What to test
This candidate changes the boundaries of review and SDD state, and adds source-backed SDD Research. Exercise these paths against real repositories rather than only fixtures:
- After SDD Session Preflight and
sdd-init, start or resolve an SDD change, select the research lane offered aftersdd-explore, and supply questions plusdocumentationand/oropen-websource classes. On a host that exposes the command, run/sdd-research <questions>. Verify that its evidence records source IDs, mapped claims, uncertainty, and separate product choices; proposal must remain blocked until selected research isdone, decisions are confirmed, and the selected store is ready. - Exercise denied and partial research. An undeclared capability, unsupported source class, generic MCP or Bash access, incomplete sources, or persistence failure must produce no validated claim and must not admit a proposal. In hybrid mode, make the two stores disagree and confirm the system does not prefer one copy; it must reconcile only from retained intent or stay blocked.
- Run a clean negotiated review through the exact STATUS transition and submit every requested capture. A terminal reviewer, refuter, validator, correction-plan, or zero-lens START event now closes and burns the lineage. It must not offer a separate FINALIZE, receipt-publication, or delivery-gate step afterward. Exercise a committed correction recovery too: the target and selectors must survive the handoff and be collected before authorization.
- Try the former receipt-driven delivery shapes after a clean review and after a correction. Delivery now follows ordinary repository policy rather than a compact receipt gate; report any path that silently treats retired receipt state as approval.
- Ask an SDD v1 caller for status, then run the current SDD status flow. The current projection is
gentle-ai.sdd-status/v2; it must not expose review binding or receipt fields. Historical runtime records containingbinding,receipt, orbinding/setmust refuse instead of replaying. - Exercise selected-untracked candidates, failed or interrupted SDD settlement, nested-worktree discovery, Strict-TDD handoff, archive collisions, and an exhausted rescope. These paths now retain only current SDD runtime semantics and must name a truthful outcome rather than revive retired review state.
- In OpenCode, exercise grouped reviewer work and model discovery with a verbose catalog preamble. Reviewer system context must stay isolated, grouping must not replace native capture authority, and catalog discovery must remain usable.
- Use the TUI from a terminal and with reduced motion; confirm installation progress is visible for Pi packages. On supported Windows beta paths, test self-update. If you use agent backup or Homebrew, confirm Codex hooks are included in backup targets and the tap-trust guidance is clear.
- Verify
gentle-ai-review-provider-contract-1.1.0.tar.gzfrom the tagged source withgo run ./internal/providercontractbundlecmd verify --archive <bundle>, then inspect it withtar -tzf <bundle>.
The change whose argument is verified in tests but unproven in the field is removal of compact receipt delivery gates. The candidate has an API-absence regression test, but no decoy yet proves that ordinary repository policy rejects the exact unauthorized-delivery shape the retired guard caught. Finding such a bypass is the most useful thing this candidate can learn.
What the previous candidate taught us
The 2.4.0 line made receipt-driven development opt-in, and rc.8 made advertised review transitions match their execution. This candidate takes the next boundary: review closes at its last causal event instead of producing a second delivery decision after the evidence is complete.
That is intentionally a new minor line. The review and SDD contracts retire compatibility paths rather than silently preserving their old meanings. SDD Research adds an optional evidence lane, but selecting it makes its admission and persistence checks mandatory.
SDD Research is source-backed and proposal-gated
SDD previously had local exploration but no first-class lane for auditable external evidence. A user can now select SDD Research immediately after sdd-explore; on installs that expose the slash command, /sdd-research <questions> runs it after Session Preflight and sdd-init have established the active change, requested source classes, artifact store, and runtime capability declaration.
Research now accepts only the versioned gentle-ai.sdd-research-capability/v1 declaration with an exact grant for documentation or open-web. It persists a gentle-ai.sdd-research/v1 artifact recording questions, grants, sources, claim-to-source mappings, contradictions, uncertainty, freshness, and separate non-authoritative product choices. Bash, generic MCP, persistence access, undeclared tools, unknown classes, invalid sources, partial evidence, and failed admission do not create validated claims.
OpenSpec stores the evidence as openspec/changes/{change-name}/research.md; Engram stores it as sdd/{change-name}/research. OpenSpec-only and Engram-only flows validate their selected backend. Hybrid flows require the same revision and bytes in both; a one-sided failure recovers only from retained pre-write intent and canonical content, otherwise the research and proposal remain blocked. No-store research cannot make a proposal ready. Once research is selected, proposal requires done evidence, valid references, a ready backend, and confirmed product decisions. Contract, state, asset, command, generated-output, and organic-runtime scheduling tests cover those boundaries.
Review closure and correction recovery are explicit
A completed review previously waited for FINALIZE, compact receipt publication, and delivery gates after the reviewer evidence had already reached its terminal result. Those extra phases could preserve a second, divergent decision about the same candidate.
Terminal reviewer, refuter, validator, correction-plan, and zero-lens events now close the review and burn its lineage. Compact receipts and their delivery gates are retired. Delivery follows the repository's ordinary policy; no retired receipt is an approval. Refusals now distinguish their Pi transport and capture-result exits, and correction recovery collects its target before authorization while preserving committed selectors through continuation.
SDD runtime is authority-free and narrower
SDD status previously carried review-binding and receipt state alongside planning and runtime information, and historical remediation records could be replayed through that coupling. The resulting surface mixed two lifecycles and left old records with ambiguous meaning.
SDD status now exposes the clean v2 contract. Runtime state retains planning, task, verification, selected-untracked, and attempt truth without projecting active review bindings or receipts. Attempt settlement is independent of receipt-driven review; failed or interrupted remediation settles truthfully, exhausted rescope does not inherit another attempt allowance, and retired binding, receipt, parser, consumer, fixture, alias, and replay surfaces refuse instead of being reinterpreted.
Nested workspace discovery, Strict-TDD handoff, selected-untracked preservation, and archive collision handling now follow that same current-only boundary. The clean break is backed by migrated and retired corpus coverage rather than compatibility shims.
Runtime, UI, and platform paths are more dependable
OpenCode now isolates grouped reviewer relays and reviewer system context while model discovery tolerates verbose runtime-catalog preambles. Grouping changes scheduling only; native review still owns binding, capture, retry, correction, and delivery.
Windows beta self-update paths, terminal-only TUI startup, Pi package-install progress, bounded package-manifest parsing, cooperative locking, and platform-aware review fixtures receive focused corrections around paths operators actually run. Agent sync now includes Codex hooks in backup targets, and Homebrew guidance clarifies tap-trust choices.
The visual-theme component now installs selectable Gentleman and Gentleman-Cute themes for Claude Code and OpenCode. Installation, verification, sync, backup, upgrade, and focused uninstall cover all four managed theme assets while preserving the active theme, unrelated settings, and third-party themes. The TUI also adds a reduced-motion spinner fallback.
Gentleman-Cute now uses a hue-separated syntax palette shared with the companion themes: pink keywords and accents (#F095C8), powder-blue functions (#A9C7EE), mint strings, success states, and added diffs (#B4E7C7), champagne types (#E0C27A), peach numbers (#F2B86D), and sky operators (#C4DAF6).
Automation and generated assets are more constrained
Issue-creation automation now constrains labels, duplicate checks, target identity, multi-select handling, and private read-back more tightly. Orchestrator guidance now requires explicit change intent before implementation rather than treating investigation or a conditional request as permission to mutate. Generated skill packages no longer publish their shared marker, and archive fixtures continue to cover shell-startup injection and symlink collisions.
Also in this candidate
The earlier dedicated Codex SDD profile experiment was reverted before this candidate, so it is not shipped behavior. Regression coverage also makes Windows relative-root review fixtures and retired generic review tags explicit. These supporting changes keep the published runtime and generated assets aligned with the clean-break contract.
Numbers
At publication, 685 issues are open against a reconstructed 594 at rc.8 publication: 304 opened and 213 closed in the interval. Inflow exceeds outflow by 91; this candidate does not call that progress. The historical snapshot uses GitHub's current-state API and can be affected by issue reopen cycles.
Install
go install github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.5.0-rc.1Or use the platform binaries: gentle-ai_2.5.0-rc.1_linux_amd64, gentle-ai_2.5.0-rc.1_linux_arm64, gentle-ai_2.5.0-rc.1_darwin_amd64, gentle-ai_2.5.0-rc.1_darwin_arm64, and gentle-ai_2.5.0-rc.1_windows_amd64.exe, plus gentle-ai-review-provider-contract-1.1.0.tar.gz. SHA256SUMS.txt covers all six payload artifacts.