nyldn/claude-octopus v11.24.0

on GitHub

Changed

This batch protects local work during quick tasks and rollback, binds shipping
audits to the delivered commits, verifies current research and Council evidence,
and supports OpenCode 2.x dispatch. Factory requires independent holdout evidence
and stops after failed stages. Configured Antigravity capacity fallbacks are
opt-in; existing model choices remain intact.

Merged changes: #1334, #1327, #1326, #1325, #1324, #1321, #1322, #1323, #1320, #1319, #1318, #1317, #1316, #1315, #1314, #1313, #1312, #1311, #1310, #1309, #1308, #1307, #1306, #1257, #1301.
These address parts of #1304,
which remains open for outstanding runtime and acceptance work.

The rollback boundary also includes #1328,
#1329, and
#1332, which preserves hidden
local edits and deletions marked assume-unchanged.

Shipping's source-review boundaries are covered by
#1330 for submodules and
#1331 for Git-classified binary files.

Added

• OCTOPUS_AGY_FALLBACK_MODELS lists Gemini models for agy to retry, in
  order, when the backend answers 503 "No capacity available for model". The
  council seat records the model that answered, with model_fallback.from, so
  a busy model no longer stops the council. Non-Gemini entries are skipped.

Fixed

• Factory satisfaction scoring rejects failed, missing, duplicate or out-of-range
  evaluator scores instead of inventing defaults or accepting false completion.

• Rollback refuses assume-unchanged index entries before restoring files, so
  hidden local edits and deletions remain intact. Protected lessons stay excluded.

• Shipping stops the quick audit when binary files change, requiring a separate complete review of their content.

• Shipping stops the quick audit for added, removed or updated submodules, whose source needs a separate complete review.

• Rollback refuses sparse or skip-worktree exclusions and linked lessons directories
  before restoring files, so partial recovery cannot be reported as complete.

• Rollback rejects linked lessons files whose tracked backing content could otherwise be restored.

• Factory stops before evaluation or completion when initial or retry implementation fails.

• Factory discards failed scenario-provider output and tries healthy fallbacks.

• Factory stops when scenario evidence cannot be saved.

• Factory rejects negated or ambiguous verdicts and duplicate summary scores in holdout evaluations.

• Factory assigns unique IDs across provider scenario lists and supplies the complete holdout set to the evaluator.

• Factory rejects malformed holdout evaluations and scores outside the 0 to 1 range.

• Satisfaction scoring uses the validated holdout value, including zero, and stops when it cannot save the score record.

• Factory retries failed holdout providers and stops without scoring when none can evaluate the scenarios.

• Factory stops before implementation when generated scenarios leave no independent holdout.

• Factory stops when it cannot save scenario or holdout evaluation evidence.

• Missing or empty holdout evidence cannot earn a perfect score; evaluation failures stop Factory, including retries.

• Shipping audits review the confirmed committed source range and report its base and delivered revisions.

• Shipping stops audits on dirty, empty, oversized or changed source instead of accepting incomplete evidence.

• Delivery stops on context-budget rejection or failed or empty required review under the audit's fail strategy.

• Delivery initializes feature context without changing source metadata.

• Optional Tangle delivery propagates failures instead of reporting success after rejection.

• Freeze enforcement recovers the Codex session identity in later hook processes
  without a host export or matching hook session ID, so out-of-scope edits stay
  blocked after activation. Explicit hosts and Claude session IDs keep precedence.

• Advisory workers clear inherited and temporary Git environment values before
  dispatch, so a temporary repository selection cannot expose another checkout
  to accidental Git writes from the disposable advisory copy.

• Interrupted council launches retain a cancellation record for a seat stopped
  during scheduler ownership transfer, so collection cannot mistake it for work
  that was never launched.

• Resuming tasks refreshes the queue and starts only an unblocked pending task.
  Fully blocked and empty queues report their state without starting work.

• Rollback stops before partially restoring checkpoints with changed submodules.
  It reports the required manual restoration instead of treating a gitlink update
  as a complete recovery of the nested working tree.

• Rollback confirmation stays bound to the previewed repository, branch, revision
  and checkpoint. Changed context requires a new preview before any restoration.

• Linux review previews and advisory copies can traverse execute-only ancestor
  directories while retaining symlink rejection and descriptor identity checks.

• Council waits retain a running-round observation when the producer finishes
  during a poll, so the new result is returned without an unnecessary settle delay.

• Parallel workflow summaries restore the work-package count in each shell,
  so every worker's result is included after resuming aggregation.

• Debate state preserves quotes, newlines, backslashes and Unicode in questions
  and clarifying answers, so saved debates remain readable by JSON consumers.

• Quick tasks commit only their selected files, preserve unrelated staged work,
  and stop before recording completion when staging or committing fails.

• Quota and authentication failures update the original provider seat in agent
  summaries instead of leaving duplicate entries that still show it running.

• Council grounding checks a later source claim even when an earlier clause
  describes the reviewer's own estimate or calculation.

• Rollback history requires the exact target and safety checkpoint tags in each
  shell call and updates the repository state file when run from a subdirectory.
  It refuses symlinked state paths so restored checkpoints cannot redirect the
  history append into another file.

• Deep research validates the current invocation's completed synthesis in the
  active host session instead of accepting an unrelated recent report.

• Checkpoint rollback removes tracked files added after the checkpoint and
  restores deleted files from any subdirectory. It refuses collisions with
  ignored local files or replacements of the protected lessons directory while
  retaining current lessons and commit history.

• Checkpoint rollback refuses uncommitted or untracked work before preview,
  safety tagging and restoration, so a tag cannot be mistaken for a backup of
  changes that exist only in the working tree or index.

• OpenCode debates admit the Claude moderator before proposals; successful
  quorum debates need no moderator. Squeeze verifies its required providers
  and stops on empty phases or failed fallbacks. Completed research resumes
  return saved results without requiring live provider admission.

• Command Code availability probes exclude the unrelated Mistral credential,
  matching the existing health probe.

• Fresh Embrace runs confirm an unpinned OpenCode login before rejecting
  readiness. Resumed workflows keep the existing admission
  path; skipped probes and provider exclusions remain enforced.

• Authentication-library initialization uses the system dirname, so a
  project-selected utility cannot run before OpenCode admission guards.

• OpenCode readiness pins its bootstrap tools and clears BASH_ENV before
  starting probe shells. Dependency loading stays outside the project directory,
  while the guarded login check retains project-relative CLI selection.

• OpenCode debate and fan-out seats appear in the production agent inventory.
  Interpreter supervision uses system cleanup timers when a project changes
  PATH, and cancellation tests retain real waits for supervisor children.

• The six-worker feature-task fixture resets its eight-second join deadline
  after each worker starts. Staggered launches retain the concurrency
  check, while serial waves and stalled workers still fail.

• OpenCode admission applies bounded Tangle isolation before executing probes.
  Version checks omit forwarded credentials; login checks disable project
  configuration and reject project-owned executables or configuration paths.
  Saved logins, external custom configuration and environment-only login remain
  available. Command refusals preserve exit 125 and their launcher diagnostic.

• Non-council research ignores unrelated council roster admission while honoring
  explicit preflight panels. Opus selection displays the command's model, and
  OpenCode dry runs identify unchecked server mode and bounded availability.

• Automatic research confirms SQLite-only and environment-only OpenCode logins
  before choosing its fleet, including without a pinned council roster. Static
  preflight inspection, probe skips and existing provider exclusions are preserved.

• SQLite-only and environment-only OpenCode logins retain existing quota and
  run-local health exclusions. Excluded seats are not probed or readmitted.
  Copilot capability and GitHub authentication probes omit the unrelated
  Mistral credential forwarded for OpenCode while preserving parent settings.

• OpenCode discovery and readiness check each supported environment token
  independently, so a blank token cannot hide another configured login.
  Preflight uses the current directory when the configured project root is
  absent, matching direct-probe directory selection.

• Selected OpenCode seats receive login confirmation even when a fixed provider
  panel omits them. Static discovery recognizes the same supported environment
  credentials as readiness checks without launching the CLI.

• MCP preserves OpenCode's custom XDG configuration, cache and state roots.
  GitHub authentication checks and OpenCode workers explicitly using known
  non-Mistral provider namespaces exclude the unrelated Mistral key. Mistral,
  custom providers and configured default models retain their credential.

• Cursor version and session-status probes exclude the Mistral credential
  forwarded for OpenCode, while preserving Cursor session authentication and
  the parent environment.

• Claude startup version, status and capability checks exclude the Mistral
  credential forwarded for OpenCode, while preserving parent authentication.
  MCP also preserves the explicit OPENCODE_CONFIG file selector so custom
  OpenCode provider settings reach login checks and dispatch. OpenCode version
  probes omit Mistral and search credentials, while login checks retain the
  required Mistral credential and omit the unrelated search key.

• CommandCode health checks exclude the Mistral credential forwarded for
  OpenCode. Failed selected OpenCode admission preserves the broad discovery
  cache, including login and provider smoke failures.

• Fixed-panel OpenCode dispatch confirms SQLite-only and environment logins
  before admitting work. Panel inspection stays static, and unrelated panel
  providers retain their existing readiness checks.

• Automatic OpenCode routing displays its model without launching a version
  probe. Compatibility helpers still load when their libraries were sourced by
  bare filename before the working directory changed.

• Broad preflight scans and roster inspection no longer launch OpenCode version
  or login probes. Selected OpenCode dispatch and workflows with a pinned
  OpenCode roster still confirm login and cannot
  reuse or populate the broad discovery cache. Single-agent probes confirm a
  pinned OpenCode roster even when another provider handles the selected seat.

• OpenCode checks and private servers launched through MCP retain an explicit
  OPENCODE_CONFIG_DIR, preserving custom configuration alongside SQLite login
  storage. Other providers retain their existing environment isolation.

• MCP OpenCode calls preserve custom SQLite login paths selected with
  OPENCODE_DB and XDG_DATA_HOME, so saved logins remain discoverable.

• OpenCode 2.x dispatch no longer passes the removed --pure flag. OpenCode
  1.x keeps its external-plugin hang protection through OPENCODE_PURE=1.
  Discovery recognizes SQLite login storage without launching OpenCode. An
  explicit live readiness check confirms saved or environment credentials,
  with bounded version and login commands. Version-aware 2.x dispatch uses a
  private server so tools stay inside the selected process boundary; unknown
  CLI versions refuse real dispatch. Empty or failed listings remain unavailable.
  Large legacy login listings survive strict pipeline checks, the live deadline
  covers both probes and startup, and failed direct probes record a terminal seat
  event in durable research history.
  Workflow admission confirms SQLite-only logins, including pinned rosters,
  before rejecting readiness. Direct OpenCode probes check login for the
  standard, fast and research seats.
  Environment-only logins also receive runtime confirmation before admission.
  Background login and version checks use the worker's project directory, so
  directory-sensitive executables select the correct private-server flags.
  Direct probe-single --dry-run previews stop before health checks or provider
  execution.
  Both OCTOPUS_SKIP_PROVIDER_PROBES=true and =1 suppress OpenCode version
  and login probes and refuse real dispatch without selecting a server mode.
  OpenCode 2.x login validation also works without jq, using Python 3's
  standard-library JSON parser while retaining connection validation.
  Admission confirms logins even when static token evidence is present and
  checks project-relative executables from the worker directory. Failed command
  construction closes its durable research-seat event.
  MCP research also forwards the optional Mistral environment credential to
  OpenCode, while isolated model children keep their own credential boundary.
  Unrelated CLI and shell-function provider children omit that unselected Mistral
  credential while preserving their own authentication and the parent environment.
  OpenCode 2.x bounded Tangle refuses model tasks regardless of storage writability.
  Saved logins and filesystem boundaries remain
  intact; support for that execution path still requires a safe state projection.
  Failed live checks retain opencode auth login guidance. Health diagnostics
  use the application logger or stderr, including on macOS, and a failed health
  handler lookup closes the direct probe's durable research-seat event.
  Rejected timeout settings, context budgets, command validation, environment
  setup and result preparation also close the seat, including under shell
  error-exit mode, so rejected work does not remain marked as running.
  Rejected explicit models also close the research seat and preserve the
  resolver's failure status, whether or not shell error-exit mode is enabled.
  Addresses #1172.

• Council quota classification requires a terminal marker validated against
  complete stdout. A truncated diagnostic tail cannot establish a session
  limit. Quote checks retain patch-introduction ownership and reuse elision
  fragments across source lines.

• Council waits retain the settle hold when a finished round's torn summary is
  repaired. Early completion requires an observed, matching running beacon.

• Council quote checks preserve template delimiters and escaped pipes inside
  regexes and strings. Model fallback requires a complete capacity diagnostic
  from one stream, so quoted output cannot supply a missing error cause.

• Council fallback records keep the model that answered and the last model
  proven capacity-limited. Session limits remain visible beside stderr warnings,
  and explicit source claims stay checked when they introduce an example.

• Council quote layout matching preserves spaces inside quoted literals and
  requires an explicit ellipsis wherever source text is omitted. An unpunctuated
  list item ends the previous item's citation scope; a colon still introduces
  attributed bullets. Empty Antigravity fallbacks return the original capacity
  failure and retain diagnostics from stdout and stderr. Command arguments and
  operator spacing remain significant when verifying quoted source.

• Antigravity changes models only for retryable capacity errors and applies
  TTY recovery to fallback attempts. Crash-retry diagnostics remain separate
  from terminal quota classification. Standalone failed session-limit statuses
  remain detectable while quoted or streaming reply text leaves seats available.

• Missing extensionless file claims retain their citation position. Result
  wording alone no longer exempts a current-source claim from verification.

• Council seats with real citations are no longer marked fabricated for
  quotes the verifier misread (sail-cruisey #3316, #3338, #3339, #3340). A
  multi-line condition written on one line verifies when only layout around
  punctuation outside literals differs. A code span stays inside one paragraph, a backtick
  opened in link text is literal, and paired \` inside a span are
  literal backticks. Citations of files with no extension, such as
  .githooks/pre-commit:48, bind their quotes. The inputs a seat says it fed
  to the code under review, and code it says the file avoids, are its own
  words, not quotes of a file. After a content verb, "built as" marks the
  seat's own input only when "I" or "we" built it. A fence partial in a cited
  file but complete in the reviewed diff is not counted as partial.

• Council seats with real citations are no longer marked fabricated for
  quoting the error a probe threw (RangeError: Maximum call stack size exceeded), for an example they made up ("a template like ..."), or for
  a quote that drops the file's inner backticks, which a single-backtick span
  cannot hold (sail-cruisey #3386). A runtime error attributed to a cited
  file is still checked.

• A quote with $n for a numbered placeholder, or abbreviated with ...
  (!== "POST" || ! ... endsWith(...)), verifies when its retained fragments match one line of the
  cited file (sail-cruisey #3389). A basename that two files share, such as
  sentry.ts:169, now resolves to the one the seat also cited by full path,
  so its quotes are checked instead of left unresolved (sail-cruisey #3390).
  A span on a new list item is no longer attributed to the previous item's
  citation.

• council-wait.sh --pool --supersede-key no longer returns the previous
  round when the wait starts before the new round's run dir exists
  (sail-cruisey #3364). A keyed round already finished at first sight is held
  for --settle seconds (default 60) while a newer same-key round may appear;
  --since skips the hold. --background drops the 570-second bound for a
  wait run as a background task, and a timeout now says the round may still
  be running and how to re-arm.

• Abbreviated council quotes must match whole identifiers, so a longer name or
  string token cannot make invented source evidence pass verification.

• Runtime diagnostics in plain-text fences do not count as invented source.
  Runtime-error quotes beside an adjacent source citation still need verification.