed declaration, prompt and lock with one git cat-file --batch and checks their drift with one git diff --literal-pathspecs --name-only, side by side, where it spawned about four git processes per Worker on every open (0.79s to 0.06-0.13s for 14 Workers on a loaded machine). A file name with * or [ is now compared literally.

• The Tasks pane lists the Task Stores an earlier (pre-GA) af release wrote as one bar entry, ! N old Stores, and one note saying where they are and that af does not read pre-GA state (ADR-0113), instead of an error row each. A Store refused for any other reason still shows its own error. review_core::event::ANOTHER_RELEASE is the phrase both sides share.

• The Codex status and subscription probes allow 15 seconds instead of 5. On a loaded machine (a full build, an IDE indexing) starting codex alone took long enough that af task run refused a healthy provider with Codex subscription probe timed out after 5 seconds, and provider tests failed in Task gates. Claude’s structural probe already allows 30 seconds.

• The browser’s Pipelines pane reads every committed pipeline, the catalog and their drift with the same two batched git calls as the Workers pane, instead of two git processes per pipeline. Tests assert both panes spawn as many git processes for 30 entries as for 2, so a per-item read cannot come back unnoticed.

• A declaration marked skip-worktree or assume-unchanged in the index is still marked * when its working-tree copy differs from HEAD: git diff does not c

Authority compatibility

Committed .af/ policy keeps working as is; a source-writing Worker that declares execute-checks gets a shell, and only then (ADR-0120).

Changes

• release: v0.9.0-rc.7 (#118)
• Give a source-writing Worker that declares execute-checks a shell (ADR-0120) (#119)
• The af browser’s Tasks pane (docs/design/tui.md §5.5) (#120)
• TUI: the Workers pane (M4) (#123)
• TUI: hand af commands off from the : line (M5) (#124)
• Give a source-writing Worker that declares execute-checks a shell (ADR-0120): worker_access maps write-source plus execute-checks to WorkerAccess::WriteSourceWithShell, the Claude adapter grants Read,Glob,Grep,Edit,Write,Bash and Codex runs workspace-write, and the shell’s process group dies with the Attempt. Candidate capture skips the scratch a shell leaves: paths under a top-level name the source did not hold, and new top-level dotfiles (SealedSandbox::capture_snapshot_where). A writer without execute-checks is unchanged. The kernel’s kernel/implementer declares it and formats, lints and tests before replying.
• The browser’s Tasks pane (ADR-0121, docs/design/tui.md package M3) lists the scope’s Tasks under running/, awaiting approval/, done/ and failed/, newest first, as task-id outcome progress%. The user scope adds one level per repository’s Task state. A Store the binary cannot read is an error row naming its directory. One Task’s pane shows TASK, PLAN and SNAP lines, one PROGRESS row per stage of the plan’s graph order ([ok], [..] with its attempt, [!!], [ ], with recorded wall and charged tokens), the TOKENS and TIME totals, and one HISTORY row per event. Every value comes from af task list --json and the af task explain --json document (af task show --json with the plan and its graph), or from an artifact they name. A running opened Task is read again about once a second off the key loop. Enter on a HISTORY row shows its artifact, p opens the Task’s pipeline, y yanks the Task id and R reads again. The af task show builder is split from its printer, and default_task_state is the one spelling of the default --state. No --json document changes.
• The browser’s Workers pane (ADR-0122, docs/design/tui.md package M4) lists the reviewer Workers and Task Worker packages HEAD commits under .af/workers/, .af/task-packages/, .af/packages/ and .af/vendor/, grouped by source when more than one has Workers. The folder is read when it is first opened. One Worker’s pane shows IDENTITY (its declaration and its af.lock or catalog pin, unpinned or pinned elsewhere), then STATE, then PROMPT (reviewer.md or instructions.md as committed, with gf opening the working-tree file). STATE counts the Attempts in this scope’s Task Stores whose invocation ran a slot that the recorded plan binds to the Worker at the digest the committed pin records (other digests of the name on one other line), a Review shard’s through the node that owns it, and a reviewer and a Task package of one name apart: reserved, settled ok, settled failed and released, plus the tokens charged and the wall time. Every open reads again. A drifted file is marked *, and a failed read of HEAD is shown above the last good entries. No --json document changes.
• The browser’s : line runs af commands (ADR-0123, docs/design/tui.md package M5). A line that clap parses and the browser does not own (:q, :cd, :scope, :e and :help keep their behaviour) runs as a child of the running af executable, with exactly the parsed words as its arguments. It runs in the scope’s root, inherits the environment, and carries AF_DISPATCHED_FROM, so it is never dispatched to another release. The browser releases the terminal, and the child’s process group owns the foreground, so `` stops the child, not the browser. The released screen then shows af LINE: exit N (or the signal) and waits for Enter. After it, the browser reads again the scope, the settings and the T

Authority compatibility

Committed .af/ policy keeps working as is; execute-checks on a review Worker is opt-in.

Changes

• release: v0.9.0-rc.6 (#107)
• Name the CLI crate after its binary: crates/af (#108)
• Bump base64 from 0.22.1 to 0.23.1 (#103)
• Bump the cargo-minor-and-patch group across 1 directory with 3 updates (#101)
• test: stop reporting a reaped descendant as live after cancellation (#109)
• Take the toml, toml_edit and jsonschema updates, parsing TOML documents as tables (#111)
• Bump toml from 0.8.23 to 1.1.6+spec-1.1.0 (#102)
• Bump toml_edit from 0.22.27 to 0.25.15+spec-1.1.0 (#105)
• Bump jsonschema from 0.26.2 to 0.56.0 (#104)
• Make Provider onboarding safe for agents (#112)
• Remove pre-GA legacy, migration and compatibility code (#114)
• Keep .af/ to declarations: layout table, undeclared-path report, Task input bindings (ADR-0112..0114) (#113)
• Pin Opus 5.5 and GPT-6 Sol defaults (#116)
• Fix source install adoption by af self (#115)
• Bare af opens a vim-native TUI; review Workers may run a shell (execute-checks) (#117)
• Bare af at a terminal opens a read-first, vim-shaped browser (ADR-0119, docs/design/tui.md package M1). On a pipe, bare af still prints help to stderr and exits 2. The scope comes from config::load: the user scope outside a repository, the project scope inside one, or af --repo DIR. A 28-column folding bar holds providers/, workers/, pipelines/ and tasks/. Beside it, the Settings pane shows the layer table and the effective values with their origins, as af config paths and af config show --origin print them, and e opens a layer with af config edit. The Providers pane shows the af provider status columns with a bar per quota window, and R runs the bounded usage probe off the key loop. The Pipelines pane shows, verbatim, the af task explain --tree text of a token-free plan compiled as af task plan compiles one, into a scratch Store; the status line shows the highlighted slot’s Worker binding. The Workers and Tasks panes arrive in later packages. : lines are parsed by the CLI’s own clap definition. The terminal runs through rustix::termios, an existing dependency, instead of the planned crossterm. No --json document, schema or fixture changes. Discovery under .af/task-packages/ walks every real directory, however deep, and keeps walking below a package. Escape sequences split across terminal reads decode whole (tui::keymap::Decoder), and a lone ESC is Escape only after a read brought nothing. Outside a repository the user scope never opens a directory layer, so a broken .af/af.toml above a plain directory cannot block it. af --repo DIR with no subcommand is exempt from pin dispatch like bare af. The bar lists the pipelines HEAD commits and reads every declaration from HEAD, the authority a preview compiles, marking a working-tree file that differs; a package the kernel refuses to plan shows its declared contract; a review Pipeline shows its committed declaration. af config edit user names the user layer without reading the ladder, so a directory layer that does not parse cannot block it. e on a highlighted layer opens that exact file, so two present directory layers cannot swap; a settings refresh or an editor hand-off whose reload fails says the settings are stale and why, instead of calling them refreshed; the Worker-binding status follows a modified package’s notice row; a malformed escape stream is bounded and dropped through its terminator. Git runs for the pipelines pane with a cleared environment and an allowlist, so an inherited GIT_DIR cannot redirect it; a failed read of HEAD is an error above the last good entries, not an empty catalog; entries are bound to one resolved commit and read again before a preview when HEAD moved; a package is previewed only when the committed catalog pins its name at that file; an editor hand-off refreshes the opened pane; the status line yields the breadcrumb before cutting a binding or an error at 80 columns. A preview compiles the e

Authority compatibility

Prerelease: committed .af authority keeps working as is and needs no migration. The sha2 0.11, rusqlite 0.40 and jsonschema 0.56 updates change no stored spelling: Attempt IDs, sha256: artifact addresses, receipt prefixes and local state directory names are byte-for-byte what earlier releases wrote, and review_core::hex::encode pins that encoding under test. The machine-local Provider registry stays version 1 — af provider setup and af provider recover run in the invoking release instead of dispatching through a repository pin, and a replacement is published by one atomic exchange, so a supported pinned reader sees either the complete old registry or the committed new one (ADR-0111). The one change that can stop a working machine: Provider admission now revalidates auth directories, so an existing symlinked, foreign-owned, or group/world-writable auth directory or registry is refused until its ownership and permissions are tightened. Refresh a consumer pin explicitly with af onboard –refresh-lock after verifying the release and its archive digests, and keep the previous release for rollback.

Changes

• release: v0.9.0-rc.4 (#98)
• build(deps): bump actions/checkout from 4.2.2 to 7.0.1 (#82)
• build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 (#81)
• build(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 (#80)
• Take the pending dependency updates, adapting digest and SQLite identities (#99)
• build(deps): bump clap_mangen from 0.2.33 to 0.3.3 (#87)
• build(deps): bump rusqlite from 0.37.0 to 0.40.2 (#86)
• build(deps): bump sha2 from 0.10.9 to 0.11.0 (#85)
• Bump nix from 0.30.1 to 0.31.3 (#84)
• build(deps): bump jsonschema from 0.26.2 to 0.56.0 (#83)
• Make fresh Provider onboarding copyable (#90): make fresh Provider bootstrap one command with af provider setup, keep af provider add for already-authenticated contexts, isolate login environment and auth-directory ownership, make setup serialize by canonical auth context, distinguish ambient discovery labels from selectable registry IDs, preserve every Gate and executing release in onboarding’s copyable apply command, make registry publication serialized, conditional, durable and atomic across pinned releases, secure its directories and files independently of umask, reject unpublishable auth paths before login, bind security-sensitive operations to stable directory handles, provide hash-validating fail-closed recovery with af provider recover, and make the README’s Codex-only quickstart complete.
• Skip the last non-UTF-8 path test where the filesystem refuses such a name (#106)
• release: v0.9.0-rc.5 (#100) — tagged but never published: its macOS check leg failed, so everything it carried ships here instead.

Authority compatibility

Prerelease: committed .af authority keeps working as is. Every warm layer is opt-in per reviewer node (warm = { notes, build_cache, workspace, session }); a pipeline that declares none behaves exactly as before, and the Store, the run events and the pinned authority mirrors gain additive records only, with no migration. The session layer is Claude-only and defaults to off: Codex reviewers and Task-hosted Review Attempts record a drop reason and run on Notes instead. A candidate-built build cache is an explicitly unsafe artifact, never a Cache Snapshot, and is refused under the safe policy at load, at selection and at capture. WarmSetSelected@1 first ships here, so its vocabulary closes with this release (ADR-0107). Refresh a consumer pin explicitly with af onboard –refresh-lock after verifying the release and its archive digests, and keep the previous release for rollback. No cold-versus-warm savings Evidence exists yet, so the design review’s build-minute and forked-resume Demands stay open and both session and workspace policy defaults ship off.

Changes

• release: v0.9.0-rc.2 (#93)
• Add self-optimizer economics, experiments and light optimization (#94)
• release: v0.9.0-rc.3 (#95)
• Reduce release latency with shared validation and concurrent builds (#96)
• Start Workers warm from declared layers and confirm clean Rounds cold (#97)

Changes

• Add the first Worker warm layer: a reviewer node with warm = { notes = true } asks each admitted Attempt for bounded Worker Notes, carries them to the next Round’s Attempt of the same node as review.kernel/WorkerNotes@1, marks every path against the previous head in a review.kernel/HeadDelta@1, and records the selection as review.kernel/WarmSet@1 with WarmSetSelected@1 before dispatch. Notes are parsed beside the flat Reviewer Result, dropped with a recorded WorkerNotesRecorded@1 reason when malformed or over notes_max_bytes, and rendered as data with their own context manifest entries; af review report shows the layers and rendered input per Attempt. Task Workers may declare optional af/WorkerNotes@1 ports that the compiler wires only within one slot. With warm absent nothing changes (ADR-0107).
• Carry the Gate’s build to Worker sandboxes as the second warm layer: a trusted_local Gate that declares build_caches = ["cargo_target"] builds into the reserved .af-cache root with CARGO_TARGET_DIR pointed at it, captures the result after its checks pass as an explicitly unsafe review.kernel/BuildCache@1 (regular files only, no-follow traversal, entry, depth, path and byte limits, fixed modes, stripped xattrs and ACLs, producer and head provenance), and records BuildCacheCaptured@1 with the artifact or a refusal reason. A reviewer node with warm = { build_cache = ["cargo_target"] } receives a per-Attempt clone from the CAS through its WarmSet@1, the bytes are removed before seal so the sealed diff equals a cold run’s, and the safe policy refuses the declaration at load and the handoff before any dispatch. The registry-only cargo Cache Snapshot and the self-optimizer cache path are unchanged (ADR-0108).
• Add the Warm Workspace as the third warm layer: a reviewer node with warm = { workspace = "rebase" } keeps one stable template root per Campaign under $XDG_CACHE_HOME/af/workspaces, named in its WarmSet@1 by an opaque workspace identity rather than a host path. On a new head the kernel applies the tree diff to a copy-on-write clone of the previous template, scans the result and swaps it in only when its manifest digest equals the head’s Tree Digest; any other outcome falls back to a full materialization from the CAS with the reason recorded. An unchanged head materializes nothing and is verified by a read-only scan before it is reused; the root’s marker is trusted only against the Campaign log’s last

Authority compatibility

Prerelease: existing .af authority remains supported. Self-optimization is opt-in and requires a reviewed project optimizer catalog, bounded policy and the RC3 binary; generated experiments still require exact signed developer approval. Refresh a consumer pin explicitly with the supported onboard refresh-lock path after verifying the release. New optimizer state and Task inspection/transition formats require a compatible binary; preserve the prior Store and known-good release for rollback. Heavy redesign, live paid savings demonstrations, longitudinal adoption and stable-release migration/pilot gates remain pending. This release does not switch consumer pins or claim stable readiness.

Changes

• Add project-history capture and reporting with explicit token, elapsed-time and cache evidence (#94).
• Run bounded optimization experiments with signed approvals, independent evaluation and exact accounting (#94).
• Add light optimization for Worker instructions and safe Cargo cache selection, with payoff gates and durable adoption evidence (#94).
• Exercise candidate model contexts and delivered cache settings through real Task paths; coordinate the completion-order test explicitly to avoid scheduling flakes (#94).

Authority compatibility

Prerelease: af task start now captures and previews without dispatching Workers, including with --json. Review the plan, then run with --confirm-plan and its full captured ID. Automation must explicitly opt into --execute on start or on the first run of a plan. Admitted Tasks can resume and finished Tasks replay as before. This CLI confirmation never replaces signed developer approval for a generated plan. Existing .af authority remains supported; legacy .review migration and exact release pin verification still apply.

Changes

• Render captured Task plans as compact ASCII flows or expanded task explain --tree views, with embedded calls, actual Worker models/efforts/accounts, inputs, outputs, effects and limits.
• Stop new Tasks before execution and refuse stale plan confirmations, including a plan change before the writer lease is acquired. Explicit automation retains existing runtime admission.
• Keep JSON inspection schemas unchanged, sanitize terminal display text, and document the preview/approval workflow for Claude and Codex.

The live pilot and complete consumer migration/rollback acceptance remain pending. This candidate does not declare stable-release readiness or change the active consumer’s pin.

Authority compatibility

This is a prerelease for Task integration and migration validation. Live pilot acceptance and complete consumer migration/rollback verification remain pending; this candidate does not establish stable-release readiness or replace the known-good consumer installation.

New Task execution requires its versioned .af catalog, Pipeline/Worker contracts and lock. Every generated Execution Plan requires an authorized developer’s exact-plan approval. Local bindings do not travel with shared definitions. Existing .review consumers still need the supported af onboard --migrate --apply path; validate migrated authority together with the chosen released binary and its verified archive digests before switching launchers.

New Review executions use the common Task runtime. Historical paid Campaigns preserve their captured executor, authority and accounting; they are not rewritten into new Tasks. Keep the original Store and known-good release for historical continuation and rollback. An older binary must not reinterpret unsupported new state, and rollback cannot refund recorded usage or reopen completed work. Release-bound migration and rollback evidence are release gates.

Changes

• Make Task the common durable execution model for implementation, Review and documents, with typed Pipeline input/output contracts, captured context and shared budget accounting.

• Compose reusable Review Pipelines inside implementation, with independent acceptance and bounded repairs that retain Finding and Snapshot provenance.

• Select fitting shared Pipelines; persist generated definitions and plans for developer review when configured generation is needed; export definitions for subsequent reuse.

• Share versioned Pipeline/Worker packages and starter workflows through Git, with local Provider bindings, deterministic contract checks, Jira/local source capture and explicit delivery to a new local worktree.

• Preserve Provider usage and recovery evidence across cancellation, writer loss and storage failures, and capture explicit admission allowances in Task catalog V2.

• Preserve nested Jira requirements, resolve explicit relative refresh files from the caller’s directory, and retain plans when only unselected Jira fields or update timestamps change.

• Make identical authenticated plan-revocation requests idempotent and refuse revocation of decisions that were never approved.

• Reduce repeated captured Review validation, heartbeat and receipt-query work while retaining fresh artifact, lease, approval and usage checks; stream raw usage transcripts with bounded memory.

• Open the repository: install.sh installs from a public release with curl alone, verifies the release signature by default when minisign is present, and keeps gh only as a fallback; the release also ships LICENSE (Apache-2.0), SECURITY.md, CONTRIBUTING.md and a restructured docs/ (architecture, tasks, migration, non-goals, design notes).

• Account for every model reported by native Claude Task usage; preserve auxiliary charges and refuse unapproved auxiliary activity instead of accepting an Opus selector alone.

• Use native JSON schemas and structured output for typed Claude Task replies while retaining independent Kernel output validation and the existing legacy text transport.

• Preserve prerelease versions in migrated authority so the candidate can read its own output.

• Retry transient executable-busy process starts and correct concurrent Linux test allowances.

• Explain logged-out Provider status and install declared toolchain components in release jobs.

Validation boundary

The release workflow checks the tagged source on Linux and macOS, runs consumer fixtures, and signs archive checksums. These deterministic checks do not replace specialist reviews, live Task measurements or actual consumer migration and rollback rehearsals. See Task execution for the contracts; candidate publication does not claim those remaining acceptance gates have passed.

Authority compatibility

Requires af onboard --migrate --apply for a consumer still on .review/: legacy authority is no longer read for new Campaigns (ADR-0043). A repository already on .af/ keeps working, but re-pin it with af onboard --refresh-lock so the lock records the per-target archive digest this release binds to. A 0.7.1 default cannot read a lock written by 0.8.0 (its [af] table is an unknown field to the older parser), so it neither dispatches to 0.8.0 nor plans: run af self update first on such a machine.

Changes

• Route pipelines by changed paths; switch oversized Diffs to a bounded pipeline (#64)
• Show Campaign state on disk and reclaim it with af review gc (#66)
• One release train, a pin that binds bytes, and .review/ retired (ADR-0045) (#68)
• Commit the minisign release public key: every release from 0.8.0 ships a signed SHA256SUMS

What’s Changed

• docs: record v0.7.0 release by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/44
• Plan consumer policies with every built af by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/48
• Validate and migrate legacy .review/ policy in af onboard by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/49
• Refresh the hub consumer fixture: one correctness reviewer by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/51
• Make wall-clock, provider usage, and dispositions visible per review by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/54
• Let a Worker node declare its own Attempt cap by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/60
• Render a Worker’s exact input token-free by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/61
• Refuse a Worker input that exhausts its Attempt cap before admission by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/62
• Make af self-managed: clap tree, scoped help, completions, af self, dispatch, config ladder by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/63
• release: prepare v0.7.1 by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/65

Full Changelog: https://github.com/PakhomovAlexander/afactory/compare/v0.7.0...v0.7.1

What’s Changed

• Record v0.6.0 release by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/30
• Harden review planning and provider admission by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/31
• release: prepare v0.7.0 by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/43

Full Changelog: https://github.com/PakhomovAlexander/afactory/compare/v0.6.0...v0.7.0

What’s Changed

• Complete Review Kernel M7-M9 by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/28
• Release v0.6.0 by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/29

Full Changelog: https://github.com/PakhomovAlexander/afactory/compare/v0.5.0...v0.6.0

What’s Changed

• Record the v0.4.0 onboarding release by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/14
• Complete M3 grouping and M4 evidence resolution by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/18
• Fix remaining M4 verification findings by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/19
• Implement M6.3 broker handles by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/24
• Default review campaigns to light mode by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/25
• Release: prepare v0.5.0 by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/26

Full Changelog: https://github.com/PakhomovAlexander/afactory/compare/v0.4.0...v0.5.0

What’s Changed

• Record the v0.3.0 trusted-pilot release by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/12
• Add deterministic review onboarding by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/13

Full Changelog: https://github.com/PakhomovAlexander/afactory/compare/v0.3.0...v0.4.0

What’s Changed

• Complete V3.1 trusted client pilot delivery by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/11

Full Changelog: https://github.com/PakhomovAlexander/afactory/compare/v0.2.0...v0.3.0

What’s Changed

• M2.5: derive report scope from round subjects by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/5
• Fenced provider admission before reviewer dispatch by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/7
• feat: report Claude weekly and Fable limits by @apkhmv-agent in https://github.com/PakhomovAlexander/afactory/pull/6
• Release v0.2.0: complete M2 review authority and scope by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/9

Full Changelog: https://github.com/PakhomovAlexander/afactory/compare/v0.1.0...v0.2.0

What’s Changed

• Establish the Afactory CLI and private release boundary by @PakhomovAlexander in https://github.com/PakhomovAlexander/afactory/pull/2
• feat(reviewctl): show provider subscription status by @apkhmv-agent in https://github.com/PakhomovAlexander/afactory/pull/4

New Contributors

• @PakhomovAlexander made their first contribution in https://github.com/PakhomovAlexander/afactory/pull/2
• @apkhmv-agent made their first contribution in https://github.com/PakhomovAlexander/afactory/pull/4

Full Changelog: https://github.com/PakhomovAlexander/afactory/commits/v0.1.0