Changelog

Selected notable releases for DivineSWE are documented in this file. For the complete history, see the git log.

The format is based on Keep a Changelog.

[2.2.0] — A Seat in a Foreign House (Books 114)

DivineSWE takes a seat in a foreign house. Until now the pantheon kept house in four harnesses, each fed a generated package. 2.2.0 also installs into the pi coding agent, straight from the repository root, with a small bridge that gives pi what Claude Code’s hooks and subagents give: the plugin root, DivineSWE’s standing context, and a seat tool that runs each summoned seat as its own pi process on its own model. The same release hands the Avatar scripts for the record it used to keep by hand. Forged by the Avatar from docs/specs/forge-pi-harness.md and docs/specs/forge-downstream-scripts.md, with three smaller forges.

Added

DivineSWE in pi. pi install git:gitlab.com/aidragonhq/divineswe on pi 1.4.0 (older releases are not supported) loads the skills and the pi bridge, extensions/divineswe/. The bridge sets CLAUDE_PLUGIN_ROOT for every command; appends DivineSWE’s context, and a note reading the Claude-worded skills in pi’s terms, to each run’s system prompt — never as a saved session message; and registers the seat tool Agent, which runs one seat per call as a child pi --mode json on the model and thinking level avatar summon printed, judges it by its event stream rather than its exit code, and stops it on an abort. Seat models come from divineswe-models.json in pi’s agent directory, which maps DivineSWE’s model ids (opus, sonnet, haiku) to pi models, so DivineSWE’s own config keeps its ladder. Install at personal scope, and update DivineSWE with pi update git:gitlab.com/aidragonhq/divineswe — a bare pi update updates pi itself. Walked end to end on a local llama.cpp model.
failing-set.mjs. node scripts/failing-set.mjs diff --base <report> --head <report> compares two test reports by test id — net-new failing, healed, vanished and still failing — reading vitest and jest JSON, JUnit XML and TRX; run --base <rev> --command "<cmd>" runs the suite in a detached worktree at the base and at HEAD and compares them. avatar-forge’s closing step names it.
spec-record.mjs. fulfil, answer and status write a forge spec’s ## Fulfilment lines and flip its status, refusing an undeclared Mandate, a sha that is no commit, and a flip while any Mandate is owed.
Findings at the command line. output read-summary --format findings lists a 4eyes or Loki document’s findings, and vow open --from-finding <task-id>#<n> opens one vow from the ones a round defers.

Fixed

divineswe-init never erases an existing plugin-root env entry, refuses to write one it cannot resolve, and seeds status.json and session-state.json through the state CLI (status seed, session seed).
vow reconcile names the TABLETS archive it read and whether it was there, and reports owed seal vows as out of scope rather than “still owed: 0” when it is absent.
The Copilot package’s self-locating paths are each one quoted shell word, so a COPILOT_HOME with a space in it works, and every fence holding one is tagged bash.
output write refuses a --task-id that disagrees with the payload’s, so one seat’s document can no longer land on another’s.

Housekeeping

Three specs sealed against their evidence (forge-claude-realm, grill-craft, adversarial-model-diversity), six research records committed, and nineteen vows ranked by priority.

[2.1.1] — Where Mortal Hands Touch (Books 114)

The walk is for what a mortal hand touches. 2.1.0 gave every forge spec a Human Testing Sequence and asked its steps to cover every Mandate. A person can always run the script a test runs, so every technical Mandate got a step of its own, and the walk became a slower re-reading of what the tests had already sworn to. This patch returns the sequence to its purpose: a functional walk, in which a person uses the built work the way its user meets it and judges what they see. Forged by the Avatar from docs/specs/forge-functional-walk.md.

Changed

The Human Testing Sequence is a functional walk. Each step uses the built work the way its user meets it — invoking a skill, running a command, opening a page — and says what you should see happen. A step never repeats what a script can prove — a file holding a phrase, a command’s exit code, a test passing — because the spec’s ## Fulfilment already proves it. Steps cite the Mandates they exercise; a Mandate no step exercises needs no step, and the Not by hand: line is retired.
The sequence is optional. A spec carries one when its work changes something a person uses — a skill, a command, a page, a message. A spec whose work no person uses directly, such as a refactor, a test or a CI job, carries none and ends fulfilled; the forge’s closing check for it is the evidence table alone, and a fulfilled one brought back to avatar-forge is told there is nothing to walk.
The sequence check holds the form, not coverage. node scripts/verify-testing-sequence.mjs <spec> now passes a spec with no sequence, saying it has nothing to walk, and steps that cite only some Mandates, printing how many they cite. It still refuses a section with no numbered step and a step citing an id the spec does not declare, exits 2 when it cannot read the file, and writes nothing.
oracle-envision, avatar-forge, docs/skills.md and the README describe the walk this way. The human-testing spec’s own fifteen-step walk of the retired rule is superseded; forge-functional-walk’s sequence carries the walk it still owed.

[2.1.0] — Walked by Mortal Hands (Books 114)

The pantheon proves the work; now a mortal walks it. Every forge spec carries a Human Testing Sequence — the steps a person takes by hand, in order, to see that what was built is right — and a spec the user has walked earns a new status, human-verified. Around it: vows carry a priority, so vow surface names the most pressing debt first; the Oracle shows a spec for approval by its path instead of pasting it whole; Copilot and Codex installs get the validator packages their schema-backed seats need from divineswe-init; and the generate-platforms skill, which only ever served this repository, is gone. No Book work ships here; everything was forged by the Avatar from the forge specs under docs/specs/.

Added

The Human Testing Sequence. A forge spec now carries a ## Human Testing Sequence section, between ## Later and ## Fulfilment: numbered steps, each saying what to do, what you should see, and which Mandates it verifies, and a Not by hand: line naming any Mandate no person can check by hand, with the reason. oracle-envision writes it and checks it before every showing, the Avatar’s ad-hoc door writes one too, and avatar-forge keeps the steps current in the same commit that changes what a person does or sees. node scripts/verify-testing-sequence.mjs <spec> is the check: it exits 1, naming the cause, when the section is missing, holds no numbered step, leaves a Mandate uncovered or cites an id the spec does not declare, and 2 when it cannot read the file; it writes nothing.
The human-verified status. At the forge’s end the user walks the sequence. A pass sets human-verified, after fulfilled, on a human-verified → line under ## Fulfilment, and the --spec gate refuses the status without that line. Accepting the evidence without the walk leaves the spec fulfilled; a failed step comes back as a core finding and is walked again; and a spec already fulfilled can be taken to human-verified later without being forged again. Existing specs are untouched, and no sequence is backfilled onto them.
Vow priority. vow open --priority <n> and vow update --id <id> --priority <n> set a whole-number priority from 0, the highest, to 10000, the lowest. vow surface ranks owed vows by it, 0 first, and shows P<n> on each prioritized row; unprioritized vows follow in their old order. vow list shows P<n> and keeps its newest-first order. A value outside the range, a fraction or an empty value is refused with exit 1 and nothing written. There is no default and there are no named levels, and a priority once set can be changed but not cleared.
Copilot and Codex get their validator packages from init. divineswe-init now runs scripts/ensure-runtime-deps.mjs, which installs ajv and ajv-formats into the plugin root with npm ci --omit=dev --ignore-scripts when they do not resolve, and reports nothing to install when they do. The generated Copilot and Codex packages carry the root package.json and package-lock.json it installs from. copilot plugin update drops node_modules, so run divineswe-init again after each update; the install docs say so. Claude Code is unchanged.

Changed

The Oracle points to the spec by its path. Each showing of a forge spec for approval, after every revision too, gives the spec’s absolute path and a short summary — what it sets out to do, how many Mandates it holds and, after a change, what changed — instead of pasting the whole spec into the conversation; ask, and it is shown in full. The approval contract is unchanged: the checks still run before every showing, and silence is not approval.
Schema-backed seats fail closed alike without the validator. Thoth, Monkey, Mason, Styx, 4eyes, Loki, Occam and Preacher all refuse to persist an output they cannot validate, where four of them used to fall back to a hand-kept check, and the session-start warning sends Copilot and Codex users to divineswe-init rather than to Claude Code.
Copilot and Codex agent text finds its own scripts. Those hosts set no plugin-root variable, so agent prose now gets the self-locating node …/scripts/<script>.mjs rewrite that skills already had.

Removed

The generate-platforms skill. It served only this repository’s maintainers and pointed at a generator no installed package carries. Every platform now ships the same eighteen skills — codex-cli no longer drops one — and the skills.exclude mapping key is gone with it. The platform packages are regenerated with npm run generate:all, as docs/platform-portability.md describes.
The installer in the Copilot and Codex packages. They no longer ship install-platform.mjs, and the install docs name the marketplace as the one Copilot route.

Fixed

Copilot and Codex seats persist their output. Those hosts install the plugin without node_modules, so a schema-backed seat could not validate and write its output; the init step above closes the gap.
Atlas’s churn angle counts a merge once. atlas-gather’s echo angle counted a merge against every parent, so merging a lagging branch looked as though it touched every file that branch lacked; it now counts only the files the merge changed.
The CI unit lane is green again, so a push to master builds and deploys the site; the 2.0.0 notes reached the docs that way.

[2.0.0] — Describe, Build, Audit, Commit Workflow (Books 114)

Describe what you want; it is built, audited and committed. 2.0.0 is DivineSWE’s Avatar workflow, and the first release numbered on its own major line. You describe the change to the live session — or, for involved work, design it first with /divineswe:oracle-envision, which researches, brainstorms concepts and sweeps for gaps before it writes a forge spec of Mandates, each with the proof it owes. /divineswe:avatar-forge then builds it in the live session, tests first, and the pantheon attends as reviewers: 4eyes audits every major unit before it is committed, Loki-Exploit attacks the work when it warrants, Occam weighs whatever Loki finds, and the Hermes second opinion, where one is set up, runs a closing 4eyes on a model from another family. The evidence is recorded in the spec, and nothing is called fulfilled until you check it.

Modern models are trained to decompose work into task lists and build tests first, so they do not need the full orchestration to do either. The Book cycle — Oracle Consult → Prophet Fulfill, a Book of ordered tasks walked seat by seat from INIT to SEAL — is kept whole as 1.0.0, “Full Multi-Agent Orchestration Workflow”, on the permanent v1.0 branch, where it is most useful with smaller and weaker models that need the decomposition and the gates supplied for them. On this line oracle-consult and prophet-fulfill remain only as deprecated doors for a Book already in flight.

0.68.0, 0.69.0 and 0.70.0 were this line’s releases before it took its number, and their entries below stand exactly as written. 2.0.0 carries all three, plus what landed after 0.70.0. The numbering is one semver line from here: 1.x is the Book cycle, frozen on v1.0, and 2.x is the Avatar line on master, continuing 2.1.0, 2.2.0 and onward.

Changed

The Avatar line takes its major number. Until now the newer line, at 0.70.0, was numbered below the older one at 1.0.0. No shipped number is renumbered: 0.70.0 still means what it meant, and 2.0.0 is that code plus the changes below.
The release guards accept a major bump. The version-sync pin takes the next minor or the next major of the release a target supersedes, read from this changelog, and steps over the 1.x line kept on v1.0; the bump fixture steps down a major line instead of deriving a negative minor; and the synthetic changelog fixtures move to numerals no release has published.
The repository’s own Vow register is pruned from 441 owed to 330: 34 closed with evidence, 78 waived, and 163 triggers that waited on “the next Book” re-pointed to the next change touching their subject.

Fixed

The Hermes carrier no longer claims a seat created .divineswe/ in its worktree when git checked it out. The note keyed on the directory being present, so in a repository that tracks .divineswe/ it fired on every clean dispatch. It now compares a reading taken just before the seat starts with one taken after, and a seat that really creates the directory is still reported.

[0.70.0] — The Oracle Sees Further (Books 114)

The Oracle looks further before anything is forged. Envision researches at a depth the user confirms, draws the design it settles, carries an enterprise change’s hard constraints and appetite into the spec, and checks every Mandate’s wording before a spec is shown. The forge gains a second opinion from another model family, audit rounds whose floor rises each round, and a worktree whenever the checkout is busy, and plugin installs now get their runtime dependencies from the host. No Book work ships here beyond Book 114’s Tablets follow-up; everything else was forged by the Avatar from the forge specs under docs/specs/.

Added

Deep research in envision. Frame proposes a research depth with the appetite — quick, or deep, where every research angle gets an independent refuter — and skills/oracle-envision/research-craft.md is the deep method’s one home. Report mode ends in a fact-checked research report under docs/research/, or a directory the user names, instead of a spec. A report opens with a plain-language TL;DR, marks each verdict on its own line and draws diagrams where they help.
The design, drawn. A forge spec’s ## Design carries an architecture diagram or a logic flow as a Mermaid block where one makes the design clearer, drawn only from what the spec settles in words. scripts/verify-diagrams.mjs refuses any block a viewer could see cut off — not a flowchart, SVG-text labels undeclared, padding below 24, a label unquoted or a label line over 28 characters — and fails closed on a block it cannot place; envision runs it over a spec or a report before showing either.
The Mandate wording check. scripts/verify-mandate-wording.mjs refuses a Mandate whose text or Accept: line carries a word that names no checkable outcome (a performance or size word with no number among them), two deliverables joined with “and also”, or a placeholder, and warns, exit code unchanged, about an Accept: line naming nothing observable. It writes nothing. Envision runs it before every showing and weighs each warning.
Specs for enterprise work. Frame settles a fifth thing, the hard constraints, and each reaches the spec through Triage as a user Mandate unless the reply marks it Later or No; the appetite gets its own Appetite: line. The gap sweep walks eleven lenses: security now covers privacy and compliance, operations covers failure signals and ownership, compatibility names what must stay unchanged, and a new lens weighs model behaviour. A spec whose change runs carries a Mandate with a runnable end-to-end check, a consumed interface is a named deliverable, and a user-confirmed probe settles a fact nothing written can, its code never reaching the tree.
The second opinion. avatar-forge’s closing audit runs a second 4eyes after the native one, carried by Hermes to a model from another family than the implementer’s, at that family’s top rung or the implementer’s tier, and never swapped for a native fallback. Both re-audit after each fix, and one record names both verdicts. The model is second_opinion_model, resolved project → global, and endpoint keys can now be set machine-wide too. The new /divineswe:hermes-setup skill, offered at init and re-runnable, says where prompts will go and writes the choice to ~/.divineswe/config.json, keeping every other key. Only claude-code carries the Hermes carrier, so only claude-code runs the second opinion.
A read-only claude/ realm for Hermes. avatar summon --model claude/<model> carries a read-only seat — 4eyes, Loki-Exploit or Loki-Doubt — through claude -p inside a bubblewrap sandbox: the root and the worktree bound read-only, a seccomp filter, and no secret in the child’s environment. The seat’s document comes home validated through the same chokepoint as the other realms, so a session hosted elsewhere can hand an audit to Claude Code. A config pin never resolves to the claude/ channel.

Changed

Audit rounds. Every 4eyes loop in avatar-forge fixes only core findings — a Mandate’s Accept: line unmet, or a regression, on an input the system can meet — and records extension findings as vows or declines them. The floor rises each round: round one fixes every core finding, round two MEDIUM and above, and from round three only HIGH and CRITICAL, with no cap. A re-audit reads the fix and the code that calls it, a reachable CRITICAL or HIGH no Mandate covers becomes a reviewer Mandate, and a HIGH still coming from round three on goes to the user. 4eyes types each finding; the Avatar may override a type or a severity, and every override is written into the Fulfilment line and shown at the user’s check. What blocks a commit is unchanged.
Envision’s dialogue. Frame asks as many questions as it needs, at most 20, where it used to stop at four, each worded so a yes accepts the recommendation. Facts are looked up and decisions are the user’s; the words the work turns on live in the spec’s ## Terms; and the draft spec is written the moment Frame settles, each answer recorded as it settles, never over a spec that already stands.
Three plausible concepts. Diverge aims for three concepts that each reach done within the appetite and break no Mandate, never padded with one that fails; a shape weighed and set aside is named apart and never offered.
Triage, grouped and defaulted. The candidates appear in three groups by the Oracle’s recommended ruling — Now, then Later, then No — numbered once across them, an empty group reading (none). The user marks only the rows they want ruled differently; every unmarked row takes the recommendation.
A worktree when the checkout is busy. On master or main, on a detached HEAD, or with uncommitted work in the checkout, avatar-forge works in a worktree on a new avatar/<slug> branch under .claude/worktrees/ and tells the user its path and branch. On claude-code it makes the worktree with git worktree add and cd, never EnterWorktree, whose worktree guard refuses compound git commands, git -C and computed arguments.

Fixed

Plugin installs get their runtime dependencies. @clack/prompts moves to 0.8.2, dropping the bundled-copy lockfile entry that made Claude Code refuse the plugin’s automatic npm install and left ajv missing, so the schema-backed seats could not persist their output. scripts/shared/lockfile-guard.mjs holds package-lock.json to the host’s install conditions, both in the suite and in scripts/bump-version.mjs, which now refuses a release whose lock the host would not install. Session start says once, with each host’s own remedy, when ajv cannot resolve.
A missing ajv is refused by name. audit reconcile reports validator_unavailable instead of the false audit_stream_missing, and the Occam loader refuses a document it cannot schema-check instead of skipping the check.
Book 114 follow-up. The Tablets-reading tests and archive sweeps read docs/, and the tests that pinned where the archive lives are gone.

[0.69.0] — The Second Bump (Books 114)

This release uses scripts/bump-version.mjs with the committed tests/release-target.json declaration to synchronize the package, plugin manifests, lockfile and generated platform packages.

Added

Design before building: oracle-envision designs involved work and hands a forge spec to avatar-forge, with shared guidance in spec-craft.md.
Scope audits: avatar summon --scope <pathspec> supports audits of tracked code across a whole repository, directory or glob. prophet-full-audit uses the summoning verb and writes an audit report with a Forge Prompt.

Changed

Occam after Loki: envision’s Loki-Doubt findings and avatar-forge’s Loki-Exploit findings are weighed before presentation or fixes.
The Avatar inherits the house: Book doors, Scry, Decrees and Canon are deprecated; Vows stay. Decrees default off, and the Avatar gains a closing whole-range audit and foreign-model summons through Hermes.
Reviewer strength: 4eyes uses a reviewer floor relative to the implementer instead of a carrier-based guard.
The Tablets moved into docs/: the completed-work archives now live at docs/TABLETS.md and docs/TABLETSv1.md instead of the repository root.

[0.68.0] — The Forge Is Lit (Books 113)

The Avatar is the default build path. The temple is unsealed for one more working: a bare /divineswe:oracle-consult now writes a forge spec — the Goal and its Mandates, each with the Accept: line that proves it, and no task breakdown — and /divineswe:avatar-forge builds it in the live session, tests first, with 4eyes auditing every major unit before it is committed. The Book cycle stays whole for large or risky work, one word away: oracle-consult book, then prophet-fulfill. Book 113’s sandbox work, which never shipped under its own number, ships here too.

Added

The forge spec. <specs_dir>/forge-<slug>.md — mode: forge, a slug, a draft → finalized → fulfilled status, and the sections Goal, ## Agreed (the Mandates), ## Open, ## Denied, ## Vows and ## Fulfilment. verify-consultation-complete.mjs --spec gates it: an open item, a missing ## Open, a duplicate Mandate id, or a symlinked or hard-linked spec is refused, each with its own wording.
Forge mode, the Oracle’s default. skills/oracle-consult/SKILL.md now carries only the lean forge protocol; the full Book protocol moved to skills/oracle-consult/book-mode.md, read only when book mode is asked for. prophet-revelation and the root-cause-analysis chain pass book explicitly.
Skill reference files reach every platform. The generator ships a skill’s sibling *.md files to copilot-cli, codex-cli and opencode and rewrites each read path to where that platform installs it, so book-mode.md loads everywhere; a file headed # claude-code-only stays home.
Occam as an Avatar seat. avatar summon --seat occam --loki <doc> (or --foureyes <doc>) narrows a review’s remedies; the document paths are confined, unaliased and neutralised before they reach the brief. Every Loki run in an Avatar cycle is followed by an Occam pass, so the adversary’s findings do not become the work’s scope.
avatar summon --base <rev> lets 4eyes and Loki-Exploit audit a new commit unit against an explicit base.
The Avatar speaks its own Mandates. An ad-hoc ask no longer runs without a spec: the Avatar grounds itself in the code and writes the ask as Mandates with Accept: lines into a committed forge spec (gated with --spec). From either door it shows the Mandates with the commit-unit breakdown — stop me now if you want to change any of these — and proceeds without waiting; every test traces to a Mandate, and 4eyes, Loki-Exploit and Occam measure the work against them.
A reviewer is never weaker than the work it reviews. avatar summon --seat 4eyes requires --implementer <model> and holds the reviewer above the implementer on the model ladder the downgrade sensor reads — level with it at the project’s high tier or on a family the ladder will not order — raising a short reviewer and printing reviewer_raised.
The test craft has one home. Thoth’s test-type ladder, The Weighing of the Heart and the test quality standards live in skills/avatar-forge/test-craft.md, read on demand by Thoth, Loki-Break and the Avatar; seam tests are named as the integration rung where a change joins two units. Generated agent files now resolve skill read paths on every platform.

Changed

avatar-forge, rewritten as the default path. Two entries — a forge spec, or a plain ad-hoc ask that arrives with no spec, Book or other skill’s output and that the Avatar specs itself. It stops at the start only when the requirements are unclear. Each commit unit runs tests first → implement → green by name → 4eyes until APPROVE → Loki-Exploit at its discretion → Occam → a fresh 4eyes when their fixes change the tree → commit, under its own slug <slug>-u<N>. From either door, every commit is recorded as a Fulfilment line (the resume point), and the work ends with a whole-suite failing-set comparison, an evidence table and the user’s check before status: fulfilled.
Avatar seats run native and say so. Each seat has a fixed built-in tier; a foreign route the seat guard refuses is replaced by the native backup and reported as replaced_route, never swapped silently. Summons work inside a linked worktree with no .divineswe/ of their own.
Under an AV- id every test traces to a Mandate: Thoth and Loki-Break trace only to the spec’s M<N>, and a summons id or a Book id is refused at the output write chokepoint.
The Canon sleeps unless a project wakes it. canon_enabled now defaults to false.
Every session starts on the default path. The session-start context, the compaction fallback, CLAUDE.md and the user docs lead with forge mode and avatar-forge; “Prophet is the sole orchestrator” is scoped to the Book cycle.
The freeze notice is lifted from the README.
4eyes rides Hermes without a guarded-seat acknowledgment when the seat guard admits its model (a codex/ terra or sol model); luna and openai/ 4eyes still ask.

Fixed (Book 113)

bubblewrap is probed for usability, not presence. On a host whose kernel refuses unprivileged user namespaces, bwrap --version succeeds while every real confinement fails; the Hermes runtime, the dispatch risk gate and the sandbox suites now run one trivial confined command and agree on the answer.
The codex binary is required only by the realm that spawns it; the openai/ realm no longer exits 10 on a machine without the codex CLI.
The shell-policy note survives JSON serialisation in the capture document.
Host-honest suites. The carrier fixtures carry their own bwrap shim, the install-interrupt fixture waits on a signal instead of a stopwatch, gated skips name the probe they read, and fixture roots are bounded so a stray .git above the temp directory cannot answer for them.
The site refresh: the ten living registers join the landing page, and the canonical repository moves to gitlab.com/aidragonhq/divineswe.

[0.67.0] — Chapter and Verse (Books 112)

A Mandate is now a first-class object, and every test names the requirement it guards. Book 112 closes the gap between what a consultation agreed and what the pipeline enforces: the Mandate register makes every ## Agreed spec item a machine-readable claim with provenance and an Accept line, the traces_to field gives each written test a named Mandate, and a test that traces to nothing is not written. This release is filed through scripts/bump-version.mjs, the pin-driven bump Book 111 shipped — its first working under the ceremony it replaced.

Added

The Mandate register. Every ## Agreed item of a consultation spec is now a Mandate: an id, a provenance (user, derived, or reviewer) and an Accept: line, extracted at consultation close. The verifier enforces the register at plan time — a task line citing no Mandate, or citing one that does not exist, is refused — and both the INIT pass and a session resume may demote enforcement to WARN via --mandates-advisory, reporting register misses without halting the cycle on them.
The prior question. A reviewer Mandate enters Agreed only after Oracle asks aloud whether the Architect asked for it, and the answer is recorded before the CORE/EXTENSION triage runs — so derived scope is confessed at birth instead of discovered at audit.
The fifth rubric probe. Every Mandate must trace to the Architect, or to a Mandate that does; provenance is not self-certifying, it is a chain back to a human request.
Test traces. test_files and adversarial_tests items are {path, traces_to} pairs. A test tracing to nothing is not written; an invariant that should have a test but has none is filed as a deferral, so the gap is a record rather than a silence.

[0.66.0] — Exceeds Its Mandate (Books 111)

An audit finding is now a typed claim, and Occam gets a third pass to weigh it. Book 111 gives every 4eyes and Loki-Exploit finding a traces_to, a disposition and a remedy, replaces severity-only gating with a reconciler that weighs them, seats Occam at AUDIT to propose narrowing without ever cutting anything itself, and retires the hand-edited release ceremony this entry was written by.

Added

Every audit finding is typed. traces_to, disposition (remediate|remove|amend-scope) and remedy (core|extension) are now required on every 4eyes finding and every Loki-Exploit form: exploit finding; doubt and break forms are unchanged, and traces_to also accepts the literal unmandated.
A weighing reconciler. scripts/reconcile-audit.mjs, reached through audit reconcile, computes the AUDIT verdict from remedy rather than raw severity — an extension finding no longer blocks on severity alone, and an absent remedy reads as core. The arithmetic stays fail-closed and arithmetic-only; a new --occam <path> --round <N> flag narrows the findings through Occam’s own occam_applied/occam_surfaced/ refused_downgrade record, and nothing narrows a CRITICAL finding below CRITICAL.
Occam is seated at AUDIT as a third pass. After both auditor paths are consumed and before audit reconcile runs, Occam reads the 4eyes and Loki-Exploit output documents and proposes cut, resurrects, merge or unjustified against their findings — it never originates a deletion and never sets a disposition itself.
Three disposition routes replace one blanket halt. remediate dispatches Monkey to build the fix; remove dispatches Monkey with an order to delete the offending code, not flag it; amend-scope dispatches no one — Prophet checkpoints and halts the cycle for the operator.
The 4eyes simplify rubric is requirement-preserving. Step 2b’s invariant now protects the Mandate’s Accept line surviving the change, not the mechanism that satisfies it — a sixth lever, “mechanics and patterns,” is explicitly in bounds for a simplify finding.
scripts/bump-version.mjs replaces the hand-edited release ceremony. It reads — and never writes — the single release pin, tests/release-target.json, writes package.json, the plugin manifest and the lock, composes the CHANGELOG and README heads from the pin, runs generate:all once, and refuses before writing anything on a dirty tree, a non-increasing version, a malformed descriptor, or a version disagreeing with the pin. It is registered in Daedalus, the tool catalog.
The release guard reads the pin instead of a hand-edited literal. tests/release-target.json is now the one place a release version, its Books and its subject tokens are spelled; eleven legacy version-sync tests derive from the pin rather than package.json, and a sweep confirms no live test constant spells the canonical release by hand.

[0.65.0] — What a Seat May Claim When It Fails (Books 108, 109)

A dispatch that failed may no longer look like one that succeeded. Book 109 makes the OpenAI realm’s per-turn output ceiling configurable and bounded, and stamps a failed dispatch on both surfaces an operator actually reads — the captured report and the ad-hoc prose relay. Book 108 precedes it with the Prophet’s own context diet.

Added

The per-turn output cap is operator-supplied. The carrier’s --max-output-tokens flag now reaches the wire as max_tokens on every turn, defaulting to 32768 (previously a hardcoded 2048 that no flag could move). The runtime’s prompt tokenBudget default rises to 96000.
The cap and the budget are bounded together. They share one hearth context slot, so the ceiling is DERIVED — slot minus budget — and both the carrier’s argv parsing and the runtime refuse a pair that cannot fit, naming both numbers. A value in that gap is now refused at exit 2 before a capture directory exists, rather than after.
A failed dispatch’s report carries hermes_failure. A non-COMPLETED outcome whose report survives the forced harvest is stamped {outcome, reason} at settle(), the runtime’s single report-carrying return point, with the outcome drawn from the frozen runtime vocabulary. The stamp is written if and only if the outcome is not COMPLETED and the report is not null; the runtime’s verdict overwrites a model-forged stamp, and a COMPLETED run’s is stripped before the capture is written.
The ad-hoc relay carries two independent marks — one keyed on the runtime outcome, saying the model failed, and one on a non-zero carrier exit, saying the carrier refused. They are emitted independently, so a run that both failed and was refused is told both.
A live end-to-end proof against a real hearth, covering the cap on the wire, a reproduction completing at the new default, the same task truncating at the old 2048 with a stamped capture and no promoted document, and the relay banners on a failed summons.

Fixed

Ten of eleven post-spawn ad-hoc exit doors relayed prose byte-identical to a clean run — including the whole codex/ realm — so a refused dispatch read as a successful one. All are now marked.
Nothing a model controls can emit an unprefixed line inside the relay fences. Carrier reasons are flattened at the print site, the single chokepoint every reason crosses, so a model-chosen tool name can no longer forge a close fence or a verdict object inside the relay. The same class was closed on stderr.
The relay’s opening fence now describes what is actually emitted, and the ad-hoc skill names both marks and what each claims.
Documentation truth. openai_max_output_tokens remains a project key that no runtime reads — hand-walked onto the flag exactly as openai_base_url is — and the shipped docs, schema descriptions and JSDoc now say so in both directions rather than implying the key is live.

[0.64.0] — Hermes at the Hearth (Book 107)

The foreign carrier gets a native runtime, a failure contract, and a name that says what it does. Book 107 renames the carrier script, gives the OpenAI-compatible realm its own Chat Completions agent loop instead of routing through codex exec, and closes a turn-one failure mode that used to pass silently as success.

Changed

The carrier is renamed to scripts/hermes-dispatch.mjs (with its companion .d.ts), replacing the retired codex-only carrier script under its former name across scripts/, hooks/, skills/, agents/, tests/, platforms/, and the shipped documentation. Every reference — imports, stderr/verdict prefixes, test names, platform manifest excludes — moved with it; the mirrored copilot/ and codex/ packages were regenerated.
A native Chat Completions runtime, scripts/hermes-runtime.mjs, now drives the openai/ realm directly — request building, history hygiene, turn budgets, the five tool contracts (read_file, write_file, edit_file, bash, submit_report) with path confinement and output caps, an optional bwrap sandbox, and telemetry — rather than shelling out to codex exec. The codex/ realm is untouched and still spawns codex exec.
Canon MODIFIED/REMOVED deltas now accept an indented from: line naming the prior declaration they supersede, so a reworded requirement retires the section it replaces instead of leaving both standing; a from: that resolves to nothing at its position in the log is a refusal reported by the plan-time verifier rather than a silent no-op.

Fixed

A turn-one reply with no tool call is now exit 19 ENDPOINT_NONCONFORMING, not a silent success or a retried transport failure — the verdict names the offending endpoint, and 19 is excluded from both the retryable-exit set and backup failover.
Failed dispatch attempts keep their evidence. A non-zero exit retains the attempt directory instead of sweeping it, and the verdict line now names the retained attempt_path alongside the files_touched list read from the attempt’s own event log.
The plan-time launcher-sham regex in scripts/verify-consultation-complete.mjs no longer misfires on a real script invocation whose filename happens to end in a TypeScript-JSX extension.

[0.63.0] — Occam Takes a Seat (Book 105)

A subtractive advocate joins the plan-time council. Book 105 adds Occam, a plan-time seat that proposes cuts, merges and unjustified-scope calls against the draft spec and Section 3 breakdown, and reconciles a long-standing Decree back-link normalization gap.

Added

Occam, the subtractive advocate. A new plan-time agent seat runs two passes — a breakdown pass over the draft Section 3 and a findings pass over Loki-Doubt’s returned findings — proposing dispositions the user alone accepts or denies; Occam never writes ## Denied itself.
### Step 4.3 and the Step 4.7 extension in oracle-consult wire Occam’s two passes into the existing consultation flow, each behind the established one-pass-per-position and no-auto-deny rules.

Changed

Atlas scouts run at a medium tier. The four atlas-explore scouts (gaia, lexis, arachne, echo) only interpret already-gathered JSON envelopes, so the Atlas agent’s declared tier drops from high to medium and every call site passes model/effort explicitly. The documented model tiers in docs/agents.md now match the shipped agent configs.

Fixed

Decree back-link normalization. scripts/shared/decree-store.mjs now strips a leading docs/decrees/ and trailing .md before comparing an observed Decree claim to the brief slug, so the bare-slug form no longer warns as a mismatch.

[0.62.0] — Hermes at the Hearth (Book 104)

Hermes carries the summons to the hearth. Book 104 adds the OpenAI-compatible foreign channel, honest local-versus-remote cost accounting, and a guarded ad-hoc dispatch path alongside the cycle’s existing carrier.

Added

The hearth channel. OpenAI-compatible models can be addressed explicitly through openai/<model> with a required, validated base URL and provider settings that cannot silently fall back to an unnamed endpoint.
Hermes, the foreign carrier. Ad-hoc summonses are available through the documented hermes-dispatch skill with explicit containment and risk gates; the carrier promotes nothing into DivineSWE state.

Changed

Costs tell the truth. Local OpenAI-compatible dispatches are priced as local work rather than reported as an unpriced foreign vendor call.
The skill reference is complete. The documentation now covers every shipped skill, including $canon-drift, $hermes-dispatch, $offering, and $orpheus-sing.

[0.61.0] — The Mended Messenger (Book 103)

The messenger returns with its seal intact. Book 103 repairs the Codex carrier’s trust boundary, so a dispatch can carry only the task it was meant to carry and the scroll it was meant to read. The carrier now compares the same normalized scroll on both sides of the handoff, refuses smuggled multi-task implementer briefs, and keeps auditor scope as an explicit, seat-bound exception.

Added

The Mended Messenger. Codex dispatches now enforce one task line for implementer seats while preserving the sanctioned batch shape for auditors.
Symmetric scroll trust. The carrier and prompt assembler share the same delimiter normalization before hashing, closing a false-staleness refusal without weakening status-only updates.

Changed

Drift guards are deterministic. Generated platform configuration is recognized precisely, while unrelated committed-tree drift remains visible.
The carrier’s instruments are tidier. A tautological ownership branch is simplified, and the temporary d.ts drift fixture is isolated from the live scripts tree so concurrent guards cannot race over it.

[0.60.0] — The Weighing of the Heart (Book 101)

Thoth, scribe of Ma’at, records the weighing of every heart — and a pin unweighed against the feather is a claim, not evidence. Book 101 turns the project’s hardest-won verification lessons into binding doctrine, single-sources the test canon shared by two seats, gives design-time simplicity one home, and retires a gate whose sensor had been lying since June.

Added

The Weighing of the Heart. A binding division in agents/thoth/AGENT.md carrying nine duties — the Weighing, the Census, the Probe, the Scales, the False Scale, the Adversary, the Song of Properties, the Steady Hand, and the Scribe’s Floor — each with its lore and one plain-language operational anchor. Weasel wording does not apply.
The Exploit-Signature Check in agents/4eyes/AGENT.md: five signatures of a test bent to fit an implementation, with an automatic blocking finding scoped to tests/** hunks no task line commissions, and five false-positive carve-outs pinned as a closed set so none can be deleted silently.
Property-Validity Review. 4eyes gains the competence the Song of Properties assigns it — judging whether a property restates the SPEC or merely mirrors the implementation, which proves only that the code equals itself.
The Design-Simplify Rubric, defined once inside oracle-consult’s Simplicity clause and walked by name from Loki-Doubt and Preacher, its findings capped advisory at the design level while 4eyes’ code-level authority stands.
The repository’s first property/metamorphic suite over the cataloged scrubber, seed-pinned, with fast-check and @fast-check/vitest added as devDependencies.
A tests/** control-byte guard reading file bytes via Node — grep provably misses binary-classified files here — with 49 raw control bytes across 20 files migrated to escape spellings.

Changed

The test doctrine is single-sourced. The forbidden bare-mock enumeration lives once, in 4eyes Rule A; Thoth points at it by name. A cross-file guard derives its probe set from the canonical home rather than sampling it.

Removed

The Stop verify-gate is retired. hooks/stop-verify-gate.mjs is deleted and its registration gone from every platform manifest. Its sensor had been reading a status.json stuck at running since June; the hollow-evidence backstop transfers to the 4eyes Book-Level AUDIT evidence stream. The shared verify-gate-logic.mjs survives — subagent-start-brief.mjs still depends on it — pruned only of exports with zero remaining references.

[0.59.0] — Orpheus, the Prompt-Writer (Book 100)

The song before the summons. Book 100 gives plan-time consultation authoring its own instrument: Orpheus, who sings a raw idea into a finished consult prompt so the Oracle inherits evidence instead of a shrug.

Added

scripts/orpheus.mjs. A deterministic four-verb CLI — gather, scaffold, validate, staleness — that reuses atlas-gather.mjs as a module (never a subprocess) to assemble an evidence bundle, raise a consult-prompt skeleton, and check a seed’s structure and freshness against the corpus’s own conventions.
The orpheus-sing skill. Orpheus’s judgment layer, sung in eight verses (interview → framings → gather → scaffold → judgment fill → validate → repair → done), kept strictly distinct from compile-prompt.mjs’s run-time dispatch-brief layer — Orpheus writes to the resolved consults_dir, never to .divineswe/prompts/.
The oracle-consult A16 amendment and the consumed-by backfill, so a seed Orpheus sang can be traced to the consultation it fed and retired cleanly once consumed.

[0.58.0] — The Vow’s Dwelling (Book 96)

The Vows can live where a project says. Book 96 makes the dwelling of the append-only vow register configurable while keeping the default familiar, and teaches every reader, writer and setup recipe to follow that one resolved path.

Added

A configurable vow dwelling. The project-only vows_dir key defaults to .divineswe, keeps vows.jsonl as the fixed filename, and is resolved through resolveVowsDir and the root-aware resolveVowRegisterPath composer.
One path across every surface. The state facade, Scry, Canon, Canon Drift, SessionStart and the Codex carrier now resolve the register instead of rebuilding a literal .divineswe/vows.jsonl path. A custom dwelling that leaves a residue at the default path is announced rather than silently ignored, and unreadable sources remain visibly unknown.

Changed

Setup and migration follow the dwelling. divineswe-init resolves the directory before creating the register, re-including it, moving its merge=union .gitattributes line and verifying ignore rules. There is no automatic migration: the consumer contract documents the one-time git mv recipe. An absolute out-of-tree dwelling remains a deliberate local-only, uncommittable escape hatch, and the resolver now guards the default path’s symlink boundary too.

[0.57.0] — Script-First Exploration: The Gather Pre-Pass (Book 99)

Every angle now admits what it could not see. Book 99 front-ends the Atlas explore flow with a deterministic gather pre-pass, scripts/atlas-gather.mjs, so the four scouts interpret one shared, versioned envelope instead of each re-deriving the codebase from scratch — and the envelope itself is built to refuse false confidence: churn is null and never 0 when the history pass couldn’t see it, query_hits is null for a file the index skipped, an empty scope can never certify fresh, and a merged document may never claim completeness over an angle that declared itself partial.

Added

The gather pre-pass, four angles behind one envelope. gaia walks the tree census; lexis builds the query-scoped identifier index and the prose-pin reverse index; arachne builds the static ESM import graph with a cycle-guarded reverse closure, fan-in ranking, subprocess weak edges, a test-gap projection and an impacted-test selector; echo derives naming statistics, a test-topology probe and thin history columns from one bounded git log pass.
mergeGathers and its budget-ranking formula. A single documented ranking formula folds the four angles into one prioritized gather, its leading term the strength of lexis query hits, so the pre-pass surfaces what the query actually touches first.
The atlas-map sidecar. Every map is paired with the gather document that justified it, and the sidecar refuses to certify a pairing it never actually read. Every staleness verdict now carries stale_paths, with sidecar-missing and sidecar-divergent among its reasons.
A bounded compile-prompt caveat. The compile-prompt stale-path caveat is capped at five neutralized stale-path tokens with an arithmetic remainder, so a large staleness set degrades to an honest count rather than an unbounded prose dump.

[0.56.0] — The Honest Instruments (Book 98)

The sensors stop lying about their own scope. Book 98 closes six related scope-honesty defects across the reporting and reconciliation layer — the temple’s spend, exceptions and audit-dispatch sensors — surfaced by a cross-repo handoff from qmtrader Book 241, and gives spec-sync a fail-closed read of its own diff basis so it can never sign a section over evidence it did not actually verify.

Added

Fail-closed reads in spec-sync. gitDiff refuses to proceed on an unverified diff basis instead of silently swallowing the git error, and a name-set completeness witness confirms every file the diff claims to touch was actually read before a section is signed. Numbered and continuation Agreed-item list forms now parse correctly alongside the existing - bullet form, and section append is atomic and symlink-preserving.
The cycle boundary. cycle_open and cycle_close ledger events now bound a Book cycle explicitly, with per-event attribution via scopeToCycle. The exceptions digest scopes its output to the current cycle’s window with an explicit two-way residue instead of leaking exceptions that belong to other Books.
Guard precision in compile-prompt and the seal’s deferral sweep. Scope verdicts now key on canonical DECLARATION lines derived from the one shared Book grammar — a bare task id mentioned in prose is recognised as a mention, not a declaration — and the seal’s deferral sweep scans a task line only in its annotation suffix rather than the whole line.
Additive sensor vocabulary in audit-dispatch. A new bucket taxonomy sits alongside the existing downgrades union field, with an unrankable-plus-reason case, a time-ordered plan-binding pass, and a --book replay filter. SEAL becomes a recorded phase across the phase enum, the schemas and the doctrine — no longer an unrecorded final step.

Fixed

spend-digest, exceptions-digest and audit-dispatch no longer overstate their own scope. All three sensors in the coupled reporting cluster now report honestly bounded results — a partitioned total with a reason-split residue, a cycle-scoped exceptions window, and a taxonomy that can name “unrankable” instead of silently mis-bucketing — closing the T1–T6 defect family identified against live HEAD.

[0.55.0] — Findings Scope Triage & Minimal Composition (Book 97)

The temple learns to keep a finding in its proper seat. Book 97 makes review findings useful without letting them inflate every Book: accepted findings are triaged into core work or optional extensions, and declined remedies remain visible as explicit deferrals rather than silently becoming tasks.

Added

Findings scope triage. Loki-Doubt and Preacher findings are reviewed as one presented set, with each item receiving its own disposition. Only the findings that belong in the current Book become mandatory work; extensions are offered without being presumed.
Minimal-composition doctrine. Oracle now carries the Concision Law for consultation dialogue and specification prose, keeps decree recommendations distinct from implementation obligations, and sizes every seat’s task at the smallest independently implementable-and-testable unit.

Changed

A smaller Book is the default. Findings integration preserves reviewer candor while separating core scope from optional extensions, recording an explicit operator deferral when a proposed remedy is declined.
Task sizing applies across the composition. Thoth and other seats use atomic task decomposition as well as Monkey, while the existing model-marker grammar remains unchanged.

Fixed

Accepted findings no longer automatically become mandatory tasks. The composition step now makes the scope decision explicit, preventing post-review over-engineering while retaining the review record.

[0.54.0] — Flash & Composition Doctrine (Book 95)

The temple stops forbidding seats and starts sizing stones. Flash was written as a prohibition — a shorter rite that banned the seats it left out — and the shipped verifier had already stopped believing it. This release replaces the prohibition with ONE uniform principle, flash defaults omit; discretion may include, teaches consultation silence to compose flash where a project has opted in, and gives Oracle two composition laws it never carried: size every task at the atom, and build no knob nobody turns.

Added

flash_default_enabled — a composition flag of the simplify_pass_enabled class, not a rite gate (deliberately absent from scripts/shared/rite-gates.mjs’s GATE_KEYS, and therefore carrying no layering, no resolver and no suppression semantics). Default false — the conservative direction, because silence must not compose flash Books on a repository that never opted in — PROJECT-ONLY and unseeded, so an absent key stays absent and the documented default governs. When it is true, a consultation in which the user expressed no preference about rite depth or review thoroughness composes flash: true at Step 5a, and Oracle states aloud BOTH the cause and the consequences: that the config default drove the composition (a silent default is indistinguishable from Oracle’s own judgment) and precisely what that composition omits. A disclosure that names why but not what is a disclosure the listener cannot act on. The provenance is additionally recorded durably in the consultation’s spec decision record — one Agreed line — because a duty whose only witness is the transcript is a duty no downstream reader can ever check.
Atomic task sizing (Step 5a, and Oracle’s Step 4 / Rules 6–7). Oracle MUST size every task at the atomic unit: the smallest independently implementable-and-testable unit of work. Both conjuncts bind — a unit that can be implemented but not proven by its own test is not atomic under this project’s TDD law, it is merely small. A task line naming two independent deliverables is two tasks. Sizing feeds the (model: …) marker rather than sitting beside it: the tier is read off the sized task and never picked in isolation, so honest atomization routes mechanical work to (model: medium) — the Book 94 economy — and leaves (model: high) to work that stays heavy after the split.
The simplicity clause. The operative test is verbatim: no configurability without a named consumer. A config key, a flag, an extension seam or an abstraction earns its place in a Book ONLY when the consultation can NAME the consumer that reads it today; “someone might want it” names no one. Bounded, not lazy: the stated requirement is the floor the ceiling rests on — compose everything the requirement demands and nothing it never asked for. YAGNI (Oracle’s Rule 6) now names the test, so the principle can be applied rather than merely admired.

Changed

Flash is a seat-DISCRETION contract, not a seat prohibition. Under flash: true no agent seat is forbidden. The DEFAULT composition omits Loki-Break, Loki-Exploit, 4eyes and Mason; Thoth is included at Oracle’s judgment when the work warrants tests; Monkey and Styx are the constant core. Every omission — the WU task and the Book-Level AUDIT included, uniformly — is restorable by discretion or by explicit user request, and a flash Book carrying a discretionary seat is legitimate, never a Book Prophet rejects. A default flash Book leaves commits operator-side; a discretionary Mason task restores per-prophecy commits verbatim.
The dispatch inversion — absence is the only signal. Prophet’s flash handling was skip-language: prose that told the orchestrator to withhold seats a flash Book named. Frontmatter is now a COMPOSITION signal only. Prophet stays task-driven — the Book’s task list is authoritative, every task present is dispatched, and there is no runtime branch on the flag. A flash Book that carries a 4eyes or WU task has that task dispatched, not skipped. The Global VERIFY evidence obligation survives verbatim and is never waived by depth.
An explicit request in either direction always wins, and the trigger is INTENT, never a literal phrase. Any expressed preference about rite depth or review thoroughness — “review this carefully”, “run the audit pair on this one”, “this is security-sensitive” — counts as an explicit request for the omitted seats or the full rite, though the words “full-rite Book” never appear. The flag is a default, never an override of stated intent, and silence means actual silence.
default_mode retired. The key was already removed from the live config and left in the schema as a documented-dead artifact; the property is now deleted from schemas/config.schema.json outright, and flash_default_enabled replaces it.

Fixed

Two flash rules the shipped verifier had already retired, still asserted in prose. skills/oracle-consult/SKILL.md claimed Rule B was WAIVED under flash and that multi-prophecy flash Books were FORBIDDEN. Neither was true of the code: Rule B applies through the Book 83 flash floor — a flash Book whose tasks hit a boundary trigger MUST still carry a wiring-test task, exactly like a standard Book, with pure-internal flash work staying permissive because the floor is boundary-TRIGGERED — and the multi-prophecy ban was removed in Book 73 P4 (§5c). The prose now follows the shipped verifier across all three surfaces (oracle-consult, prophet-fulfill, agents/prophet/AGENT.md), and adversarial resurrection guards stand over both retired phrases so neither can be reinstated by a well-meaning future edit.
The flash live-file scan was in the known-failing baseline, and therefore blocked nothing. The prophet-flash-frontmatter-adversarial scan had been failing long enough to be parked in tests/test-baseline.json, where SET-diff verification can never notice it — while this very Book added new “flash mode”-bearing files it would have silently missed. EXCLUDED_FILE_RELS was reconciled against the live tree, the nine standing hits were adjudicated one at a time, the scan was paid down to GREEN, and its two test ids were removed from the baseline so the guard blocks again. A guard in the baseline is a guard that has been switched off without anyone saying so.

Honesty invariants

A default that changes what silence MEANS must never change what a flash Book may CARRY. flash_default_enabled never launders past the Book 83 flash floor: a defaulted-flash Book whose tasks hit a boundary trigger still composes the Rule B wiring task, or falls back to the full rite.
A config default cannot repeal a stated law. A Book born from a defect report carries Thoth’s failing-test reproduction as MANDATORY — every bugfix starts with a failing test that reproduces the bug — however the composition was reached. The audit pair remains guidance for the seat’s discretion; the reproduction is not discretionary.
The typing contract lives at the READER, because no runtime module applies config.schema.json. Only the JSON literal true opens the flag; the string "true", 1, null and every other value read as closed, and the malformed value is surfaced aloud so the operator learns the key did not take. The schema stays strictly Boolean for any harness that does apply it — a loose schema accepting the string "false" would read truthily and silently invert the operator’s disable signal. By the same token, retiring default_mode is a documentation-and-test contract change with no runtime effect: a straggler config carrying the dead key experiences nothing at runtime, and the fix is deleting one dead line.
Doctrine is only doctrine if it can be interrogated. The atomic-sizing and simplicity clauses ship behind paraphrase-deletion guards with positive and negative controls, so neither can be satisfied by a vocabulary-only shell that keeps the words and drops the rule.

[0.53.0] — Daedalus, the tool catalog (Book 93)

The temple opens a workshop. Daedalus built wings so a thing that had always been walked could be flown; Daedalus, the tool catalog is where a chore an agent re-derives from scratch every session becomes a small, tested, discoverable tool. It is the operational arm of the First Axiom — build a script wherever it saves context and LLM work — and it ships with its limits written down beside its guarantees.

Added

The daedalus facade domain — eleven verbs: daedalus scaffold | lint | test | register | describe | list | find | run | ack | retire | promote, kept in lockstep with a per-subcommand CLOSED flag allow-list that rejects an unregistered flag before a byte is read or minted. A tool is a per-tool DIRECTORY at a project or global write tier holding an AJV-validated tool.json, an entry stub and a node --test exhibit; a third provenance, shipped, is reached only through an Offering and is never a write target. The pure value/derivation policy lives in scripts/shared/daedalus-core.mjs, the search policy in scripts/shared/daedalus-find.mjs, the schema shape in schemas/tool-manifest.schema.json.
daedalus find — the three-origin discovery read. Searches name and keywords across project, global and shipped at once, ranks the hits, caps the render at 25 with the cap ANNOUNCED (--limit N to a ceiling of 1000; an out-of-range value is refused, never silently clamped), and reports each origin as one of four distinct words — populated, empty, partial, unknown. Unknown is never rendered as empty: a missing directory, a blank HOME, an unreadable manifest or one skipped entry withdraws the zero-hit “go build it” nudge, because a tool hiding in an origin nobody could read must not be rebuilt into a duplicate. Origin is the tier a manifest was READ from, never the tier it claims.
ONLY test and run execute. scaffold, lint, register, describe, list and find read manifests and stubs statically and never import tool code. daedalus test runs the exhibit in an isolated node --test child and, on a pass that actually executed a test, records a BOUND attestation — an emission marker plus a content digest over the tool’s bytes — which daedalus register re-derives and refuses when it no longer matches. A hand-written {passed:true} is refused; editing the tool after test invalidates the record. Stated ceiling: the marker is a public constant, not a secret, so the binding closes casual hand-forgery and a source-reading forger remains out of scope. A vacuous exhibit still earns a legitimate attestation, and test runs the exhibit unsandboxed with the operator’s privileges.
The counted path — daedalus run, ack, retire, list --stale. run executes a registered tool’s declared entry in an isolated child and, on SUCCESS only, appends one capped O_APPEND row to .divineswe/daedalus/usage.jsonl; list --stale folds that register into a decay report over a 90-day window. daedalus run is counted, not enforced — invoking the entry directly with node reaches the same code and touches neither the acknowledgement nor the counter — so every usage figure is a LOWER BOUND, and the caveat is rendered wherever the number is (counts_are_lower_bounds, usage_is_lower_bound). A torn or malformed row is skipped and COUNTED, never repaired; an unreadable register reports unknown with null figures rather than zero. ack records a per-PROJECT human consent before a global tool’s first use in this repository (never under $HOME) — a human seam, not a sandbox. retire is index-only and reversible by register; the files are never deleted.
The ladder — daedalus promote. Hop one, project → global, is three effects or none — copy, re-register (the copy re-earns its own attestation at the destination), supersede — with an occupancy check that runs FIRST against the shared machine namespace, names the incumbent, compares CONTENT rather than name, and offers no --force. Hop two, --to upstream, hands the tool to the Offering pipeline as the new code type tool and STAGES it screened: false, emitting no filled URL: the human screened: true flip stays the authoritative gate. The identifier screen on that path BLOCKS, and its declared cannot-see classes are documented rather than glossed.
Offering type tool — the strictest type. The code clauses key off what the payload IS (detectCodePayload: a shebang, a tool manifest, package main, or an accumulation of weak grammar signals across shell, awk, perl, Go, C, python and JS) rather than off the self-asserted type label, and a declared-prose-over-detected-code MISMATCH is refused with a diagnostic naming the signals. A code payload rides the paste-file vehicle at ANY size, and an exhibit is required — read grammatically, at code level, in an import position, with at least one test registered.
The Book number lifecycle — book claim-number, book release-number and book publish. book claim-number reserves the next free number under a TTL’d, lock-serialized record that stores a DIGEST of the owner token and never the token, minting and returning one when the caller names none. book release-number is owner-checked in two lanes — presented token, or session anchor — with no fallback between them, so a failed credential is never rescued by ambient authority. book publish is the exclusive draft → public transition, built on linkSync (which fails EEXIST in the kernel) rather than rename (which silently replaces), so the loser of a race keeps its work byte-intact; the Book number is canonicalized at parse, so --book 05 and --book 5 name the same Book.
daedalus_enabled — the tenth rite gate: default true, project-only, with no dependency edge on any other gate. A closed gate skips the verb loudly and exits 0 — fail-OPEN dead-switch polarity, so a mistyped or unreadable config can never silently darken the catalog. A global declaration is inert and reported as such.

Changed

CATALOG.md at each tier is a DERIVED artifact and nothing else — a hand-edit is drift and is overwritten wholesale on the next re-derivation; list reflects the validly-registered manifests, never the file.
The retirement/supersession predicate is shared by find, list, run, the catalog derivation and both promote hops, so no reader can advertise a tool another verb refuses.
README, docs/architecture.md and docs/state-model.md gain the Daedalus reference; the root CLAUDE.md subcommand roster names the new domain and its verbs.
One execution seam. daedalusAssertExecutionPermitted is the single guard both executing verbs pass through — retirement, then containment, then the per-project global acknowledgement. The checks previously lived inline in the run case block, which is why test never honored them.
One plan-time projection. planTimeSurface is the sole projection behind both CATALOG.md and list --json, and the attestation predicate moved to scripts/shared/daedalus-attest.mjs so find consults the same one every sibling does.
One manifest validator. The core’s phantom summary vocabulary is gone; validateManifest speaks purpose, deriveCatalogIndex reads it natively, and the translation bridge is deleted.

Fixed

The mandatory Book-Level audit read the seven prophecies as one artifact and found what no single-prophecy pass could: places where independently-hardened surfaces disagreed with each other. Each fix is anchored at the shared predicate rather than the call site.

daedalus test honored neither gate daedalus run enforced. Because the acknowledgement and retirement checks were written at the run call site instead of the shared execution seam, test would execute arbitrary code out of another repository’s machine-global tool from a project that had never acknowledged it — and print attestation recorded. Worse, that same call silently re-attested tampered global bytes, making the documented invalidate-on-edit property repairable by any project on the machine without consent. readAttestationState now distinguishes absent / invalid / valid, and invalid is an alarm rather than an invitation; --reattest is the recorded consent. Stated ceiling: the no-silent-re-attest refusal is global-tier only — at the project tier an edit-then-retest loop is authorship of your own code, and no mechanism distinguishes it from tampering.
promote --to global silently corrupted non-UTF-8 files. The copy read and wrote 'utf-8', so a binary emerged with different bytes and a different digest — then re-earned a fully valid attestation over the corruption, registered into the shared namespace, and dropped the intact source from its index. atomicWriteBytes now copies bytes as bytes, and the upstream payload renderer round-trip-checks the decode, NAMING a non-text file with its size and sha256 rather than mangling it into the artifact a human is asked to screen.
The PF-11 length-cap and charset policy enforced nothing. The validator was keyed to a summary field no shipped manifest carries, while the live path admitted purpose under minLength: 1 — so a 5,000-character multi-line value passed lint and register and rendered uncapped into every surface. Row injection was already closed; this was a context flood and a broken pledge.
list --json rendered untrusted tool text raw where find suppressed it, CATALOG.md neutralized it and describe quarantined it — ANSI control sequences and a forged provenance marker all rode through the machine-readable surface.
find was the only reader that skipped attestation verification, advertising a hand-planted global tool as a populated, scoring hit while every sibling verb refused it.
The “only test executes” claim was false in four places. Three paths execute tool code — test, run, and the promote --to global staging re-earn — and the operator-facing text that governs auto-approval decisions named one, mislabeled ack (which executes nothing) as an execution verb, and omitted run entirely. The roster is now derived from source, so a fourth executing path cannot be added without the guard going red.
The exclude lever was inoperative for everything under scripts/shared/. The recursive copy added for the Daedalus templates never consulted the exclusion list, so a dev-only file could not be kept out of the committed, git-installed copilot/ and codex/ packages — while CLAUDE.md documented the lever as working. Dotfiles and hidden directories were copied in, and symlinks were dropped in silence; both are now skip-and-counted with a diagnostic.
Guards named for the committed tree read the working tree. They reported green on a release the commit did not carry; they now read git show HEAD:<path>.
An offering could land somewhere nobody named. The staging path read only the discovered root and dropped the redirected / exhausted signals, so an offering could be written into an enclosing project’s directory at exit 0 with nothing on stderr — indistinguishable, from the named base, from having done nothing. A redirect now announces both paths, and an exhausted discovery refuses non-zero: unknown is not empty.
Test fixtures that an unrelated directory could redirect. A repository-like ancestor of the temp directory hijacked repo-root discovery for fixtures that never established a boundary of their own. tests/_fixture-root.ts makes a fixture root answer for itself across 24 suites — recovering 150 failures that had been read as environmental noise, and removing the ambient condition that made them look that way.

[0.52.0] — The Codex Economy Dispatch Channel (Book 94)

The temple opens a second gate. Implementation seats may now resolve to a foreign codex model through the codex/ model-id prefix — codex/gpt-5.6-luna for the cheap tiers, terra and sol above it — with every dispatch carried by a new carrier script that lets nothing foreign touch the sacred state. The full prefixed id is recorded verbatim everywhere it travels; the ONLY strip point is the carrier’s -m flag.

Added

The carrier — scripts/dispatch-codex.mjs (claude-code package only; excluded from the other three platforms). Pre-flight (brief presence, STOP-banner inspection, scroll content-hash staleness, auth/binary probe, persona sidecar), invoke (codex exec sandboxed to the worktree, detached setsid spawn, carrier-owned timeout with process-group kill + quiesce check), post-flight (AJV-validated capture, main-tree containment witnesses, the carrier performs the ONE state write). Typed exits 0–16; one machine-readable verdict line carrying the prefixed id and token usage. Failure is read from the JSONL event stream, never the exit code — codex exits 0 even on turn.failed (probed live, pinned as fixtures).
The routing layer — model_backups (native-only by schema), the global-config routing trio, scripts/shared/model-routing.mjs (layered project → global → built-in read per key; an unreadable layer is ABSENT with fail-safe NATIVE), parseModelChannel() fail-closed prefix parsing, and the CODEX_SEAT_GUARD: Styx never resolves foreign on any authority path; 4eyes holds a terra/sol capability floor with asymmetric strict-allow/loose-deny segment matching; Loki is deliberately unguarded (the D1 seat rides later).
Prophet integration — the single-home “Foreign dispatch channel” subsection inside the claude-code-only fence: INIT layered-routing read + snapshot, one cached auth probe per cycle, backgrounded carrier invocations, fail-over that never fails open (one recompiled codex retry, then the named native backup), per-attempt dispatch_spend with the codex-exec/codex-retry/backup-failover source vocabulary, and the mixed-pair rule: foreign member exact from the carrier verdict, native member approximate.
JSON persona sidecars — codex/codex-agents/<name>.json emitted beside the TOMLs by the generator; the carrier composes personas from them without shipping a TOML parser.
Spend accounting paid in full — spend-digest --book is a real anchored filter with an unattributed-residue line; the sibling exceptions-digest --book defect fixed (closing two standing vows); per-attempt grouping without double-counting; codex pricing rows labelled derived per row (a vendor capture remains a registered vow); both digests hardened against ledger-text injection and prototype-keyed accumulator poisoning.
audit-dispatch learns the channel — rank table luna < sonnet < opus with terra/sol pinned from the installed binary, segment-matched family tokens shared with the seat guard, backup dispatch replayed as an allowed upgrade with every waiver rendered.

Changed

The shipped defaults stay ALL-Claude — schemas/config-defaults.json is byte-untouched. The luna flip is an explicit operator post-seal step, recorded on the vow register, never a pipeline task.
The Book-90 A9/LD-6 global-schema narrowing is superseded for model_preferences/model_backups/agent_models (seven-key pin; authority note in docs/configuration.md).

Hotfix on 0.51.0 — Dispatch by Reference (The Second Axiom)

A summons should name its brief, not recite it. Prophet compiled a per-dispatch brief to disk and then also inlined that brief’s payload into the dispatch prompt string — the same context assembled once and paid for twice. The saving from ending that accrues to Prophet, not to the agent it summons: an ephemeral subagent pays once either way, while the orchestrator carries every dispatch’s full payload in its own window for the length of the cycle. This shipped as a hotfix on top of 0.51.0 with no version bump of its own — which is why it carries no release number here; it first reached a published release as part of 0.52.0. The 0.51.0 release itself is Book 92, recorded below.

Added

The Second Axiom — canonized in skills/prophet-fulfill/SKILL.md, its single canonical home, with the expanded treatment in docs/axioms.md:

Let the brief be written once, the summons carry only its name, and no pointer be sent to a brief unwritten.

Three limbs, and as with the First Axiom the third is load-bearing: context is assembled ONE time into a durable artifact; the dispatch carries a POINTER and never the payload; and no pointer may be sent to a brief that does not exist — an agent dispatched at a missing brief holds its AGENT.md identity and nothing else, believes it has context, and confabulates. A doctrine with only the first two limbs licenses silent context starvation. Every other agent and skill references the Axiom by name; to restate its limbs elsewhere is to fork it.
A scope clause that binds only once a brief exists — the Axiom does NOT mandate that every dispatch write one. Selector-only dispatches stay outside its reach and are named so no future reader “fixes” them: Atlas scouts pass a scalar angle, RCA passes small role/task/hypothesis descriptors, and neither materialises a brief. Bare pointers into the repository — filesystem paths and git refs — already satisfy the Axiom; the test is whether the agent must run a command to turn the token into content.
docs/consults/dispatch-brief-scriptability.md — the analysis pass behind the fix: what of prompt-writing and dispatch is MECHANICAL, the honest limit that no script can verify an agent read its brief, and the open question that gates the remaining work.

Fixed

The assembler reported success for a brief carrying nothing. Every derivation failure inside compilePrompt degraded to '' and the write proceeded at exit 0 — Prophet’s only success signal. While the payload was also inlined this was merely degraded; under pointer-only dispatch it became silent total context loss. The Second Axiom’s own patch had created the condition its third limb exists to forbid.
A batch id derived one task line out of N and exited 0. An id shaped B<NN>-P<N> or B<NN> — the live convention — matched the derivation gate, and matching breaks on the first hit. Plausible, silent, and green, at the cycle’s terminal VERIFY gate, whose conservative fallback is FAIL. deriveDescriptor() now carries every matching task line and every enclosing prophecy scope.
The STOP banner was forgeable. custom_instructions was appended un-neutralized and the marker was matched over the whole document, so a forged line made a fully-populated brief exit 3 with a diagnostic that was flatly false. The verdict is now read only from the document head, and marker-shaped lines arriving through config or descriptor fields are rendered inert. The proven neutralization of scroll, map and lesson bytes is unchanged.
A malformed descriptor was treated worse than an absent one — a parse failure suppressed Book derivation entirely, where an absent descriptor correctly derived. It now falls back, and says so.
Non-string descriptor fields stringified into the trusted band, so {"taskLine":{}} shipped **Task:** [object Object] at exit 0. Such a field is now ABSENT, not content.
Three prompt: compilePrompt(...) call sites passed an un-awaited Promise against the wrong signature — rendering Read your brief at [object Promise], a well-formed sentence pointing at nothing. Reconciled with the Bash pre-computation architecture the sandbox actually permits.

Changed

The assembler is fail-closed, mirroring what output verify already does on the return path. The dispatch path had no equivalent — output write refuses to persist an invalid payload while compile-prompt cheerfully persisted an empty one. Exit codes now carry a verdict: 0 WHOLE (the only green signal) · 3 CONTENTLESS · 4 PARTIAL (the id names a scope, not a task) · 5 DISCARDED (a descriptor was supplied and could not be parsed, so caller intent was overridden). Precedence 3 > 4 > 5. An explicit descriptor bypasses derivation and is how a dispatcher declares scope intent. Auditor seats count diffRange/baselineSha as content; implementer seats do not, because their briefs emit neither.
Every Pass: bullet across the seven dispatch sites now names what the brief carries and states that the summons is the pointer alone — with what the brief genuinely does not hold named by PATH or git range rather than pasted as text.

Honesty invariants

A claim about brief coverage is a claim about composeBrief(), and must be verified against it. The recurring defect this release closes was prose asserting the brief carried payloads the assembler never assembled — the ownership map, test files, implementation summaries, diff text. Sentences that sound true are the root of the whole class.
An emptiness check is not a completeness check. The guard catches a brief with nothing in it; the batch-id defect proved a partially derived brief can still exit 0. Partial derivation is its own verdict precisely so the green light cannot be mistaken for a wholeness it never established.
No script can verify that an agent READ its brief. Pointer-only dispatch is a request, not a guarantee. Delivery rests on the SubagentStart injector — whose payload contract is pinned by no test and supplied by no observed dispatch site. Recorded in the consult as the open question, never as a solved one.

[0.51.0] — Book 92 (The Canon: Declared Truth, Canonization, the Drift Audit, and Genesis)

DivineSWE gains a memory of what it claims about itself. The obligation layer tells you what is still owed; it has never told you what this project currently declares to be true. This release adds that third pole — the Canon — plus the mechanism that writes to it at the Seal, the sensor that asks whether a declaration still agrees with the code, and the one bootstrap that lets an existing codebase adopt the layer without inventing history.

Added

The Canon — a committed, append-only declared-truth layer at docs/canon/: the event store .canon-log.jsonl (merge=union) is the one true store, and one <capability>.md file per capability is a derived artifact and nothing else — hand-editing it is indistinguishable from drift, and git conflicts resolve by re-folding the log, never by hand-merge. Total order is the provenance SEAL TIMESTAMP, never the Book number. Per-section provenance and frontmatter paths: watch globs travel with every section. Four new pure-read verbs: canon show, canon list, canon validate, canon drift.
Canonization at the Seal. book seal-bookkeeping merges a Book’s ## Canon Deltas into the log after the TABLETS archive is durable and before the vow write. Write paths are exclusively the seal merge, the vow judge signature, and a correction flash Book — never in-place regeneration. Every rung obeys the A23 non-blocking covenant: a closed gate, an unwritable store, a missing or unreadable spec, and a malformed delta are all loud notices rather than a halt — a malformed delta skips loudly, marks its declaration Apocrypha-unmerged, and opens a failed-canonization vow. The Seal never halts.
The drift audit — scripts/canon-drift.mjs, fronted by the canon-drift skill: a mechanical gather that joins the paths git says have changed against each capability’s declared watch globs (weighed per SECTION against that section’s own provenance recency), plus a single dispatched agent that reads both the declaration and the code and may emit exactly two codes (canon-agent-contradiction, canon-agent-unverifiable). It is read-only by construction — its import graph reaches no Canon writer at all, and it re-exports none either — so “accuses, never authors” is a property of the code, not a promise about a given run. Every finding crosses one schema gate (schemas/canon-drift-findings.schema.json, refusing the six fields a Canon writer reads by name, and enforcing the agent’s two-code restriction rather than merely instructing it) before it becomes a vow, never a Canon write. The vow is Book-scoped (--book is required: a register row naming no Book is the one citation shape the Canon’s judgment binding cannot weigh), de-duplicated on (code, capability, slug) against what already stands open, and capped — an over-large findings document is refused whole, never truncated. The path reading asks git for a merge’s first-parent diff, through the one shared builder scripts/shared/git-path-log.mjs that the Scry’s canon_paths_moved sensor also uses: git log --name-only prints no path list for a merge commit, so a --no-ff merge of a branch older than the seal would otherwise read settled on both consumers at once.
canon genesis — the one bootstrap, and the Canon’s only writer besides the Seal and the Judgment. Scaffolds a Canon from a survey — an Atlas exploration’s output — wholesale, into the Apocrypha. It cannot mint anything above the Apocrypha however the survey is shaped (a survey entry asserting a tier field is refused wholesale, not quietly downgraded), refuses to clobber a store that already carries an event or a canon directory that already carries capability files while the log records nothing (that is a store whose log is missing or torn, and the files still standing are the only surviving evidence of every signature), refuses any survey field carrying a line break (a newline inside a requirement authors delta-document structure, including a ### capability: heading the name gate never saw), reads --book in plain digits and nothing else, and opens no vows — the obligation cost of a bootstrap does not scale with the size of the codebase.

Configuration

canon_enabled — the ninth gate key. Default true, PROJECT-ONLY, DEPENDENT on vows_enabled exactly as decrees_enabled is. A closed gate SUPPRESSES a read loudly and never yields a clean empty or a clean verdict.

Honesty invariants

The decree gap join is lexical, and it says so. coverage: complete is a statement about files; criteria: unjudged is stated always, because a criterion is judged by an operator against the brief’s acceptance rows and never derived from a capability count. A Canon that flatly contradicts a criterion still yields complete coverage — the ceiling is measured and travels with the report as GAP_MECHANICAL_JOIN_NOTICE.
The drift audit’s recency window is a stated limit, never a claimed enforcement. It is a commit date the COMMITTER supplies — GIT_COMMITTER_DATE/GIT_AUTHOR_DATE are caller-supplied and survive cherry-pick and rebase — so a backdated commit to a watched file reads settled. CANON_DRIFT_BASIS rides on every reading saying so. A control that can be bypassed is documented as advisory, never claimed as enforcement.
An unreadable Canon source reports UNKNOWN, never zero and never clean. A torn log line, an unreadable capability file, a section with no provenance stamp, a tier no judgment signed, and a canon_enabled: false gate all yield unknown or suppressed — never clean, never a coverage claim.

[0.50.0] — Book 91 (The Obligation Register: Vows, Decrees, Judgment and the Scry)

DivineSWE gains a memory of owed work. Until now the pipeline could tell you what it was doing; it could not tell you what it still owed you. This release adds an obligation layer that outlives the cycle that produced it, a committed initiative layer above the Books, an attestation seam that machinery may not cross, and one pure-read report over all of it.

Added

The Vows — an append-only obligation register at .divineswe/vows.jsonl. Unlike the rest of .divineswe/, it is meant to be committed: an obligation that exists only on the machine that recorded it is one the next clone has already forgotten. The file carries merge=union in .gitattributes and what a reader sees is the fold of the events under a pinned total order, so two worktree agents may append concurrently and git may concatenate their lines in any interleaving without a conflict and without a wrong answer. New verbs: vow open, vow update, vow close, vow waive, vow judge, vow snooze, vow list, vow surface, vow reconcile, vow migrate.
The Decrees — the initiative layer above the Books: committed briefs under the new decrees_dir (default docs/decrees/) declaring intent, an ordered Book sequence, the capabilities bought and the acceptance criteria the work will be judged against, with a lifecycle draft → active → delivered → done. New verbs: decree create, decree advance, decree list, decree status. The brief is the single source of truth for its own sequence; a Book file’s back-link is warn-level and may neither add nor subtract a Book from the roll-up.
The Judgment — vow judge records a verdict (validated or rejected) with an evidence pointer and provenance (actor, actor_derived, actor_source, judged_at). A validated verdict is an evidence-backed close; a rejected one leaves the debt owed and records why. Evidence is required in substance — n/a, - and tbd are refused.
The Scry — a pure-read morning report over every source this repository owes something from: divineswe-state.mjs scry, scry --json, scry --full, scry --format html, scry --heal. Shipped alongside the /divineswe:scry-project and /divineswe:vow-capture skills.
vow reconcile — the mutation counterpart to the Scry. One pass stamps the seal commit, closes what a remote can be observed to contain, heals a register lost to a crash from the TABLETS.md archive, and walks the two mechanical Decree rungs. --cheap is the offline always-runs variant; --deep widens the horizon to the full history.
docs/vows-consumer-contract.md — the consumer-facing contract for the whole layer: enabling the gates, the backfill recipe with its provenance fields, the migration invocation and its status-mapping table, the judge workflow, the --json read surface, and the gate-dependency matrix. Every shell recipe in it is executed against the shipped CLI by the test suite, so a documented invocation the binary refuses is a build failure rather than a support ticket.

Changed

The home-scoped follow-up register is retired and superseded. Deferred debts previously lived in ~/.divineswe/follow-ups-<project>.jsonl. vow migrate carries that ledger into this repository’s register and stamps the home file superseded — never deleted. The documented mapping: open stays open; closed with an evidence pointer becomes closed with the pointer carried verbatim; superseded with a pointer becomes waived; and an unbacked closed or superseded becomes open and is named on the report — trusting an unbacked dismissal would launder a hand-written note into a permanently discharged vow. Migrated debts land as kind: deferral from source: backfill, owned by agent unless the row declared otherwise, with item and trigger byte-for-byte.
The superseded file is still watched on every read. Deleting it would turn a lagging plugin’s append into a silently lost obligation, so it is kept, and vow surface names loudly every entry the home file holds that this repository’s register does not. That stale-append window is documented rather than papered over: an older install or a version-skewed agent elsewhere on the machine can still write there, and the consumer is the only party positioned to notice.
vow reconcile’s close predicate has two arms, not three. verified is an ls-remote observation that a remote ref contains the stamped commit, and it is the only strength a discharge may be minted with. unknown is everything else and closes nothing. A third arm that closed on a local remote-tracking ref was removed: a tracking ref is a local file any process can write, so it is never affirmative observation of a remote. The label it minted, approximate, stays readable but unmintable so rows discharged by an earlier release keep their grade on every read.
Book numbering is series-aware. book next-number now computes the next number within the numeric band it is asked about rather than across the whole range, so a parallel numbering series cannot drag an unrelated one forward.

Configuration

vows_enabled — the Vows dead switch. Default true.
decrees_enabled — the Decrees dead switch. Default true.

Both are deliberately opposite in polarity to the three opt-in memory rites of 0.36.0. A register you have to opt into is empty exactly where it matters — on the machine of the operator who never heard of it — so this layer ships live and a project that wants it dark says so, once, in its own .divineswe/config.json.

Both are PROJECT-ONLY. Obligation state and committed intent are per-repository facts, so a declaration in the machine-wide ~/.divineswe/config.json is inert for these two and is reported as global_key_ignored:vows_enabled / global_key_ignored:decrees_enabled. The four globally settable keys are unchanged: offerings_enabled, retrospective_enabled, teachings_enabled, atlas_enabled.

decrees_enabled depends on vows_enabled: a Decree reaches done only through a judgment recorded as a vow, so decrees_enabled: true over vows_enabled: false is an incoherent pair. The resolver reports it as dependent_gate_without_substrate:decrees_enabled and changes neither declaration — silently closing the dependent gate would make your config file and the verdict disagree, and silently opening the substrate would manufacture consent you never gave.

A closed gate on this layer suppresses a read rather than emptying it ({"vows":[],"suppressed":true,...}, and a SUPPRESSED prose line), and no-ops a write loudly, naming the transition it discarded. An argv mistake still exits 1 in both gate states.

Security

The attestation ask-rule. vow judge and decree advance --to done are carved out of DivineSWE’s facade-level auto-approval. They are never granted by any shipped artifact, and divineswe-init now writes an ask permission rule for both so the prompt is mechanically reached. The CLI does not rely on that rule: it refuses both verbs from a detected agent context — the DIVINESWE_AGENT marker carrying any non-blank value, or an --actor that normalizes to a DivineSWE agent name — at the argv seam and again in the store, with no override flag. --force, --as-operator and --allow-agent are all rejected as unregistered, because a documented door through an attestation guard is the guard’s absence with extra steps.
The honest tier is stated at its real size: raised cost plus a reconstructible record, never impossibility. The prompt exists on claude-code and copilot-cli and not on opencode or codex-cli; an operator’s own blanket allow rule re-opens both verbs; and one blanked environment variable defeats prefix matching. Read docs/honor-system-rules.md row A1 for the canonical statement.

Honesty invariants

One rule governs every surface this release adds: an unreadable source reports UNKNOWN — never zero, never clean. A Scry sensor that could not read its source states why and renders no number at all. A vow register that exists and will not fold reports blind: true rather than an empty list. A migration whose source cannot be read exits non-zero and never stamps that source superseded. “Nothing is owed” and “I could not look” are different facts, and this release refuses to render them as the same bytes.

[0.37.0] — Book 90 (Book-Level AUDIT remediation)

This release hardens the defaults flip landed in 0.36.0 — see that entry below for the full picture: offerings_enabled, retrospective_enabled, and teachings_enabled had their defaults flipped to opt-in, off for every existing consumer upgrading, while atlas_enabled stayed on by default. Restoring the old behavior is still setting the affected keys to true, project-locally or once for every project via the global ~/.divineswe/config.json layer this release’s discovery logic makes safer.

Two CRITICALs closed in the config-gated memory rites landed by 0.36.0. Three rounds of Book-Level Loki-Exploit against the cumulative Book 90 diff found that a monorepo or subdirectory base could erase a project’s explicit false and re-open the memory rites, and that a below-root config which was unreadable (symlinked, a trailing comma) silently inherited the machine-wide true instead of failing closed.

Bounded project-root discovery. scripts/shared/rite-gates.mjs gains discoverProjectRoot(), walking realpath-normalized ancestry with validated .git boundaries (including content-checked bare-repo pointers) up to the repository marker — never past it, and never into the global layer’s own root. A config found at or below the discovered root can close a rite but can never open one the root itself did not open: first-false-wins, one walk, one answer.
Fail-closed on an unreadable below-root config. The new exported projectRefusesRite() is the single decision both the offerings CLI and the teachings veto walk now call, so a below-root declaration that exists but cannot be read no longer inherits the machine-wide true — it closes, and reports project_declaration_below_root_dropped.
project_root_discovery_exhausted — the new warning token emitted when the ancestry walk runs out of bounded root before finding a repository marker, so an exhausted discovery fails closed and loudly instead of silently.
Offerings gate/write-target split fixed. The offerings CLI’s permission check and its actual write target now resolve against the same discovered root (Round 3), closing a divergence where the two could disagree.
Generator fix: stale hooks no longer survive an in-place regen. scripts/generate-platform.mjs’s hooks cleanup previously wiped outputDir/hooks only in the no-hooks case; a hook file deleted from canonical source could survive forever in an in-place dist/claude-code or dist/codex-cli. The wipe is now unconditional and precedes the hooks re-emit, so a deleted hook is actually gone after regeneration.
teachings-gate.mjs coverage closed. A CLI/chokepoint verdict divergence is fixed, and the module’s exported surface is now driven in-process (not only through child-process CLI tests, which the v8 coverage provider cannot instrument), raising coverage from 74.02% line / 26.66% branch to 100% / 94.74%.

[0.36.0] — Book 90 (Config-Gated Memory Rites)

⚠️ BEHAVIOR CHANGE — defaults flipped. Read this before upgrading.

Three rites that previously ran unconditionally are now opt-in and ship off. If you upgrade and change nothing, they stop running. This affects every existing consumer, not only new projects — the gates are resolved at runtime, so an already-seeded .divineswe/config.json does not grandfather the old behavior.

What changed. Three subsystems are now gated by config keys that default to false:

offerings_enabled — the whole Offering pipeline: the /divineswe:offering skill, scripts/offering.mjs, and the compose-time script-opportunity detector in oracle-consult.
retrospective_enabled — the whole WRAP UP retrospective tail: the 4eyes mode=retrospective dispatch, follow-up-register appends and reads, the honor-register append, the spend and exceptions digests, and the terminal acknowledgment.
teachings_enabled — the whole TEACHINGS rite, reads and writes: per-dispatch lesson injection into agent briefs, the ~/.divineswe/TEACHINGS* reads at prophet-fulfill INIT and oracle-consult Step 1, the sweep, the tiering pass, and the promotion coda.

Why. Each of these bought organizational memory with tokens on every cycle, whether or not a given project wanted it. Making them opt-in means a consumer who never asks for a rite never pays for it. atlas_enabled is the deliberate exception — it is a new key too, but it stays default true, because the plan-time map is load-bearing for plan quality and accurate task file-paths.

Who is affected. Everyone upgrading from 0.35.0 or earlier who relied on offerings, the WRAP UP retrospective, or TEACHINGS. Nothing errors and nothing warns — the rites simply do not run, which is exactly the failure mode worth announcing loudly.

What to do about it. To restore the previous behavior for a single project, set the keys in that project’s .divineswe/config.json. To restore it for every project on the machine at once, create ~/.divineswe/config.json — a new machine-wide (global) config layer this release introduces — and paste:

{
  "offerings_enabled": true,
  "retrospective_enabled": true,
  "teachings_enabled": true,
  "atlas_enabled": true
}

Resolution order is project value → global value → built-in default, so a project config wins over the global file. The project layer is located structurally — at the repository root — so a rite run from a worktree, a subdirectory or a vendored subtree still reads the enclosing project’s config. A .divineswe/config.json below the repository root cannot open a rite and can still close one (an explicit false is honoured and reported as project_declaration_below_root_closed; one that is found but not read — symlinked, a trailing comma — also closes, reported as project_declaration_below_root_dropped), and the walk never climbs into the home directory whose config is the machine-wide layer. The teachings_enabled veto resolves through that same rule, so no config file gets two answers out of one release. Only strict booleans count, and a non-boolean does not inherit the machine-wide value: "true" the string marks the project layer as not read for that key, and the rite resolves closed until the project config is repaired.

One exception is worth knowing before you paste the machine-wide form: authorization for a section of the shared ~/.divineswe TEACHINGS register follows that section’s recorded owner (teachings-owners.json), not the project asking. A section with no recorded owner is decided by the global file alone — so a machine-wide teachings_enabled: true also opens unclaimed sections belonging to projects that declared false — and a section owned by another root stays closed even when your project says true. Bind a project’s own section once, from its own root, with teachings-tier --project <slug> --base <project root>. See docs/configuration.md.

Also in this release.

scripts/shared/rite-gates.mjs — one resolver owns all six gate keys; every consumer asks it rather than reading config itself. It refuses a ~/.divineswe directory or a config.json leaf that is a symlink, and any leaf that is not a regular file under a 1 MiB cap — so a config layer can never redirect the read out of the directory it was found in. That guard covers those two components and nothing above them: a symlinked home directory is followed normally. Every refusal is reported in warnings[], and the resolver never throws. Run node $CLAUDE_PLUGIN_ROOT/scripts/shared/rite-gates.mjs <projectRoot> to print the resolved gates and warnings[] — it always exits 0, and it is the only way to observe these otherwise-silent failures.
ledger_enabled / scrolls_enabled wired for real. Both were declared and seeded but read by nothing; they now gate their actual chokepoints. They remain project-only — declaring them in the global file is inert and reported as global_key_ignored:<key>.
The four gate keys are deliberately not seeded into new configs. An absent project key is what keeps the global layer reachable; a seeded false would shadow machine-wide policy forever.
PreCompact hook removed. It emitted hookSpecificOutput.additionalContext, which PreCompact does not support at all — the hook errored visibly on every compaction and could never deliver its payload.

[0.35.0] — Book 89 (Bookkeeping Core)

Scripted Book lifecycle. New divineswe-state.mjs subcommands take over Prophet’s mechanical bookkeeping: book mark-task|seal-bookkeeping|seal-cleanup|next-number, output verify, audit reconcile, and ownership create.
Content-inclusion durability witness. book seal-cleanup deletes a completed Book file only when every task line appears verbatim in TABLETS.md; spoofable heading/token heuristics were removed.
Fail-closed reconciliation. audit reconcile is arithmetic-only — an absent declared findings stream exits non-zero with no verdict, and Prophet retains reconciliation authority.
Single Book parser. scripts/shared/book-parse.mjs is the sole source of Book-file parsing (parameterized checkbox-class regex; verbatim raw task lines), with verify-consultation-complete.mjs refactored onto it.
Facade docs. All seven new subcommands documented in docs/state-model.md, guarded by structural tests.

[0.34.0] — Book 88 (The Offering — Upstream Pipeline)

Offering pipeline. scripts/offering.mjs (prepare|lint|url|log) packages a local improvement into a prefilled upstream issue URL. Sharing is an explicit human link-open — deny-all by default, zero network code — and only linted entries are recordable.
upstream_url config field. Optional http(s)-only upstream target (defaults to the DivineSWE GitLab), validated against URL/log injection.

[0.33.0] — Book 87 (The First Axiom — Script the Mechanical, Reserve Judgment)

The First Axiom canonized. The script-vs-judgment three-gate decision rule is single-sourced in skills/oracle-consult/SKILL.md, expanded in docs/axioms.md, with a verdict-neutral compose-time detector duty for Preacher and a union-of-qualifying-sections drift guard.
Script-opportunities backlog. docs/script-opportunities.md seeds 13 mechanization candidates under opaque SO-NNN ids, guarded by scoped-label (not blanket-file) exemptions.
book-parse.mjs extracted. Pure shared Book parser plus the compute-only layout-hint.mjs CLI; a re-probe-caught O(N²×path) hotspot was cured structurally (40.3s → 1.17s on a 2000-task Book).
Derive-from-canonical version sync. Guard reads the expected version from package.json and collapses all seven version sites into one set — stale hand-updated literals can no longer hide.

[0.32.0] — Book 85 (Organizational Memory)

TEACHINGS tiering. scripts/teachings-tier.mjs keeps the project TEACHINGS Active band small with a no-loss archive.
Lessons in dispatch briefs. compile-prompt.mjs routes [seats: …]-tagged lessons into each agent’s brief inside a closed, forgery-hardened delimiter band.
Follow-up register. scripts/follow-up-register.mjs tracks deferred debt (open|closed|superseded) with an evidence-gated close, read at plan time by oracle-consult and Preacher.
Claims register + exceptions digest. docs/claims-register.md rows every “unproven” caveat with revalidation triggers; scripts/exceptions-digest.mjs surfaces six exception classes beside the retrospective spend table.

[0.31.0] — Book 84 (Law and Authority)

All seven pipeline agents schema-backed. New monkey/mason/preacher output schemas close the output chokepoint; the legacy lax write path is dead, and styx evidence flipped to REQUIRED.
Single-source duty guards. Strict spawn keep-guard in scripts/shared/duty-guards.mjs, Mason’s canonical mode registry, and a schema-validated scroll update-state CLI.
Real lint/type gates. eslint 9 flat config (29 errors burned down), @vitest/coverage-v8, and a phased typecheck gate — genuine checkJs over hooks/shared/** plus a .d.ts↔.mjs conformance ratchet.
Statute conformance. statute-extract/statute-conformance assert every doc-quoted CLI literal against the live exports.

[0.30.0] — Book 83 (Restore the Signal)

Quarantine baseline. tests/test-baseline.json (AJV-schema’d) pins known failures so regressions are localized by failing-test SET diff, never by count; a nondeterministic platform-test flake was fixed with a cross-process mkdir-mutex.
run-verify.mjs. Full-suite runner with sha256 tree-bound evidence, quarantine-aware set-diff, and vacuous-PASS guards.
Deterministic briefs. compile-prompt.mjs rebuilt as the brief assembler with untrusted-content delimiter neutralization.
CI lanes + audit teeth. .gitlab-ci.yml unit and scheduled-e2e lanes, reconcile-audit.mjs fail-closed synthesis on missing audit streams, flash-floor refusal, and a fourth executed-evidence audit stream.

[0.29.0] — Book 86 (Token Efficiency) + Book 82 (Atlas Map Provenance)

Spend telemetry. dispatch_spend ledger events with a strict required-flag contract, projected by scripts/spend-digest.mjs into per-seat/per-model dollar digests with downshift recommendations.
Evidence-gated model mix. Effort markers on heavy tasks; downshifts argued from spend-digest evidence, not vibes.
Book 82 (shipped unversioned). Atlas maps carry provenance + staleness, with reuse-when-fresh and a --force flag; a forge-provenance CLI write bypass was closed.
0.29.1 hotfix. Fixed SessionStart hook failures.

[0.28.0] — Book 81 (Atlas — Exploration Agent)

Atlas, the read-only cartographer agent, plus the atlas-explore skill. A plan-time multi-modal sweep fans out four read-only scouts (by-structure, by-content, by-dependency, by-convention) and synthesizes a structured map under .divineswe/maps/, giving Oracle accurate file paths and blast-radius context at planning time.
Everyone gets a swarm; only the mechanism differs. Orchestration lives in the main-thread skill, so the multi-scout fan-out works on every platform — claude-code via the Workflow tool, copilot/codex/opencode via native multi-dispatch (the claude-code-only Workflow block is stripped for other platforms).
Proactive agent-use roster. The session-start reminder now marks Atlas (and Oracle for ad-hoc design) as usable proactively, while scoping the pipeline-7 as Prophet-dispatched-only. Atlas is read-only and never a run-time task-line agent (absent from ALLOWED_AGENTS).

[0.27.0] — Book 79 (Runtime Boot-Smoke Gate)

Audited boot-smoke runtime-wiring gate. A boot-smoke convention that exercises the orchestration runtime end-to-end so packaging-conformant artifacts are also proven to boot, closing the gap between “loads” and “runs.”
Adversarial verification teeth. The gate is backed by Book-Level 4eyes review with real teeth and a Styx PASS gate, so a green boot-smoke reflects an adversarially-verified run rather than token presence.
Preacher advisory tripwire. An advisory Preacher tripwire surfaces drift in the boot-smoke wiring before it reaches the runtime gate.

[0.26.0] — Book 76 (Workflow Orchestration)

Native Workflow orchestration for Prophet and Oracle (claude-code). Book 76 wraps Prophet’s run-cycle and Oracle’s consultation flow as Claude Code Workflows — predefined, model-directed execution graphs with parallel fan-out and structured output. Workflow content is gated behind  inline markers and stripped for all other platforms at generation time (fail-CLOSED for non-claude).
 marker anatomy. Inline gating markers keep Workflow-specific bodies for claude-code (markers removed, body kept) and strip entire blocks for copilot-cli, opencode, and codex-cli. Marker recognition is line-anchored; unterminated blocks fail-CLOSED for non-claude. The strip pass runs before rewriteSegment so no env-var rewrites fire inside deleted content.
model_authority config field. New enum "prophet" | "config" (default "prophet"). "prophet" lets the run-cycle orchestrator decide model and effort per agent dynamically; "config" clamps model to the static tier in model_preferences / agent_models for deterministic, cost-bounded dispatches. In-workflow strict-mode: resolver is advisory — the Workflow host’s constraints are honoured rather than overridden.
RCA diagnosis harness (Styx). Systematic root-cause analysis for bugs, crashes, and recurring failures — fan-out evidence gathering, adversarial verification, structured diagnosis output.
Oracle consult Workflows. Oracle’s brainstorming and consultation flow runs as a structured Workflow with parallel research fan-out and iterative dialogue.
Agentic-engineering research survey. docs/agentic-orchestration-frameworks.md — a 12-agent (6 research + 6 adversarial fact-check) verified survey of orchestration patterns, grounding the Book 76 design. Highlights: verification reliability is governed by the externality of the feedback signal; prefer workflows over autonomous agents for most production use.

0.25.0 — Book 74 (Copilot Git-Marketplace Install)

Copilot git-URL marketplace install. The generated copilot/ package is now COMMITTED at the repo root so it can be installed directly from a git URL via the marketplace — no clone+generate step required. copilot plugin marketplace add <git-url> → copilot plugin install divineswe@divineswe is the only supported install path (direct owner/repo form is broken upstream — copilot-cli#2390).
buildMarketplaceManifest owner MUST be an OBJECT {name:<string>}. The real @github/copilot binary rejects a string owner (owner: Expected object, received string). Any string author/owner is normalized to {name:...} in both the repo-root and internal copilot marketplace.
Copilot NO PLUGIN_ROOT/CLAUDE_PLUGIN_ROOT env var. Generated copilot SKILL and HOOK bodies self-locate scripts via a marketplace-name-PINNED cache-glob, validated against a sibling plugin.json name===divineswe sentinel before exec.
divineswe-init updates. Copilot git-marketplace install docs added; VS Code install gesture documented. copilot/plugin.json and both marketplace.json versions flow from the generator — regenerate after a version bump.

0.24.0 — Book 73 (configurable books_dir + doc-as-contract guard)

books_dir is configurable. Code resolves the Books dir via scripts/resolve-books-dir.mjs resolveBooksDir(basePath) (default .divineswe/books; permits absolute + ~; rejects ../null-byte/shell-expansion). Out-of-tree books_dir makes Books local-only working state.
Doc-as-contract guard. When an AGENT.md documents a structured-output shape, a test AJV-validates the documented example against its canonical schemas/<agent>-output.schema.json — prevents doc↔schema drift.
output write is the AJV validating chokepoint. output write --agent <name> --phase <phase> --json <doc> selects the canonical schema by the call-site --agent, hard-rejects payload agent field mismatches, and AJV-validates before persisting.
Structural grep guards. tests/structural/no-hardcoded-books-dir.test.ts enforces zero hardcoded .divineswe/books in scripts/**/hooks/**.

0.21.0 — Book 65 (Per-Prophecy State Persistence and Agent Enhancements)

Per-prophecy state persistence. Prophet now checkpoints session-state.json at the start of each prophecy with current_phase set to {book}-prophecy-{N} (e.g., 65-prophecy-2). This enables prophet-resume to re-enter mid-Book at the exact prophecy that was in progress, rather than re-deriving from stale Book file checkboxes.
WRAP UP retrospective and TEACHINGS. After each Book, 4eyes (in mode=retrospective) writes a retrospective report to ~/.divineswe/akashic-records/{projectFolder}-b{N}.md. TEACHINGS are curated learnings at two levels: global (~/.divineswe/TEACHINGS.md) and project (~/.divineswe/TEACHINGS-{project}.md). Prophet consolidates both files during each WRAP UP.
Styx operational verification. Styx now verifies build/compile, linter/typecheck, clean working tree (git status --porcelain), commit history, state file consistency (session-state completed_tasks vs Book checkboxes), and code coverage (80% threshold for new code). Styx tier changed from high to medium — operational checks, not deep analysis.
4eyes test sufficiency. 4eyes now checks for sufficient test coverage across test types: integration, wiring, DI, smoke tests, and test type distribution (not all unit tests). Verifies tests exist for new/changed code; Styx handles quantitative coverage enforcement.
Audit revisit scroll traceability. When 4eyes or Loki-Exploit returns REQUEST_CHANGES, they include the relevant scroll filename in the findings output. Prophet continues the existing audit revisit flow (invoke Monkey, write prompts) — no new schema fields.
OpenCode model dispatch. Agents are dispatched with general model in OpenCode. Agent types remain specialized (Thoth, Monkey, etc.) but share the same model endpoint.
oracle-consult approval gate collapse. Step 4.8 (re-approval after Loki) and Step 5 (entry approval) merged into a single check. If the user approves the revised design at 4.8, proceed directly to Book composition without asking again.
divineswe-init updates. Now creates ~/.divineswe/ (for TEACHINGS files and retrospective reports) during first-run setup. Retrospective reports live at ~/.divineswe/akashic-records/ (user-level, not inside the project .divineswe/).

0.20.0 — Book 63 (Task-Enforced Pipeline / Agent-Name-as-Phase)

Book becomes the execution plan; Prophet shrinks to a pipeline-aware Book-interpreter. Pipeline enforcement moves out of Prophet’s centralized state machine and into the Book/prophecy structure itself. Each task line carries an explicit colon-separated agent prefix (Thoth:, Loki-Break:, Monkey:, 4eyes:, Loki-Exploit:, Styx:, Mason:). Prophet walks tasks top-to-bottom and dispatches the named agent; phase is inferred from the agent name.
7-agent dispatchable allow-list is the binding contract. Spoofed agent names are mechanically rejected at verify time by scripts/verify-consultation-complete.mjs. The same script enforces the dual-audit gate, the per-prophecy TDD ordering rule, and the empty-book gate.
CHECKPOINT renamed to WRAP UP throughout live code, docs, schemas, tests, and the standard pipeline (INIT → TEST → IMPLEMENT → AUDIT → MERGE → VERIFY → WRAP UP).
Breaking: mode enum removed from schemas; flash boolean added. schemas/book-file.schema.json no longer accepts a mode field — flash mode is signaled by flash: true in Book frontmatter (default false). Multi-prophecy Books with flash: true are mechanically rejected.
Breaking: skills/prophet-add-prophecy/ and skills/prophet-flash/ hard-deleted. Both skills (plus their test files) are removed from the tree via git rm -r. Upgrade path: use oracle-consult to add or amend Book content; signal flash mode by writing flash: true in your Book frontmatter.
Standalone audit unchanged in posture. skills/prophet-full-audit/SKILL.md continues to dispatch the dual-angle 4eyes + Loki-Exploit audit.
Platform packages regenerated for all four targets (claude-code, copilot-cli, codex-cli, opencode) via npm run generate:all. The agent-name-as-phase contract, WRAP UP terminology, and flash flag propagate uniformly.

0.10.0 — Book 62 (Prophecy Execution Model)

Prophecy Execution Model. Optional per-prophecy mini-cycle (TEST → IMPLEMENT → AUDIT → VERIFY (smoke)) opt-in via ### Prophecy N: headings inside Book files; task IDs use B<NN>-P<N>-<YY> (e.g., B62-P1-04). Legacy Books without prophecy headings remain valid — they parse as a single implicit prophecy. Mixed-format Books are forbidden.
Book-Level AUDIT + Global VERIFY are MANDATORY after the last prophecy in any prophecy-structured Book.
Branch isolation for large Books (branch_mode). Books with task count > 6 now run on a book/<N> branch with per-prophecy commits and a Book-level FF-merge to <default_branch> at WRAP UP.
New default_branch config key (default "master", regex-validated). Set to "main" if your repo uses main as the integration branch. The SessionStart top-up hook backfills the key automatically.
Advisory layout Book frontmatter (oracle-consult Step 5a.4). Pure observability — Prophet emits a layout_hint_observed ledger event but never branches on the value.
Breaking: prophecy_snapshot removed from session-state schema. Pre-Book-62 session-state.json files containing the field will fail AJV validation. Upgrade path: run a prophet cycle on the previous version once to refresh session-state, or manually delete the prophecy_snapshot key.

0.9.0

Migration removed. The one-shot v3 migration script and its SessionStart hook (introduced in v0.8.0) are deleted in v0.9.0. Upgrade path: users on v0.8.x upgrade directly to v0.9.0+ with no migration required. Users on v0.7.x must upgrade through v0.8.x once first.
prophet-revelation script enforcement (hardening). F8 (strictly-greater-than post-glob book diff) and F5 (clean-abort message) are now script-enforced rather than prose-only. The prophet-revelation skill invokes scripts/diff-revelation-books.mjs compute-diff for the diff and verify-clean-abort for the chain decision.