task_cost_budget, task_time_budget_minutes and task_token_budget no longer
exist: a task is not capped by what it spends. Old config files carrying them
are cleaned on start with a one-time notice, and the settings declaration and
config template drop them. The budget machinery a Goal run injects for itself
(goal_token_budget, off by default) and the run usage accounting stay. The
effect tests that only exercised the configured budgets are removed, and the
Windows CI steps that named them are pruned in the same commit.
Context maintenance follows one trigger: a share of the model window, now
0.90 by default for new configs (existing files keep what they saved).
Removed the absolute-size economic boundary and its setting, HTTP route and
settings UI, the draggable fold handle in the context panel, the retired
multi-threshold and cold-resume keys (old files are cleaned on start), and
the failure-output elision applied to retained messages during a fold,
including the extra model call that picked the lines to keep.
The pull-request-only Windows steps listed tests by name and failed when one
was missing. The sub-agent, isolation, background-job and carried-proof
rewrites deleted a number of them, so every pull request failed its Windows
check. Drop the steps whose whole list is gone, prune the removed names from
the rest, and remove the concurrency inventory runner whose two inventories
named nothing that exists.
complete_step now only says a step is done: it names the step and what is now
true, and the host advances the task list as before. It no longer asks for
commands, files or criteria to cite and no longer checks them against the
session's receipts.
conclude_blocked existed to let the readiness gate through and goes with it;
the prompts that pointed at it now ask for a sentence in the reply. Plan steps
lose their acceptance and verification fields: the submit_plan schema, the
planner and executor prompts, the rendering and the re-approval rule all
stop mentioning them, and plans saved with them still load.
The executor's no-action nudge now keys on a plan naming files only.
Both only steered the final-readiness gate, which no longer exists: the flag
chose exit 3 for an unmet readiness verdict and the setting chose whether a
changed turn was held for a check, a review and a sign-off. Neither can do
anything now.
`run` still exits 4 when an untrusted folder refused its edits. A user config
that still carries host_verification loads unchanged; the key is ignored.
Removes the HoldOwedChecks and WaiveOwedChecks plumbing behind them.
A session method refused because another runtime owns the transcript answered
-32600 and prose, the code a malformed frame gets; an ownership probe that could
not decide answered -32603, the same as a disk that would not write. A client
could not tell "held" from "unreadable" from "your request was broken", so it
could not decide whether to ask the person to close a window or retry.
session/new, session/load and session/resume now answer -32022 with data.code
busy.session_in_use for a held lease and -32023 with data.code
session.lease_unprovable when the store's probe cannot prove ownership either
way; -32600 is left to a genuinely malformed request. The human message stays.
The HTTP frontend, the kernel, the lease and the inbox are untouched.
docs/ACP.md states the table and what a client does with each answer. repolint's
family-vs-writer check is now parameterised by family; it reads the lease
sentinels beside the inbox ones, so a lease sentinel added without a coded case
fails by name against the ACP writer.
The loop no longer classifies a tool-call turn that arrived without
reasoning, retries it, or keeps a file-backed cooldown for it. Removes the
watch and the cooldown state, the deferred stream sink they needed, the
provider policy interfaces and their implementations, the descriptor field on
the extension wire (schema and SDK regenerated), the state-dir path, the
run-metrics counters and the protocol-recovery kinds.
The protocol-recovery audit channel itself stays for now.
Electron 45 ships electron_wer.dll, unsigned, and no longer ships dxil.dll.
Sign electron_wer.dll with the other unsigned PE images, and stop requiring
a Microsoft-signed dxil.dll. Checked against the 45.1.0 win32 x64 and arm64
archives: both hold exactly the declared set.
--password put the serve password in argv, where ps and /proc/<pid>/cmdline
show it to every local user; --hash-password needed it there too. Add
--password-file, held to the same single-line, owner-only rule as
--token-file, and accept it for --hash-password.
Fixes#14913
`doctor runtime` always passed a nil BuildResult, so it read the empty
process-local DefaultRuntimeOwner and printed clean=true/cleanRollback=true as
facts about a session it could not observe. The receipt ledger is in-process
only, so a fresh CLI cannot know whether a crash or mid-migration left
irreversible work.
Report recoverability and resume as nil (JSON null) when no runtime was
available to ask; the text says unknown and names why. The BuildResult seam
still computes and prints the observed verdicts exactly as before.
Problem: upstream studio changes made the model-health UI PR conflict in Composer.
Root cause: studio added WorkspaceInfo while the health hook removed the former
inline ModelEntry loading state in the same import declaration.
Fix: retain studio's workspace information, running-message intent and composer
hint behavior alongside the consent-gated health hook. Remove the unused
ModelEntry import. The grouped picker, default-off setting and old-server hints
remain unchanged; the feature diff remains 514 additions across 22 files.
Verification: production frontend build, frontend tests and census; go vet,
pinned lint and repository checks; HTTP health authorization/settings tests,
builtin tests and inventory-reconciled boot partitions.
Problem: Accepted total-only usage remained visible to reporting but did not
cross token budgets, allowing additional tool rounds after the known spend.
Root cause: Both local and shared-root enforcement added only input/output
components, so missing or partial splits hid a known reported total.
Fix: Use one accounting helper for the larger of the nonnegative total and
component sum, and saturate both counters. Keep usage, pricing, shadow component
telemetry, context ownership and existing soft-gate/finalization behavior.
Verification: Real OpenAI HTTP/SSE adapter and Boot execute real file tools.
Final19named regressions pass; exact preceding owners fail10 events with9controls.
Root240packages once:24330named passes/215existing skips. Complete Agent race
2162pass/10existing skips; focused Boot race7pass. Vet, pinned lint, check, format,
workflow and release gates pass; four Win/Linuxamd64 checks compile only.
Problem: An isolated candidate deletion could follow a source directory link
and remove a file outside the repository while reporting success.
Root cause: Leaf comparison followed ancestor links and publication deleted
through an ordinary pathname, without an ancestor precondition or held root.
Fix: Check ancestors before path-by-path leaf hashing and before publishing
deletions, and delete through an open repository root. Preserve whole-workspace
file-to-directory conversion and the Store's existing same-ID conflict retry.
Extend the existing Windows isolation inventory with junction regressions.
Verification: Final root inventory covers 240 packages once with 24324 named
passes and 215 existing skips. Both required package commands exit zero.
Complete worktree/isolation race has 242 passes and no skips. The final focused
13 names pass; the exact preceding owner fails 9 events with 4 controls.
Vet, pinned lint, check, format, workflow and release-note gates pass. Windows
and Linux amd64 compile checks pass; native hosted verification is pending.
SessionLeaseHeldByOtherRuntime folded every lease-lock probe failure into
"held", so a lock it could not open became the same answer as a live holder.
Redaction then skipped a session nobody held and reported an active lease,
leaving the secret scrub silently incomplete; session and task listings
claimed active/running on the same non-evidence.
Add ErrSessionLeaseUnprovable beside ErrSessionLeaseHeld and expose
SessionLeaseOwnership as the three-state probe. Only ErrSessionLeaseHeld
proves a holder; any other lock failure is unprovable with its cause kept.
The bool wrappers keep their old "may be busy" answers, so callers that only
skip work are unchanged.
Redaction refuses an unprovable session, reports it as a skipped file with
the reason (and exits non-zero), and never calls it an active lease. Machine
session state and running task/subagent status become unknown when ownership
cannot be proven; held and free keep their current answers.
yhh