CHANGELOG

Changelog

All notable changes to the @mstar-harness/commands package are documented in this file.

The monorepo root CHANGELOG.md summarizes cross-surface releases.

[Unreleased]

[4.0.0] - 2026-10-15

Harness

• Hardened the opencode-v2 write gate against symlink aliasing: the landing-path resolver now follows symlink chains to the real destination (8-hop bound, fail-close refusal write.symlink-resolution-refused on cycles/overflow), closing a dangling-link bypass that could write harness authority files (store.db-wal) through outside aliases (#438).
• Hardened the ZCode git-guard hook force-push detection: push argv roles are now classified (option allowlist from git push -h, values consumed, first positional = repository), +refspec force pushes are denied, and unknown option forms fail closed naming the token — closing the +main:main and --repo=origin +main:main bypasses (#439).
• The MCP and CLI spawn helpers survive early-exiting children: child.stdin stream errors (EPIPE) are owned by the helper instead of crashing the process with an unhandled exception (#441).
• Root hooks/ are CI-covered: guard behavior tests plus node --check run in CI; hooks/session-context.mjs degrades fail-soft (diagnostic + unavailable-authority context) when the engine is unresolvable instead of crashing (#445, #446 partial).
• Status-write lock refusals now diagnose the stale-lock state (holder alive / confirmed dead with verified removal steps / pid file absent) instead of a bare hand-edit hint; automatic takeover stays deferred pending an atomic primitive (#447 partial).
• Lean cleanup: removed the unreachable CLI target prompt and the @inquirer/prompts dependency, deleted the dead homeRelativeSourcePath export, unified the judgment shadow digest helpers, fixed a stale release docstring (#453 partial).
• The omp gate hook now fails closed: an unexpected error inside a gate returns an explicit deny envelope (gate name + error summary) instead of undefined, which the host read as allow; envelope-construction failures rethrow (#443).
• dsh workflow-policy gains direct decision tests: allowlist normalization/boundaries, mode behaviors, unknown-name handling, ask-cache hit/miss and key normalization, and uncovered-plan precedence, with mutation-bite proof (#444).
• The codex agent installer caps retained backups at the 3 newest per target (mtime-ordered, best-effort pruning that cannot fail an install) (#448, partial — engine receipts/ledger retention remains open).
• Projection reads skip the rewrite when nothing changed: an unchanged generation fingerprint with intact published rows performs no SQL write; changed inputs render byte-identical legacy output; deleted/corrupt published rows are rebuilt (#449).
• The loopback dashboard now requires a per-launch random token: the CLI prints the tokenized URL once, valid tokens set an HttpOnly SameSite=Strict cookie for in-page requests, missing/wrong tokens get a state-free 403; Host/Origin checks unchanged (#450).
• The installer now refuses to clobber user files: symlinked/non-regular config targets are refused with a named recovery instead of being silently replaced; an incomplete ~/.mstar/harness clone self-heals (kept aside as .broken-<timestamp>, one re-clone) instead of blocking every future install; failed paired ZCode marketplace writes restore both prior file contents (#452).
• Published command schemas now state what the engine enforces: issue closure payloads publish disposition-specific requiredWhen branches (anyOf derived from the engine's ClosureEvidence registry, including disposition overrides), and plan.complete publishes/validates its declared completion-evidence shape — clients composing calls from the published schema no longer hit invisible refusals (#451).
• The issue action vocabulary has one source: engine exports ISSUE_ACTIONS/ISSUE_ACTION_NAMES (payload, read, CAS and closure-disposition facts per action); the CLI derives its verb tables from it instead of four hand-maintained lists — drift is now a compile error, published ids pinned by parity tests. Token set and behavior unchanged (#453 remainder).
• Removed the dead judgment review-advice command end to end (registration, family, CLI adapter/tests, docs, skill routing). It could never succeed — its only production call passed a null evaluator channel, which the runtime refuses before reading any input. The shadow evaluation path in packages/judgment is unchanged. The sandbox calibration worker (scripts/evaluate.ts) was migrated off the removed CLI spawn: it now imports the built judgment API bundle and submits via connectEvaluatorChannel in the same sandbox/supervisor flow (#440).
• hooks/session-context.mjs is now a bundled artifact: its source moved to hooks/src/session-context.ts and is built through the ZCode hooks builder (engine inlined), so the SessionStart hook runs standalone without node_modules; the fail-soft unavailable-authority diagnostic is preserved and covered by a bare-copy smoke test (#446).
• Gate path resolution is single-sourced in the engine (host-gate-paths.ts) and adopted by all five enforcement sites (opencode v1, opencode-v2, omp, dsh, ZCode write gate): symlink chains are followed to the real landing path with an 8-hop fail-close bound — v1/omp/dsh/ZCode upgrade from one-hop resolution, closing the alias-bypass class fixed in opencode-v2 during batch 1. Each host keeps its own refusal envelope (#442).
• Added the /amazing-test-audit entry (Codex/dsh project command installation included) and the mstar-audit test-suite deep method references/test-audit.md — value bar, authoring gate, junk-pattern sweep, retention bar, per-candidate evidence, discovery lanes, and whole-subsystem campaign (per-test R/F/C/D ledger); wired into SKILL.md variant dispatch, playbook § 4, and the full-audit scope variants.
• Added the four canonical audit command definitions with bounded scaffold/promotion writes and the existing secret and supply-chain scanners.
• Routed the audit CLI identities through the shared command definitions and added fixture-backed family coverage.
• Test-authoring audit check: codebase, test-suite and PR reviews now report incidental, source-shape, wiring or environment-constant assertions with the conclusion “delete, or replace with a product-behaviour assertion”. Aligned implementer and reviewer contracts include the four PR #280 counter-examples while preserving product-behaviour assertions and fails-first regression defences; rejected assertions are never renamed or re-pinned.
• PR-review score is now a diminishing-deduction score with bands. computePrTally deducts per finding within a class — must-fix 45 then 15 each additional; should-fix max(12 − 3·(n−1), 2) → 12,9,6,3,2,2…; nit 2 then 1 each (class cap 8); unverified 5 each (class cap 15) — floors score_pct at 0, and annotates the result with a score band: mergeable ≥ 90 · good 80–89 · pass 60–79 · fail < 60. Verdict derivation is unchanged (count-driven, 3 tokens) and score/band never override it. New engine exports PrScoreBand / PR_SCORE_BANDS / scoreBand(); PrTallyResult gains band.
• The chat display header is now {verdict} · {score_pct}% ({band}), and the posted report's Verdict heading reads · Score <score_pct>% (<band>) — the derived number is labeled Score (the per-finding - **Confidence**: evidence field is a different concept and stays unchanged).
• mstar pr-review validate-report recomputes score_pct from the same locked schedule (no second formula), and mstar.review/v1 envelopes accept an optional tally.band — absent stays valid, present must be a valid band token. The envelope payload schema/help advertises those tokens, and MstarReviewV1.tally uses a band-optional envelope tally shape (MstarReviewTally) so legacy band-less envelopes still typecheck.
• Updated mstar-audit/references/pr-review.md (deduction schedule table, band definition, worked-example check table, display contract), commands/amazing-pr-review.md and docs/commands.md.
• Agent-first CLI operability (#393): --help, schema, and admission now derive from one shared registry contract (118 commands observed in the runtime tools/list); missing input produces one aggregated refusal listing every missing field (path/code/expected/received), the minimal required set, safe defaults, conditional/alternative facts, helpRoute, and recovery on both CLI and MCP.
• Error fidelity (touched families: session, milestone, pr-review, audit, dashboard, status, workflow): engine-authored code/message/details travel verbatim on the refusal paths this plan touched. Malformed attestation/proof/evidence/policy causes are sanitized: real parser grammar and the parser-reported location survive while submitted operands and secret-shaped values are withheld — verified per runtime with actual Bun 1.4.0 and Node 24 malformed inputs, not universally. Schema-unsupported refusals report highest applied schema, supported maximum, and first unsupported migration as three distinct machine facts.
• Public operations: workflow-note.append/workflow-note.coverage join the canonical registry on CLI and MCP; an ambient MSTAR_HOST_SESSION_ID or launcher-minted identity satisfies the caller-context requirement without --session-id (verified on the built bundle), explicit selectors keep precedence, and no-identity/malformed selectors refuse without writing. issue.* mutations publish numeric revision CAS, refuse blank replay ids, and return the generated id in the receipt. workflow.evidence publishes the per-delivery-kind file-content contract with record-time revisability and close-time freeze.
• Terminal recovery & native coordinator: workflow.adopt-terminal settles unregistered ACTIVE sessions via optional operator attestation with addressed-target completeness and per-operation file recovery (POSIX error codes retained); read-only store opens converge across the Bun writer-close window (bounded retry, persistent corruption still refused). The registered mstar_coordinator contract binds/recovers ACTIVE schema-9 authorities with host-derived identity, aggregate refusals, and real loaded-entry provenance — evidenced on the SDK 18.3 adapter route only; it does not replace a running host's cached registration, and the guidance no longer promises reload-style replacement.
• Command admission now returns grouped structured diagnostics: every schema violation carries its safe field path, stable issue code, message and array index in details.diagnostics, so one call reports all missing or malformed fields instead of flattened messages alone.
• CLI parser errors name the field: missing arguments and option values identify the input field and the leaf help route (mstar <path> --help) when deterministic; unknown flags keep the honest parser diagnostic without a guessed field. Usage responses stay usage/exit 2, distinct from engine refusals.
• Plan writes use explicit plan addresses under the acquired workflow coordinator. Sparse own-context resolution retains structured diagnostics for actual scope, identity, token and state conflicts. Stopped-owner recovery names only the workflow coordinator and real stop attestation, never a per-row replacement.
• Usage-message construction for schema rejections is now bounded: when a rejected input produces more than 20 issues, the first-line message carries the first 20 causes plus an explicit …and N more issues pointer, while details.diagnostics keeps every diagnostic (uncapped, with the established secret-shape redaction). The rejected summary field reports only the first cause's flag/expected/received facts; the full per-issue facts remain in details.diagnostics.
• Top-level CLI and command refusals share one envelope with help routes and recovery guidance; input-schema failures flow through central validation, root-union guidance is preserved, and schema discovery publishes truthful coordinator and plan recovery token kinds.
• Added runtime payload schemas and mstar-harness schema <TypeName> output; issue and plan payload help now points to its matching schema.
• Aggregated issue and covered plan payload validation so one refusal identifies all malformed and missing fields.
• CLI command surface: non-installer commands are now generated from the canonical @mstar-harness/commands definitions. mstar init remains the installer. Parser failures return a version-1 usage envelope and exit 2; command outcomes keep their documented exit codes, including SDD task 3 and child 124/127/128+n.
• Runtime session selectors and generated bundle: plan.bind uses runtime invocation identity instead of a request field, declared CLI session selectors reach the handler context (including the multi-value workflow recover-coordinator --stopped list), and packages/commands/dist is generated locally rather than tracked.
• Preserve structured engine details while deriving refusal help metadata; cover omitted usage/refusal defaults.
• Unknown MCP tool calls now return a close tool-name suggestion when available and direct callers to tools/list.
• Added coordinator-only mstar session run --workflow W --role coordinator [--harness H] -- <argv>: child-local identity replaces spoofed/legacy inputs, inherits stdio and propagates exit/signal. Session recover replaces the explicitly stopped workflow coordinator under acquired identity and stop attestation.
• Plan file/ACTIVE transports remain disjoint. Current coordinator context may be derived for ordinary actions; explicit session reference/token/operation inputs remain constraints. Mixed authority or numeric ACTIVE expectations refuse before payload IO.
• mstar workflow register / iteration register publish through the atomic DB registration, workflow evidence records the delivery transition and status workflow-close performs the terminal lifecycle transition — no file close, no unregister step and no --ended-at rewrite survive on the active route. The closed phase / lifecycle / execution-policy / integration-worktree grammar joins the existing mstar workflow group.
• store execution restore-preview and restore use ordinary store backup images for disaster recovery; export reports live execution state. The staged execution migration faces (preview, apply, activate, retire, abort) were removed. store activate remains only the issue/catalog migration step.
• status validate reports the root and per-workflow execution tokens the active writes consume as their CAS, so a caller passes --expect from a read instead of inventing one.
• A coordinator bind retry under an explicit operation id is now the recorded replay. bindExecutionSession takes an OPTIONAL expected and resolves the workflow's current token from its own header inside the write transaction; the bind request fingerprint carries the freshness-omitted marker instead of a freshly derived token, so the unchanged retry of {workflowId, operationId} after the first commit's revision advance is served as the replay rather than execution.operation-conflict. A SUPPLIED token keeps its strict-CAS semantics: a stale value still refuses execution.stale-token, and the same operation id with a different supplied token stays an operation conflict.
• The host-owned mstar_coordinator ACTIVE bind forwards an omitted expected as omitted (the engine resolves it) and mints the operation id when the caller names none; its recover arm still reads the current token from the addressed authority because recoverExecutionCoordinator requires an explicit one. The registered tool description, parameter advertisement and the mstar-host OMP reference state the same contract.
• Incompatible-store FILE recovery keeps its engine facts and loaded-module provenance. The stored-target reader's §4.3 authority veto carries the original thrown StoreError, and the FILE recovery boundary projects it through the shared engine-refusal path, so a store.schema-unsupported refusal reaches the caller with its three schema-version facts, loadedEntry and the incompatible-loaded-build guidance — the same fidelity the bind / show-recovery / ACTIVE-recovery branches already provide.
• Coordinator identity is acquired, never generated. A fresh coordinator bind now requires an explicitly acquired session id: the engine refuses an omitted id with coordination.identity-missing before any write instead of minting a UUID, and plan bind --coordinator no longer accepts the inherited MSTAR_HOST_SESSION_ID as authorization. Plain local operators pass --session-id; managed host sessions use the new host-owned tool.
• One adapter-only ExecutionIdentity type (packages/engine/src/session-identity.ts): the (canonical harness root, workflowId, role, planId, sessionId) tuple plus validateExecutionIdentity, shared by engine, CLI and host adapters instead of a second per-consumer shape.
• New host-owned mstar_coordinator tool (bind): the extension derives the native session id from the host and the canonical control root from the host cwd, refuses leaf/scoped-plan callers, and accepts no session id, root, caller role, authority flag or credential path.
• Retired the blanket bare-bash env revision. A managed plan bind --coordinator attempted through bash/functions.bash is blocked before shell execution with a redirect to mstar_coordinator; unrelated shell calls are unchanged and an absent or unsupported env field no longer produces an input revision.
• Added the audited JSON Prepare coordinator recovery (showPrepareCoordinatorRecovery / recoverPrepareCoordinator, prerequisite contract §3.3): it replaces a workflow's recorded coordinator binding when the recorded owner can no longer authenticate — the state a cancelled host handoff leaves behind. It is deliberately NARROWER than the existing active-DB recovery (execution-workflow.ts), which keeps its full execution token and stop attestation: no prepared-plan takeover, no lease transfer, no raw session rewrite and no force flag.
• The write is admitted only under the snapshot write lock and requires: file authority (an active execution authority refuses and names the existing DB recovery verb), a registered RUNNING iteration in this canonical root, a committed registration, a prior envelope that still authenticates the exact recorded coordinator, a freshly acquired identity addressing this workflow's coordinator seat, an explicit reason + authorization reference + a stop assertion naming that holder, both fresh byte versions, and the original prepareAdmission over every row. Every semantic refusal happens before a file is created.
• The accepted effect is one role-scoped envelope through existing exclusive creation, the top-level coordinator binding replaced, one immutable coordination.identity_recoveries audit record appended (operation id, request digest, both public session ids, authorization reference, reason, stop assertion, both versions, time — never a credential or envelope body) and updated_at refreshed. Rows, branch anchors, evidence and sibling workflows stay byte-identical; the prior envelope's bytes remain as history and stop authorizing because the binding moved.
• The snapshot schema owner (coordination-write.ts) validates the audit strictly and the ordinary writers pin it (dropping, rewriting or forging an entry through a generic snapshot write refuses coordination.direct-write-refused). A crash between the exclusive envelope creation and the snapshot commit reports failure — never a success receipt — and reclaims only the exact envelope that operation created; an exact retry returns the recorded receipt without revision churn, while a changed request, a stale token or a superseded binding refuses.
• New transport: mstar workflow recover-coordinator (explicit operator route, exit 2 for usage, 1 for refusals) and the host-owned mstar_coordinator tool's show-recovery / recover operations, which derive the native session id, the canonical control root and the recorded prior holder from host/engine facts — never from the call. The public projection is §3.3's list only: the coordinator envelope/credential path stays in coordinator-owned transport, so the CLI's JSON and diagnostics never print it, and every stop-assertion entry must be a public session id (single safe path component, bounded length) before it is hashed, stored or echoed.
• Reviewed-token integrity is closed on all three seams: the recovery re-reads the compass immediately before its commit (a concurrent compass edit refuses stale and reclaims only this operation's envelope), crash cleanup unlinks a leftover envelope only while its bytes still equal the ones this operation wrote (a replaced path is left untouched), and a create-only generic snapshot write may not carry coordination.identity_recoveries at all — recovery history is provenance, not shape.
• Identity-missing refusals name the supplies verbatim. Every active route that refuses for a missing session identity — plan bind in all its forms (coordinator, identity session, sparse, resume), plan show, sparse plan operations, and workflow transitions/evidence/recovery — now states the exact supply paths in the refusal: CLI --session-id (or MSTAR_HOST_SESSION_ID), MCP: the host passes sessionId per call. The ACTIVE registration refusal was reshaped for the optional-creator contract: only expect and operation can be missing, and its text explains that an unset identity registers a NULL creator the first coordinator bind adopts.
• mstar doctor --target omp now reports real plugin alignment. The doctor's pluginVersionNote is fed by a new detectPluginVersion effect the CLI supplies from the existing per-host discovery (for omp: omp plugin list), so the stale-plugin guidance ("CLI X is newer than installed plugin Y — update the Morning Star plugin: omp plugin install @mstar-harness/omp") and the not-installed note reflect the actually detected version instead of always claiming no plugin was found.
• ACTIVE registration no longer requires a session identity (issue #383c). workflow register / iteration.register over the active DB route accept a caller with no session id and write a NULL creator_session_id; an explicit id is still recorded as attribution when the transport supplies one. The trust boundary is unchanged and now tested end to end from real unset-identity creation: the first coordinator bind adopts a NULL-creator workflow once, later adoption is refused once any coordinator record exists, and the creator fence plus duplicate-holder/holder-matching gates are untouched.
• validateExecutionIdentity gained one explicit registration-only relaxation (allowUnsetSessionId): the normalized empty string passes as "unset" for the create path, every other consumer keeps the acquired-identity rule.
• Reworded registration refusals to disclose state and the supported next action.
• MCP session identity: the MSTAR_HOST_SESSION_ID environment fallback has been removed from the MCP resolve path. Identity-consuming commands such as session.recover take the main-conversation session id solely via their explicit per-call sessionId input (the CLI --session-id flag / MCP schema field — parity that already existed); the existing fail-safe refusal when the parameter is absent is unchanged. MCP-invoked identity tests now pin the identity-gate-specific refusals, the wrong-session ownership refusal, and real CLI parse/routing.
• Ambient environment identity no longer blocks legacy mstar plan bind --resume; that route ignores ambient env and refuses declared identity (--session-id or host-supplied).
• Routed every registered-plan pointer through the ONE path resolver (prerequisite contract §4): resolveRegisteredPlanFile / PlanPathError are exported from the engine barrel beside planDeclaredHeaders, so registration, the Prepare append and later readiness share one parser instead of restating the {PLAN_DIR}/<plan-id>.md convention.
• mstar iteration register now persists the canonical absolute plan path in the snapshot instead of copying the caller's spelling, and the catalog registration preflight resolves and refuses an iteration row pointer before the first prepared journal row — a repository-relative .mstar/plans/<id>.md input is refused (received form, base, expected canonical target, permitted forms) with no root, snapshot or journal write; the normalized request is what gets hashed, stored and handed to the producer, and the shipped transport derives its default operation id from that same normalized workflow, so equivalent spellings of one target share one operation identity.
• The Prepare appendPlans pointer check consumes the same resolver (its private fence-aware parser is gone); the invalid-plan refusal vocabulary and codes are preserved and now carry the resolver's typed path detail, and a missing/non-string append pointer refuses with that code instead of escaping as a raw path TypeError. Standalone/audit catalog location schemas are unchanged.
• The resolver settles the pointer's shape before any path API sees it, so an exported-contract caller (a JavaScript caller or a decoded payload) supplying no file, null, a number or an object is refused with plan-path.invalid-pointer — naming the received type, never the rejected value — rather than a raw Node TypeError it cannot map onto its own domain refusal.
• Extended the guarded Prepare workflow amendment (amendPrepareWorkflow / mstar workflow amend-prepare) with the optional correctPlanFiles list (prerequisite contract §4.1): each entry names one existing Todo row by the exact pointer it holds now (expectedFile) and that row's own canonical plan file (file), repairing a malformed repository-relative pointer without a raw snapshot edit. appendPlans stays present — a correction-only call passes an empty append array.
• A correction moves only the addressed row's file (plus the ordinary updated_at); every other row field, the root register and the review documents survive by value. It refuses an unknown or ambiguous row, a mismatch between the row's pointer and expectedFile, an old pointer that does not identify that same plan, a no-op pointer, an id that collides with an append or repeats, and a corrected pointer the shared resolveRegisteredPlanFile refuses — all without writes, under the unchanged coordinator identity, Prepare/no-execution admission, double byte-version CAS, exact compass plan-id set and last-moment compass recheck.
• The old pointer is accepted in only two forms: one the shared resolver accepts (canonical absolute or normalized harness-relative), or the exact repository-relative spelling derived from this control root's configured plan directory and the repository root that owns it. A foreign absolute path, a same-basename guess, an unrelated directory prefix and a copied plan document with a matching header all refuse; normal registration and readiness still do not accept that spelling.
• The Phase-1 readiness checkpoint now consumes the shared prerequisite seams instead of its own path/base logic (prerequisite contract §4/§5): every registered plan row pointer is resolved through the ONE resolveRegisteredPlanFile resolver (the same one registration and the guarded Prepare correction use, including a .mstarc-declared or external {PLAN_DIR}), and the coordinator identity verdict is read through the engine's own read-only showPrepareCoordinatorRecovery view.
• Refusals keep the frozen broad codes callers depend on (binding-invalid, prepare-not-locked, …) and now carry a typed diagnostic that names the §5 subreason, the subject, the safe identity-source label, the public ids already in play, the canonical base/target of a plan pointer and the next supported operation. Identity detail distinguishes identity-missing, identity-mismatch, foreign-owner, recovery-not-prepare, recovery-stale and recovery-unauthorized; path detail distinguishes plan-pointer-invalid, plan-identity-mismatch and a genuinely prepare-unlocked.
• A stale stored pointer (the pre-contract .mstar/plans/<id>.md spelling) is therefore never rendered as an unlocked compass: it keeps its own path detail, and readiness never normalizes or repairs the row — the guarded Prepare plan-file correction remains the operation that repairs it.
• The registered model-handoff tool forwards those diagnostics verbatim into its not-ready details and names the typed reason and the next supported operation in the refusal text. Diagnostics render public ids, codes and canonical plan pointers only: never an envelope path, credential, session JSON or environment payload. A refused plan pointer is therefore classified by its received form (canonical absolute or harness-relative) instead of the value it held, and a receipt/row disagreement reports only the canonical expectations — a malformed stored row can no longer project an arbitrary absolute path.
• Hashes are provenance, not gates. Remove content-hash and canonical-serialized equality refusals across prepared documents, submitted evidence, workflow/catalog/roadmap operations, migration/coverage/activation, recovery and stored schema records. Ordinary document edits no longer require restoration, adoption, resealing or re-signing; recorded digests remain historical information.
• Keep real constraints. Same-operation-id/different-request replay conflicts, current semantic scope/owner/QA/state/path requirements, numeric revision and execution-token constraints, and actual Git delivery facts remain. Remove obsolete byte-version, manifest/coverage hash and restore-loss digest admission inputs without adding bypass or replacement-seal protocols.
• Align canonical CLI/workflow/evidence guidance and add four targeted routing scenarios with semantic negative controls; generated host assets continue to derive from canonical sources.
• Accept equivalent session-reference and execution-token key JSON without byte canonicalization. Preserve interrupted ledger tails instead of truncating or refusing them, and retire only reviewed index rows while preserving added rows and narrative content.
• Add a bounded architecture check for hash, raw-byte and canonical-equality refusals/assertions, with operation-id lookup evidence required for each replay exception.
• Remove persist --expect-version, Prepare recovery/amendment byte-version inputs and store execution restore --accept-loss-digest. Removed extra-primary launch admission is not replaced by another seal.
• Restore compares authorized loss row identities/revisions and operation IDs, inventories and installs one private backup image, and retains fresh pre-restore safety backups. Re-preview is needed only for newly endangered work or authority generations, never for a changed digest.
• Legacy migration derives current source data under its root lock, preserving workflow/plan membership and current coordinator ownership. Deleted launch reservations have no replay/repair successor.
• State persist write replacement semantics in help, update obsolete hash/CAS expectations in consumer tests, and escape non-ASCII code literals for bundled CLI execution.
• Validate recovery-point paths before staging the image so missing/unreadable points return typed refusals with public backup/preview recovery. Rebuild the committed ZCode hook bundle from the current engine.
• Keep the retained ledger descriptor open through commit so inode reuse cannot mask a replaced destination; clear stale migration ended_at fields while preserving authored notes. Keep actor-only mutation scenarios independently isolated instead of grouping thirteen CLI processes under one timeout.
• Recovery-first engine surface. Exported lifecycle operations (mutatePlanCoordination, mutateExecutionPlan, mutateExecutionWorkflow, amendPrepareWorkflow, the registration producers and the closes) accept a sparse intent — omitted redundant selectors, revisions, session projections and copied metadata — resolved against the caller's trusted root, its durable association and recorded declarations, with transaction-local inputs staying strict. Published resolvers: resolveIntentRoot, resolveIntentTarget, resolveCurrentAuthority.
• One recovery sidecar on every outcome. A successful value carries recovery; a refusal carries the same object under error.details.recovery (outcome, applied, unresolved, resolvedFrom, warnings, commitState), so a partially applied compound intent is never reported as a mutation-free refusal.
• Semantic replay instead of transport freshness. A repeated intent is a current success with no revision, receipt or byte churn; a revision that moved without the intent changing is a drift warning rather than a refusal; a genuinely different payload or target still refuses.
• Registration derives its own identity. derivePlanRegistration and deriveLifecyclePhase derive a plan's id/title/pointer and an iteration's phase with the selected document as the authority; an interrupted registration finishes its missing link on retry and a phase-less iteration is derived on read.
• Prepare amendment commits per component. Independent components land and withheld ones report one minimum decision each in the stable append plan <id> / correct-plan-file <id> / integration-worktree <path> / execution-policy <value> vocabulary — one partial receipt per call on both authority routes, no applied component applied twice on replay.
• Every declared lifecycle state has a writer, on both routes. Evidence recorded before a row is Done completes the report-only tail; closeFileWorkflow is the file authority's one close verb and the DB route composes the same intent on one handle; explicit failed/stopped outcomes are recordable on both routes, settling only owned claims of non-live holders and preserving the first ended_at.
• Additive engine exports only. New: closeFileWorkflow, the intent resolvers, phase constants, CloseWorkflowOutcome and the resolution/derivation/close types. No export renamed or removed.
• CLI and MCP recovery transports. The CLI and stdio MCP share the command registry and return the same versioned outcome envelope for recovery-sensitive commands; MCP tool schemas expose the registry's payload contracts, and the smoke probe runs against isolated file and SQLite roots.
• roadmap replace states its own comparison basis. --expect-project and --expect-roadmap are irreducible caller claims; an omitted claim is one aggregated usage refusal naming both flags, and a stale claim refuses roadmap.revision-conflict with nothing written (the guard no longer compares the authority against itself).
• MCP tool schemas no longer advertise fields the handler does not read, and a declared string-or-null payload field (IssueTriage.owner) keeps its type instead of degrading to z.unknown().
• Cancellation during a dashboard start stops the listener it created instead of leaking a connection-scoped service; a handle another call already owns is reused and left running.
• plan issue-add derives plan-owned project association per finding and reports independently invalid entries with their array indexes before capture; DB capture and plan linking stay composed in one transaction with occurrence keys as stable event identities.
• Declared per-kind persist.write payload schemas; aggregate status validation failures surface through the persist command while coordinated replacement/version-conflict handling is preserved.
• Retired the judgment review-advice route; the historical judgment submit intent has no registered command. ReviewDecisionPack-owned fields are derived and multiple missing pack paths surface together only in the retained judgment APIs.
• Documented mstar-harness schema discovery for issue capture/occurrence/triage/closure/link and plan progress payloads; disposition-specific fields are checked before writing, not guessed through repeated refusals.
• Test corpus cleanup. Every inventoried package corpus (engine, cli, commands, omp, opencode, judgment) was swept under one written keep/delete rule: assertions pinning source shape, wording/help prose, forwarding echoes, duplicated registry copies, exported arity or environment constants were deleted, not renamed or re-pinned; consumer-visible behavior, boundaries, atomicity, authority, replay and actionable diagnostics were retained.
• Development acceptance stays isolated. Acceptance language aligned with isolated product-behavior proof rather than live provider, authenticated host, installed artifact or device receipts; separately authorized operational verification remains independent.
• Native model-handoff preference off is a success-shaped no-op with a neutral notice at both direction-lock and phase-1-lock; enabled handoff still checks coordinator identity and actual readiness.
• Allowed sparse active workflow mutations and workflow close to derive current tokens and generate one operation id when omitted; explicit session references and tokens remain constraints.
• ACTIVE cleanup reads the authoritative store; a launched minted coordinator identity takes precedence over ambient identity without granting unrelated workflow authority.
• Execution authority lives in store.db: ordinary primary-coordinator prepare/progress/complete and workflow transitions use atomic SQLite transactions, CAS and receipts; per-row PM identity/transfer/execution-lease admission is removed.
• Registration atomically publishes catalog delta, ordinary workflow/row metadata, root membership and receipt. Catalog edits do not silently relocate registered plan pointers; no sealed Assignment is required.
• Added the authoritative execution read route: workflow/plan state is read from the store in one read transaction, and a missing, staged, corrupt or busy authority refuses (execution.consumer-not-ready) instead of degrading to leftover root/snapshot JSON, newest-workflow guessing or dashboard projections. While the authority is active the retired file writes are refused at every entry boundary.
• Replaced the staged execution migration preview/apply/activate/retire/abort protocol with the single static mstar store upgrade --operator <name> path: it opens or creates the store, imports recognizable stopped-workspace state and activates authority in one run, leaving skipped source bytes in place. Standalone backups freeze the file-native bodies a SQLite copy does not carry (ledgers, identity index, cursors, history chunks, selection body) together with their accepted-record identities.
• Completion is witnessed by a sealed Git proof instead of refs alone (checkout/git/common-dir identity, HEAD and its refs, the index, every tracked path's content and mode, the directory listings a new untracked path changes, merge/rebase sentinels, the object inventory). It is re-read from the filesystem with no child process and no await immediately before the completion transaction, so a worktree, index, untracked or object-store change inside that window refuses without a Done, a receipt or a released lease.
• Added the execution coverage substrate: a closed 18-surface inventory with a byte codec per surface, and a validator that recomputes coverage from the retained bytes — hashing every named witness and deriving each result hash from what the bytes say — so an invented result, a changed byte, a borrowed or unpinned witness, a foreign workflow identity or a mislabelled capability refuses as execution.coverage-incomplete.
• An injected ArtifactStore (setArtifactStore / --store / MSTAR_STORE_MODULE) is served behind a guard that refuses the root register, a workflow snapshot and their json aliases while the canonical control root's authority is active; the control root is resolved from the process, never from the injector's own claim.
• Updated mstar-artifacts references/status-and-residuals.md: the transport split (active DB authority vs pre-activation file route) is now stated where the v2 file shapes, lease fields and lockdir prose are introduced, instead of only in the later coordination section — remaining snapshot-as-SSOT references are scoped to the pre-activation transport or legacy history.
• Canonicalize active workflow registration's catalog plan path relative to the plans root, accepting canonical absolute plan paths without changing the execution resolver input.
• Coordinator recovery is an explicit attested bootstrap: it names the prior holder, adopts only the ownership that revocation orphaned, and never revives an old-epoch lease.
• Source readiness does not switch installed consumers, bump version surfaces or claim live activation or release. The committed ZCode hook bundle hooks/mstar-write-gate.mjs is rebuilt from the current engine; installed fencing and consumer refresh remain separate operational work.
• Kept standalone backup recovery (store backup, store execution restore-preview, store execution restore) and live-state export (store execution export) independent from upgrade.
• Added whole-store recovery (previewExecutionRestore / restoreExecutionBackup / exportExecutionState): the backup carries committed WAL-visible work, restore internally checks authorized loss row identities/revisions and operation IDs and retains a fresh safety backup, and the diagnostic export is inert and credential-free. No caller-supplied CLI loss-digest flag is required.
• CLI/session/host writes use independently acquired workflow coordinator identity with explicit plan addresses and checked or derived current transport context. No per-plan PM identity or child transfer survives.
• Kept the file forms only in explicitly labelled pre-activation sections that also state an active authority refuses them; no active instruction tells a reader to hand-edit a snapshot or to treat a legacy envelope as the live route.
• Made the session reference a lookup rather than a bearer credential: it names a stored row and grants nothing without the caller the engine compares inside its own transaction, and a reference, an expectation value or an operation id is never forwarded into a child assignment. Resume is not recovery — a stopped owner is replaced only by the explicit recovery verb on an active authority, or by the guarded Prepare recovery on the file route.
• Host specifics moved to their owning host references and were sourced from the reviewed implementations; the DSh README pair was realigned on the ledger identity/dedup authority, the durable cursor and the archived display tail.
• Added two vocabulary entries to CONCEPTS.md: Consulted header set (a label-keyed plan parser consults a closed, exactly-matched label set — never a prefix, so a descriptive sibling such as Working branch policy cannot alias a consulted field) and Maintenance exclusion (the single outermost lock an engine lifecycle operation holds so no cooperative writer in any package can append into its window; a coordination discipline, not an authority).
• Documented the shipped coordinator identity routes in the skill corpus: the host-owned mstar_coordinator entry (bind, show-recovery, recover), the local plan bind --coordinator --session-id form, the mstar workflow recover-coordinator verb, and the registered-plan pointer forms. The corpus separates pre-activation routes from active-store DB recovery (full execution token + stop attestation) and native one-shot model handoff (mstar-host/references/omp.md, mstar-use-cli/references/plan-and-workflow.md, mstar-use-cli/references/preconditions.md).
• Registered plan pointers are documented as the canonical absolute {PLAN_DIR}/<plan-id>.md — a canonical absolute or normalized harness-relative input is accepted, the repository-relative .mstar/plans/<id>.md spelling is refused before the first journal/snapshot/root write — and the guarded correctPlanFiles correction is the same-row repair, changing only row.file plus updated_at under the existing Prepare admission and current semantic/revision constraints, not obsolete byte-version inputs (mstar-artifacts/references/status-and-residuals.md, mstar-iteration/references/phase-1-prepare.md).
• Workflow coordinator identity is explicitly acquired; public recovery output contains safe facts, never envelope paths/body. No Assignment or row identity is a binding input.
• Documentation alignment itself changes no source behaviour, flag or refusal code and claims no installed generation, released verb availability or operational handoff.
• Removed status.json from the engine compoundRefreshScope allow-list (its ACTIVE file-route guard refuses that path); regression coverage asserts the narrowed scope and the ACTIVE refusal through the real write port.
• Appended the Amendment 2026-10-06 — ACTIVE store execution authority to the frozen plan-workflow lifecycle contract: store registration/close seams primary, file routes as pre-activation/engine-absent fallback.
• Closed the knowledge_refs carrier decision on catalog relations (mstar catalog link); snapshot plans[].metadata.knowledge_refs labeled legacy read-only across artifacts/compound/compound-refresh.
• Added execution-authority state and the supported upgrade entry to status validate; clarified route-scoped tokens and plan-file addressing.
• mstar store upgrade --operator <name> is the sole default execution-state upgrade: it opens or creates the store, imports recognizable records in one run, activates authority, and returns one result with skipped items. Unknown and unresolved sources remain at their original paths; no attestation, inventory, staged manifest, coverage gate, activation barrier, or command-owned recovery point is required.
• Removed store safe-upgrade and the staged execution preview, apply, activate, retire, and abort verbs. Standalone store backup remains; execution restore-preview, restore, and export remain as independent backup/disaster-recovery and live-state reporting utilities.
• Canonical store administration: CLI and MCP store operations now accept the project's canonical control root through explicit --harness selection or normal project discovery. Backup verification, maintenance locks and migration/activation attestation guards remain in force; command help documents the supported target.
• Store-upgrade migration retirement now requires current snapshot or root execution evidence; stale journal history alone no longer qualifies.
• Added workflow adopt-terminal to record an adoption receipt for an unregistered workflow header, with a revision CAS and truthful status reporting.
• Restrict the mstar persist family to review and json; engine status and snapshot kinds remain internal to the migration path, whose permanent consumer is migrate.ts.
• Retire the coordinated artifact read/replace chain and its public exports. The coordinated purge-entry veto remains deferred to the T21 terminal sweep.
• Registration replay no longer answers over a terminal lifecycle snapshot: during the close window (terminal snapshot on disk, root entry still present) a committed registration refuses with catalog.registration-terminal-lifecycle; committed reconcile replays apply the same guard. Let an in-flight close finish; if it was interrupted, run mstar status workflow-close --workflow <workflow-id> --harness '<harness-root>' to finish unregistering, then retry the registration. Ordinary plan-row progress replays still replay the committed receipt (#323).
• Dashboard views: Workflow and iteration views now read from the execution authority on ACTIVE harnesses instead of refusing the request. Fixes #354.
• ACTIVE projection: Removed an unreachable synthetic plan validator and redundant lease queries; completed plans with retained released leases remain visible without historical ownership.
• Added the file-native workflow notes ledger (appendWorkflowNote): one canonical line per note, appended under the execution-maintenance exclusion and the per-workflow status lock, with the synchronous current-session assertion as the last step before the fsynced byte write. Migrated legacy lines and the inline plan notes stay byte-for-byte preserved — nothing rewrites, reorders or compacts a retained ledger, and no note becomes a DB event.
• A note's identity is the caller's stable id: the same id with the same body replays without appending, the same id with a changed body refuses, and an id already recorded elsewhere refuses instead of picking a winner. A crash-cut partial line of the record being written is reconciled into exactly one accepted line; an unaccepted prefix that follows the record's own accepted line is healed by removing that prefix only; an unterminated tail that is not that record's partial refuses with every retained byte left in place.
• The retained leaf's trust decision is its open: O_NOFOLLOW plus a re-verification of that same descriptor's device/inode and its bytes, so a leaf swapped for a symlink, replaced or removed between the read and the commit refuses instead of being followed, truncated or written through.
• Durable writes complete a short write (a capacity-limited descriptor can accept fewer bytes than it was given) and refuse a write that accepts nothing, in both the ledger append and the atomic-replace helper.
• The DSh agent-flow ledger now derives every new row's identity from verified native facts — the log's verified incarnation plus the carrying session and call id — makes the accepted-identity index the dedup authority and the cursor sidecar a per-incarnation scan bound, and keeps the append, the identity commit and the scan-bound advance inside one shared-lock critical section. Display compaction is a single transaction recorded in a transient journal (before/after tail hashes plus the exact archive range), and evicted lines are archived byte-exact into sealed history chunks before the display tail is rewritten.
• Both agent-flow write paths take the same execution-maintenance exclusion as the engine's activation, restore and migration before their own lock, so a plugin write inside that window is refused with a bounded advisory instead of landing in a directory that is being rewritten.
• Exported the lifecycle-branch fact type from the engine package entry point for the commands consumer.
• Removed the retired file-route Prepare recovery suite and lease.verify-integration setup-verb test cases; surviving L1 lease coverage remains in worktree check.
• ACTIVE iteration registration now canonicalizes compass references to harness-relative paths and refuses paths that escape the harness, including through symlinks.
• Replaced retired recovery instructions with ACTIVE status/token reads, coordinator recovery, and an actionable failed-close/re-register route for a missing delivery kind.
• mstar worktree check --entry admission is now workflow-type specific: a standalone plan workflow requires only the source/target anchors its registration records (and uses target for main-worktree residency), while iteration workflows keep the required base/target/integration anchors plus the integration-checkout validation. Missing-anchor refusals now give per-type, achievable recovery instructions.
• Audit-promote CLI fixtures assert the ACTIVE execution graph (single store initialization, activated token) instead of the retired snapshot/status.json projections.
• Made the status-write gate execution-authority-only and regenerated its bundled hook.
• Removed retired lease verify-integration assertions from the MCP identity test and retained the active worktree check surface.
• Inject acquired session identity into milestone.assign while preserving the optional checked session reference.
• Removed the retired empty status template fixture and its validation case.
• OMP: mstar_coordinator gained the active bind / recover forms that call the DB verbs directly under the host-derived execution identity, with show-recovery answering from the DB on an active root and keeping the unchanged Prepare view on the file route. The route is read from the addressed control root, never selected by a tool argument: a mixed or partial key set, an active form on a pre-activation root and a Prepare form on an active root all refuse before any IO.
• OMP: mstar_phase2 {operation:"bind"} takes no caller-supplied session path and adopts what the addressed root's own authority holds (the DB coordinator binding on the active route, the workflow's own recorded envelope on the file route). The durable record is version 2; earlier records stay readable as legacy history and are never upgraded into a DB binding, and an active binding always supersedes one.
• OMP: added a read-only hidden-history reader/exporter that classifies one session ledger by its exact hidden entry types, preserves every payload verbatim with its digest, and decodes only what a verified producer schema admits. An entry whose producer is unknown or whose payload cannot be admitted is retained in full and diagnosed rather than guessed into a session or another type, and the exporter refuses instead of exporting with evidence missing.
• DSh: session selection and exclusion floors persist separately from rebuildable engine-status emissions; only canonical execution-binding witnesses are stored, and a stale, revoked, missing, corrupt or scope-mismatched authority is refused without falling back to the root register or the newest workflow. The legacy target route survives only when no active authority exists.
• DSh: added the plugin-owned /mstar-execution human command (closed JSON adopt | clear | run) — identity comes from the carrying native session, known leaf/subagent seats are refused before any parse or harness probe, and run launches a shell-free child whose execution-identity transport is overwritten while every spoof and legacy key is removed.
• OpenCode: the execution identity is derived from the native hook session id plus an independently acquired scope, the session's own reference is learned from its CLI traffic and carried into a real shared-CLI invocation, and both legacy keys are removed while the root comes only from an explicit flag or the child's working directory.
• Inject the omp session's native identity into eligible Morning Star MCP calls and diagnose a missing ACTIVE-workflow identity injection path.
• omp now supplies the Morning Star MCP sessionId per call (issue #383a). The new mcp-identity extension (registered in omp.extensions) revises eligible mcp__morning_star_mstar_* tool_call inputs to { ...input, sessionId: <native id> }, so a standalone plan workflow chain — workflow register -> coordinator bind -> plan prepare -> progress — carries the calling session's identity without the agent passing ids by hand. Eligibility is schema-aware: a tool qualifies only when its declared ToolInfo.parameters schema declares sessionId (the host revalidates revised inputs, so an undeclared key would be rejected host-side); the name prefix is a prefilter only. Injection is additive-only: an explicit caller id is never overridden, block is never set, and the id is read per event from ctx.sessionManager.getSessionId(), so leaf sessions carry their own id.
• Restored host session identity injection for shell commands with an idempotency guard, keeping repeated revisions from stacking MSTAR_HOST_SESSION_ID exports without touching the env input.
• Changed the coordinator-visible OMP notice bar titles to the shared types: the phase-2 diagnostic notice and the model-handoff notice now send customType mstar:notice, and the bounded phase-2 advisory sends mstar:advisory (previously mstar:phase2-notice / mstar:model-handoff-notice / mstar:phase2-advisory). The bar header prints the sent type, so the visible title now matches the shared Morning Star notice family.
• Unchanged: the hidden durable ledger identities mstar:phase2 / mstar:model-handoff, their restore and dedup identity, the observed body workflow id/status/fallback, the delivery/continuation options and every machine refusal code (phase2.workflow-terminal included). A visible title rename is not a ledger or refusal-code change.
• Source-level change to the emitted values plus the matching host-reference paragraph; the emitted body states its own workflow status once. No installed UI, renderer registration, bundled host copy or publication is claimed by this entry.
• Removed the dead omp validator tool sources (src/tools/: mstar_iteration_gate, mstar_worktree_check, mstar_status_validate, mstar_lease_verify, mstar_path_resolve, mstar_dispatch_validate). The build stopped compiling and shipping them when the MCP stdio server moved into the CLI; the same capabilities are served by npx @mstar-harness/cli mcp through the packaged mcp.json (iteration.gate, worktree.check, status.validate, lease.verify, path.resolve, dispatch.validate). One scope note: the CLI path.resolve command resolves the four top-level directory symbols ({HARNESS_DIR} / {SPECS_DIR} / {WORKFLOW_DIR} / {PROJECT_DIR}); the per-plan {PLAN_DIR} / {SDD_DIR} and the {ITERATION_DIR} / {KNOWLEDGE_DIR} symbols follow the documented resolution conventions from {HARNESS_DIR} (engine resolvePlanDir / resolveSddDir / resolveIterationDir / resolveKnowledgeDir; SSOT mstar-conventions). Deleted the omp-side test arms that pinned them (execution-read validator suite, worktree-check, the store-cutover tool route, the bundle-smoke custom-tool probe) and the cross-package arms in packages/cli/test/tools-v2-smoke.test.ts; the omp tool_call pre-hook coverage is unchanged.
• Widened the optional host peer to @oh-my-pi/pi-coding-agent@^18.3.0 (any 18.x host) and moved the development baseline in devDependencies to 18.3.0, so the suite validates against the host users actually run. The exact 18.2.1 pin had already drifted from reality: hosts in the omp 18.3.0 line refuse any bash tool call whose input carries env without a service name (ready and env require a service name.), a parameter-surface contract this package's shell-transport code must respect.
• Upgraded the @deepseek-ai/dsh-* peer cohort to ^0.2.0-rc.2 (corridor dsh-v0.2.0-rc.1 → dsh-v0.2.0-rc.2: desktop menu-bar bundled dsh install, experimental async Q&A, model-picker fuzzy search, UX/desktop fixes, pi-ai → 0.87.1; deferred until npm published 0.2.0-rc.2). Session format v4 unchanged.
• Renamed the @deepseek-ai/dsh-* peers dsh-agent-presets → dsh-agent-preset and dsh-code-runtime → dsh-ptc-runtime.
• Migrated the planMode bridge from agent/session-start to serial agent/created.
• Bumped the dsh-llm-fallbacks devDependency 0.5.2 → 0.6.4 (first fallbacks generation matching the 0.2.0-rc.1 peer cohort); the engine DSH_LLM_FALLBACKS_VERSION pin moves with it. Route the live workflow picker through ACTIVE execution state, fail closed when dispatch-ledger targets are omitted, preserve alternate branch-form lease matching, and reuse one ACTIVE workflow-source read across dispatch gates and recording.
• Documented the issue/catalog SQLite path {HARNESS_DIR}/store.db and its authority split from execution JSON (ArtifactStore).
• Indexed the mstar issue … CLI family (verbs in --help; flags not restated in skills).
• Recorded CLI launch floors by entrypoint: Bun >=1.4.0 for the shebang, Node >=24.18.0 for explicit node on the CLI bundle — not a demand to install both runtimes.
• Added the catalog authority in {HARNESS_DIR}/store.db (migration 2): project/iteration/plan/document identity, paths, membership, spec/knowledge relations and catalog lifecycle are DB rows, while document bodies stay files and execution routing, leases and frozen inputs stay JSON.
• Replaced the maintained Markdown index obligations (iteration README rows, package Documents tables, specs/knowledge index tables) with catalog discover / import / register / query duties; completeness is a DB query, and a missing README is no longer a failure.
• Added the mstar catalog verb family (list, show, register, update, link, discover, import, export, reconcile) — verbs and flags live in --help.
• Added the registration journal: the snapshot/root writes and the catalog delta publish through one recoverable operation (catalog.registration-pending, recovered with mstar catalog reconcile), and a prepared plan pins its execution input to a catalog revision.
• Added disposable execution/roadmap projections (migration 3) with honest freshness and diagnostics, plus the withStoreRead read boundary and dashboard DTOs.
• Documented the cross-clone limit: store.db is local and gitignored, tracked bodies alone cannot rebuild local catalog history, and discovery reports explicit unknowns. Live index retirement and activation belong to the cutover plan.
• Landed the capture duty as settled by compass D18: a confirmed finding becomes an issue in {HARNESS_DIR}/store.db at the moment it is confirmed — capture records evidence only, disposition is a separate authorized act, and a recurrence appends an occurrence instead of opening a second issue.
• Made mstar-project-governance「Issue capture」the single authority (issue contract §6 verbatim): the seat that owns the confirmed outcome captures — the PM seat and a PR-review round's main agent at Stage 3 — while leaf audit/QC/QA seats return evidence and never write the store. The other five owner texts carry pointer landings only.
• Re-pointed the residual-register prose in the artifacts family (SKILL.md + references/status-and-residuals.md), mstar-audit (incl. the PR-review reference) and mstar-review-qc, and added the minimal delivery-loop sentence to mstar-harness-core: the register is migration history, open items are store issues, and mstar status tech-debt / mstar status findings-cleanup read the store. Retired register writers (mstar status backlog-register / backlog-close) refuse and name the issue verbs; skills never restate flags.
• Plan issue mutations use only the recorded workflow coordinator envelope or ACTIVE coordinator reference plus acquired identity and explicit plan address. Deleted per-row identities and their historical envelope aliases grant no authority.
• Dashboard rows scope by their own workflow (PR #266 review RV-1): projection plan/lease rows are matched by the tables' own (workflow_id, plan_id) key — the same plan id under a plan workflow and an iteration workflow no longer attaches the other workflow's lease, status, progress or pin revision in the workflows view or the iteration execution overlay.
• Symlink cross-harness register writes are vetoed (PR #266 review RV-2): a pre-activation register reached through a symlink that lands on another harness's active or unreadable issue authority is refused by the landed context (project.register.retired / store.authority-unavailable) in all three enforcing copies (ZCode hook, omp gate, dsh store-authority); both contexts pre-activation keep the §7 legacy register path.
• Catalog imports never leave a silent prefix (PR #266 review RV-3): a mid-plan importCatalog failure rethrows catalog.import-partial carrying exactly the applied receipts and the resume instruction — the applied proposals are journalled progress, and re-running the same reviewed plan with the same operationId converges to the full plan exactly once.
• OpenCode plugin declares its Node floor (PR #266 review RV-4): @mstar-harness/opencode engines now requires node >=24.18.0 (node:sqlite) alongside Bun, and the package INSTALL/README name the floor.
• Added DESIGN.md for the local read-only governance dashboard: light-theme tokens, four-view navigation, evidence/history presentation, accessibility and explicit empty/stale/error states.
• Added an offline mstar report draft generator with explicit caller-supplied fields, finite secret redaction, and a user review step; it does not collect local data or submit issues.
• Documented matching CLI and MCP report usage, absent/unknown values, and the meaning and limits of redaction counts.
• Issue writes are actor-only: every unscoped issue write verb, including link, records through the store without a session envelope or workflow requirement.
• Plan issue-add/issue-close use the workflow's primary coordinator and explicit plan address; plan/iteration link targets remain labels, not independently checked authorities.
• Workflow creator fidelity. Imported workflow creator identity is preserved, and first-bind adoption is limited to workflows with a NULL creator.
• Plan provenance is origin-scoped: only plan-scoped writers can create scoped membership; actor-only links remain unscoped, and historical provenance remains plan-scoped.
• Origin-dependent issue reads refuse outdated stores with the supported mstar store upgrade --operator <name> recovery.
• Removed the obsolete triageIssueExecution, closeIssueExecution, and linkIssueExecution exports from the engine API.
• The public IssueProvenance type exposes origin as "scoped" | "unscoped" for typed consumers.
• Issue revision conflicts now include recovery instructions that preserve the original invocation's --operation-id, --actor, and payload while replacing --expect <current-revision>; CAS help is available only for the issue verbs whose engine path enforces the revision CAS (triage, close, waive, duplicate, supersede, reopen, link).
• Added revision-guarded issue reopen for reopening terminal issues with an auditable reason and idempotent operation receipts.
• mstar issue <verb> --help now lists each payload field with its type and conditional requiredness, derived from ISSUE_PAYLOAD_SCHEMAS — e.g. references (requiredWhen: resolved) — replacing the opaque Payload fields: payload line (#420).
• Closure payload requiredness now follows the effective disposition end to end: --disposition overrides select the required fields at decode time, and static transport schemas keep disposition-conditional fields optional so composed MCP/CLI admission matches assertClosureAuthority (#420).
• Iteration registration now records phase-1-prepare and stores a harness-relative compass_ref: the producer normalizes an absolute in-root spelling to the contract form and refuses pointers that escape the harness root (symlink-safe), so every newly registered workflow is amendable by construction.
• Prepare commands recover legacy snapshots instead of dead-ending: workflow show-prepare reports derivable state (derived) when the phase label is absent or the stored compass pointer is absolute-but-in-root, and the next workflow amend-prepare adopts both in its ordinary locked write — a present non-Prepare phase is still refused, never rewritten, and real execution facts (leases, non-Todo rows) keep refusing first.
• Phase 1 writes land only in the gitignored iteration package: the §2.3 integration-worktree checklist step 7 (reached through iteration-start §6) now pushes only the newly created spec_integration_branch (git push -u; the branch tip stays at the recorded base, satisfying the phase-1-lock readiness check that the pushed remote tip equal the live integration HEAD — enforced by the omp model-handoff runtime). Phase 1 roles write compass / plans / the <iteration-id>/ package (specs in <iteration-id>/specs/) — all default-gitignored local artifacts; the global {SPECS_DIR} is written at Phase 3 iteration-close promotion — compound-rewritten directly into the integration worktree's tracked {SPECS_DIR} ({KNOWLEDGE_DIR} promotion follows the same integration-worktree write; the primary checkout carries only gitignored process artifacts) and committed into the integration branch by the §3.5 close commit — with the existing registration surfaces completed in the same step: package Promoted to: annotation, plan primary_spec / spec_refs + compass references, and catalog register / link (the registered path resolves against the integration worktree during close and PR review, and against every checkout after merge). Renamed the iteration-start / iteration-loop pre-commit checklists to pre-integration checklists (loop's phase-1-autonomous-start todo now completes on compass lock + integration-branch push), rescoped the §1.6 chain and writing-specialist corpus hygiene to the iteration package (iteration-artifact-boundaries.md / iteration-corpus-hygiene.md updated to the same boundary), and dropped the stale Phase-1 "commit" from the plan-mode bridges (_shared/plan-mode-bridge-core.md gate + anti-pattern row, cursor.md Phase-1 Plan-mode gate, cursor-/omp-/kimi-/zcode-plan-mode-bridge.md).
• Prototype-first preparation: interactive Phase 1 revises a retained plain-language visual HTML until the current design is explicitly approved before formal artifacts; autonomous opt-in retains an appropriate HTML/Markdown/JSON prototype for planning and traceability without routine human confirmation.
• Selected specialist review: PM reuses prototype contributions and selects product-manager/architect by remaining gaps; actual selected reviewers run sequentially with mandatory writing-specialist last, and OMP readiness accepts their ordered completion receipts.
• Removed the dead judgment review-advice command route; judgment runtime and shadow-supervisor APIs remain available.
• Exposed judgment runtime, audit, evaluator-channel, and shadow-supervisor APIs; made the shadow runner available as @mstar-harness/judgment/shadow.
• @mstar-harness/judgment: add shard-scoped author pre-dispatch gate (author-gate.ts, author-sink.ts, scripts/author-gate.ts) reusing the shadow supervisor Docker launcher pattern — provisions tool-less author inputs, runs deny probes for forbidden qualification paths, validates create-only sink scoping, and records supervisor access transcripts before Q2 shard dispatch.
• @mstar-harness/judgment: add seat-scoped annotation pre-dispatch gate (annotation-seat-gate.ts, annotation-sink.ts, scripts/annotation-seat-gate.ts) reusing the author gate Docker probe launcher — provisions tool-less seat inputs (brief + projected shard view), deny-probes forbidden qualification paths (other seat, crosswalk, gold, sources, authoring, protocol artifacts, tuner, model output), validates create-only annotation sink scoping, and records supervisor access transcripts outside seat reach.
• Judgment runtime: observing jev_mode=off during input collection now aborts active file and stdin reads, prevents further collection, and discards late read results.
• Judgment: Reject TypeSafe responses whose reported model does not match the requested native model.
• Fixed calibration shadow staging so citation files, inventory identifiers, and confined readonly runtime assets match the supervisor's contracts.
• Made the annotation projection test use a generated local fixture instead of maintainer-specific qualification evidence.
• Fixed shadow receipt reconciliation so required receipts are enforced while frozen-inventory omissions remain visible as incomplete work, without rejecting valid cancellation dispositions or treating zero-work runs as incomplete.
• Documented an optional, finite A05 shadow step in PR-review synthesis, preserving original vet, deduplication, rejected-candidate record, tally and posting authority when evaluation is off or unavailable.
• Added account-free component exercise guidance and an explicit synthetic-only evidence boundary; component receipts grant no Jev work credit and never count as named-host/W5 verification.
• Fixed strict TypeScript errors in the judgment package and aligned its declaration root with its engine import.
• Repaired the first red runs of the newly registered test-judgment / test-commands jobs: the shadow-supervisor confinement case probes its declared environment (Linux platform, listable /proc, writable /mnt/output, which the CI job pre-creates runner-writable) and a capability guard fails the CI run with the named missing capability instead of silently skipping the witness; the study-closure cases now run everywhere through the supervisor's public controlled-provider inputs over the real mailbox protocol (the live-provider witness remains a documented gap), two latent assertion defects they had never exercised were fixed (missing assessor evidence fields and unbalanced receipt accounting), and the synthesis-pack tests assert validatePack content equality (toEqual) since validation intentionally returns a normalized derived copy, not the same reference. The container/mount isolation semantics the study-closure cases used to exercise are NOT exercised by this rewrite (the test job has no configured container worker image/namespace launcher); what remains verified is the host-side capability probe and loud guard plus the supervisor's mailbox closure over valid requests and the assessor's refusals of failed or run-identity-mismatched study results. The controlled-mailbox integration test widens its worker poll budget (1s→6s), child cap (2s→the pilot's 10s ceiling) and test timeout, which a loaded CI runner outran (observed 1.1s round trip) without changing the lifecycle contract it witnesses.
• Development calibration recognizes a genuinely fresh frozen qualification root as a first run and loads prior-run manifests and request hashes from the newest per-run directory, preserving freeze identity checks.
• Freeze validation now rejects annotated corpus variants that lack a gold row instead of silently excluding their labels from coverage checks.
• Security: Removed worker CLI attestation based on caller-controlled environment values and filesystem shape. The shadow runtime continues to reject unattested evaluator channels before pilot/pack collection; worker-side submission remains unavailable until an authenticated launch adapter exists.
• Added CI test routes for the commands and judgment packages: both package manifests now declare test: "bun test", and CI runs each surface as an independent test-commands / test-judgment job alongside the existing per-package jobs.
• Corrected package release surfaces, hosted-install dependency specs, CLI option decoding, installed-host MCP doctor paths, request-scoped store selection, child stdin policy, and dashboard lifecycle cleanup; aligned CI consumers with the canonical command definitions.
• Integrated the stdio MCP server into @mstar-harness/cli as mstar mcp; host configs now launch npx @mstar-harness/cli mcp. The standalone MCP package, per-host bundles, and native bridges are removed.
• MCP health checks host configs, not per-host bundles. mstar doctor MCP inspection now validates each host's real MCP configuration file and its npx @mstar-harness/cli mcp launch entry (server entry resolved from command/args arrays), replacing the retired build-info.json/stdio.js bundle probes, and refuses runtimes below each packaged target's native floor. evidence.verify reports a failed assessment as ok data with an assessmentPassed flag instead of a refused envelope.
• DSH gains its Cordis MCP client row. The shipped dsh bundle patch inserts an mstar-mcp row (@deepseek-ai/dsh-mcp-client, stdio npx @mstar-harness/cli mcp, server name mstar) next to the plugin row; mstar-harness doctor --target dsh parses the profile's Cordis sources structurally (comment-proof) and reports aligned only with the bridge plugin installed. spawnProcess normalizes ENOENT to a deterministic executable not found in $PATH error, and relative dev-command args resolve against MSTAR_CLI_PROJECT_ROOT.
• Documented CLI-based MCP launch paths for the six JSON-backed hosts and OpenCode's plugin-injected config, plus the DSH Cordis YAML follow-up; recorded runtime prerequisites, doctor status meanings, host/session boundaries, and separate installed-host verification.
• Recorded the OpenCode V1 @opencode-ai/plugin 1.4.8 pin and removal of the global CLI fallback.
• Added the consumer-v1 source/package inventory producer (scripts/execution-consumer-manifest.ts): per consumer (engine, CLI, DSh, OMP, OpenCode, ZCode) it records the canonical build-input closure, the generated output closure, the entrypoint, the exact runtime target and floor, the declared capability and the copied-instruction trees each package bundles from the repo-root skills/, commands/, agents/ and assets/ corpus — reusing the existing build layouts instead of introducing a second build system. --write emits the manifests; --check re-verifies every written manifest against the bytes on disk without writing anything.
• The producer also publishes one per-consumer evidence document derived from the aggregate, so the handoff form cannot disagree with the operator-facing artifact.
• Assembled-package Node regression drives the built CLI's coordinator registration, binding, ordinary source/configuration/progress and exact retry; it compares public/store facts, current consumer manifests and committed ZCode hook stdin/exit behavior. It never launches a per-row PM.
• The regression states explicitly what it is not: no native host process, no installed binary and no TypeScript source import. Host entrypoints are covered by generated-manifest parity plus a populated OMP-shaped database fixture executed against the built engine generation.
• A .gitignore that already states any harness-root rule (.mstar or .agents, including a leading slash, a negation or a partial rule) is author-owned: scaffold, the install fence and doctor make no change at all — no append, reorder, dedupe or normalization, and the file bytes stay exactly as written. Unrelated paths and a lone .mstarc entry do not declare, and the custom-layout skip is unchanged.
• Added the exported hasHarnessRootDeclaration(content) predicate to the engine path module: a mechanical, read-only line scan that recognizes either layout's root rule, including a leading slash, a negation and a partial declaration, and introduces no glob, escaping or precedence semantics.
• validateGitignore now returns gitignore.author-declared for a declared file before any missing-entry computation and proposes no rewrite. A missing file stays gitignore.missing, and an undeclared file still reports the canonical entries it lacks. The canonical-completeness success branch was retired as unreachable, because canonical content is itself a declaration.
• Execution receipt payload slimming: graph-sized operation receipts (workflow creation, lifecycle transitions, terminal adoption) now persist a slim envelope — {slim, token, storeId, epoch, operationRecovery?} — instead of the full root graph, and replay re-serves the live data/token pair for those rows. Per-row size becomes a small constant (pinned by a bounded-size test) instead of scaling with the project graph; plan-verb, bind/recovery and catalog receipts stay byte-faithful for the consumers that parse them.
• Mixed receipt forms are declared: result_json payloads are write-time versioned — pre-slim rows keep their full form and replay from stored bytes, slim rows carry the envelope — and the store execution restore-preview surfaces (engine module header, CLI help, docs/commands.md) now say so, so inventory differences from mixed forms are declared, not silent. Versioning is forward-only: an older engine reading a slim row refuses store.corrupt; restore the matching build.
• Execution receipt retention: terminal close and adoption now prune the closed workflow's execution_operations receipts inside the same transaction, and an epoch-bump purge statement pins the invariant that an in-place epoch advance never leaves replay-dead receipt rows behind. RUNNING workflows keep every receipt (replay and recovery evidence stay intact); per-workflow accumulation is documented as the deliberate tradeoff tracked by #466.
• Restore preview declares pruned receipts: store execution restore-preview help, the engine module contract, and docs/commands.md now state that receipt retention is an expected source of backup-only execution operation rows (restore preserves prior-epoch receipt rows; replay stays current-epoch scoped), so backup-vs-live differences after pruning are declared, not silent.
• Notes-ledger expectations documented: workflow-note append/coverage help and the engine ledger header now state the append-only growth model and the whole-file read costs (id-dedup scan, whole-file coverage hash) as contract behavior.
• Removed application file/directory mutexes without a replacement mutex protocol. Native SQLite transactions/CAS, authorization and genuine workflow integration ownership remain; ordinary notes and documents are not authority.
• Workflow notes are a plain append log: repeated IDs/submissions append again, one LF-framed O_APPEND write preserves peer bytes on failure, tolerant readers continue past partial records, and receipts return the note ID without an accepted-operation replay promise. An admitted append may finish after later session revocation; its record is not current execution authority. Native device/inode observations reject a detected replacement during append; they are not a mutex and do not prevent subsequent external rotation.
• Production note, catalog-purge and execution-restore operations ignore removed test-control environment values: a working-directory .env cannot execute test scripts, truncate unrelated files, park production work or select recovery fault injection. Failure and interleaving instrumentation lives only in the test suite.
• Dsh host state uses the existing control-root database for events, accepted source identities, scan bounds, bindings and newest status emissions, without JSONL tail/index/cursor/cache authority or file compaction. Dispatch, settle and workflow-verdict evidence follows the selected logical workflow ID, never a destination directory basename. Native session logging continues before ACTIVE authority; unavailable persistence reports supported init/upgrade recovery. Engine-status reads preserve native refusal causes and distinguish a true addressed no-row answer from absent, staged, corrupt and schema-refused authority. Legacy binding imports reject a session already bound at another cwd while preserving same-pair replay and the existing explicit skip recovery.
• Legacy Dsh import preserves tail-only replay identities and reads source leaves through no-follow file descriptors; identical native replay preserves the original event, conflicting identity bytes refuse, and a replaced symlink leaf is not followed.
• Legacy execution recovery imports directly through store upgrade, retaining original v1/v2 source bytes; standalone mstar migrate staging and internal status/snapshot writers are retired, and engine ArtifactKind is review | json only. Active standalone v1 lifts require one addressed --delivery JSON object per original workflow ID, supporting different delivery intents in one same-source retry before execution registration; kind is never inferred, and inapplicable declarations refuse. Store initialization may already have committed when declarations refuse. Existing Dsh skip acknowledgements recover an unregistered symlinked Dsh source, including the whole workflows/ root with --ack-skip-dsh dsh-workflows, without following it or changing link/target bytes; registered execution sources retain containment/no-follow checks and cannot be discarded by a Dsh acknowledgement. Database backup captures a consistent native image; restore replaces all authority domains transactionally on the same live database with a new epoch, without freezing or rolling back ordinary files. A committed restore remains successful if its optional filesystem receipt copy fails, returning recoveryReceiptPath: null; pre-commit cleanup reclaims only the attempt's own safety image when the native store generation proves it did not commit, and preserves images on changed or unreadable authority. Fresh-store failures distinguish unpublished filesystem failure from an already-published store whose handle could not open, with phase-specific public recovery.
• Unsafe registered sources and native-ID collisions have explicit import recovery: optional --ack-skip-workflow <id...> skips only named refused execution imports, independently of Dsh disposal, while preserving source/link/target bytes and existing native rows. Unknown/noncolliding acknowledgements report a usage error before registered unsafe-source refusals. Receipts disclose lost imports; default no-follow and ordinary physical containment remain, with no fabricated resumption.
• Nested execution-source refusals use the same workflow acknowledgement, including symlink/non-regular snapshots. Legacy status, snapshots and session bytes use no-follow, identity-checked descriptors; session validation consumes those bytes without reopening the path. The checkpointed-authority regression no longer waits for garbage collection or asserts SQLite cleanup timing.
• Legacy source leaves are opened non-blocking, so a FIFO or other special file at a registered leaf refuses by type and names its recovery instead of hanging the command; a decidable sibling source in the same run still imports. The same bounded, type-checked, no-follow read covers the v1 iterations/<id>/delivery-compass.md leaf, which a special file at that path would otherwise have blocked.
• The v1 conversion consumes the already-verified register bytes rather than re-acquiring status.json by path, so classification and the converted rows come from one descriptor-verified read on the supported v1 route.
• A store-upgrade receipt is bound to the imported source: the source digest participates in the request identity, so reusing one operationId over changed legacy bytes conflicts instead of answering with a receipt that describes bytes the run never imported. Unchanged input still replays its retained receipt.
• The upgrade retry survives a publication race: an upgrade that loses initializeStore's create-only publication race is pointed back at store upgrade (its legacy import may be unfinished) instead of at the "do not initialize or migrate an existing store" instruction meant for store init.
• A history chunk that vanishes after enumeration refuses: the DSH import no longer reads that ENOENT as "this workflow kept no retained history", so the identities in a vanished chunk cannot be skipped silently; a genuinely missing history directory keeps its previous treatment.
• A v1 compass that changes under the probe is refused: once the type probe has observed a compass, a leaf that vanishes or becomes a link before its read refuses by name instead of being treated as absent (which would silently regroup that iteration's plans); the non-regular-compass refusal names both supported repairs — replace it with a regular file, or remove it to convert those plans as standalone rows.
• A malformed v1 plan row is skippable: a converted v1 lifecycle whose rows cannot be imported refuses as that lifecycle's own source and is addressable by --ack-skip-workflow <original id>, exactly like a malformed v2 snapshot, so one agent-authored row no longer blocks every valid workflow.
• Root status.json residual_findings are reported rather than dropped: the v1 conversion states the exact count and the supported route (a project register document at projects/<id>/residuals.json, or the issue verbs), leaving the legacy field untouched.
• The upgrade recovery and help name the complete skip vocabulary: the machine-facing DSH recovery also names --ack-skip-workflow for ids this run already committed, and the command description lists every source class the acknowledgement accepts.
• A refused legacy source is always skippable by its id: a registered snapshot whose plan rows are missing, duplicated or unconvertible now refuses as that workflow's own source (the default refusal names --ack-skip-workflow), so one malformed row no longer aborts the upgrade or blocks every healthy sibling import.
• The acknowledged-skip disposition names the refused source, not a presumed cause: a nested-source skip no longer asserts that its (real, in-root) containing directory is unsafe; the per-item reason carries the exact cause.
• Both source digests are ordered by code unit, never by the process locale: the same legacy bytes keep one identity across machines, locales and ICU versions, so a same-input retry is never falsely refused as execution.operation-conflict.
• The v1 compass refusal names three supported exits, and a link raced into the open window refuses exactly like a static one: replace the compass with a regular file (keeping the iteration grouping), remove it (converting those plans as standalone rows), or explicitly start without importing any legacy source (store init --harness <new-empty-control-root>, existing data untouched). The descriptor is also identity-checked against the probe, so a swapped-in regular file cannot contribute its bytes.
• A workflows/ entry that sources nothing is treated as absent, not as a conflict: a regular file (or other non-directory) with no registration under it no longer aborts the upgrade, while a registration under it keeps the existing per-source refusal.
• The upgrade receipt binds the bytes it consumed: each source hash is taken from the single descriptor read that produced the rows (and the v1 compass reads record theirs), so the digest no longer re-acquires the same paths; a DSH refusal that follows a committed execution import names both acknowledgements its advertised retry needs.
• Catalog purge-registration settles the native execution journal only, without reading, hashing or rewriting the recorded snapshot: the failed producer's source bytes are retained exactly, and an edited document no longer blocks journal cleanup. The recorded digest remains historical failure evidence on the receipt, never a re-certification of the live file; identity, generation, catalog-revision, ACTIVE and recorded-receipt replay guards remain.
• New store publication synchronizes its parent directory before removing the fallback image. A failed barrier reports the published partial outcome, retains readable data and the fallback, and supports recovery through the same public upgrade entry.
• Retired mstar migrate now recognizes its former delivery and branch flags before returning the explicit no-writer refusal. Legacy-status and Dsh workflow-selection diagnostics direct operators to mstar store upgrade --operator <name> --harness <control-root>.
• Milestone mechanism in the project store: mstar milestone add|update|assign write milestone metadata and the sole issue association under store-revision CAS; read-only list/status expose open/resolved/other-retired rollups. Delivery is an explicit status change that requires at least one linked issue and zero open ones.
• Composed roadmap surfaces: mstar roadmap export (JSON v2 / grouped Markdown) and the roadmap dashboard render milestones — target, status, linked issues and counts — alongside the retained Direction; they work without Markdown content and never modify milestone records.
• Governance wording now references milestones: the Durable Roadmap Gate accepts a milestone ID plus linked-issue acceptance/owner/dependency/trigger evidence, and retired roadmap.md stubs remain history/import transport only.
• Project roadmap authority now lives in the project store record, not a live roadmap.md: CLI, dashboard and dsh read the same content; a known project with no roadmap is reported explicitly.
• Roadmap authoring uses read-only import preview and reviewed apply, revision-guarded replacement, and Markdown/JSON transport export. Harness scaffold registers _default without writing roadmap Markdown; legacy files remain import candidates or history.
• Iteration close reads the stored roadmap, exports an independent candidate and replaces it against observed revisions instead of editing a live project roadmap file. Runtime guidance now points to one governance rule home.
• Fixed roadmap CLI discovery, import-preview round-tripping, dashboard absence handling, and legacy roadmap migration disclosure without creating a second authority.
• Refused worktree cleanup when ignored files would be lost; refreshed the committed hook bundle and migration/scaffold expectations.
• Corrected roadmap dashboard and project-rollup absence messages, and updated migration-6 test expectations.
• Read dsh project roadmap milestones from the store authority and disclose absent, partial, and unavailable roadmap coverage in the panel.
• Restored catalog facts in roadmap views, clarified the empty project rollup message, and retained migration steps in successful JSON output.
• Added the read-only local dashboard: mstar dashboard serves the issue list/detail with recorded history, the workflow / iteration / roadmap views and one cumulative captured-vs-retired issue-flow chart on 127.0.0.1 (loopback only, no bind option), from the issue store and the lazy execution/roadmap projections. The dashboard never mutates; unknown historical dates are disclosed and counted separately, pre-store buckets are labelled register history, and the issue-flow chart is paired with an accessible data table.
• Dashboard roadmap is now a milestone board: the roadmap page lays each project's milestones out as columns (one column per milestone, in store ordinal order) with that milestone's assigned issues as the items inside it — mono id, disposition badge and stored title — instead of the previous vertical card list. The project's unassigned issues appear as an explicit, named trailing column; the count is named on the no-milestones branch too, so it is never silently dropped.
• Direction demoted below the board: the content authority's Direction and the stored historical document now render as collapsed sections under the board, each keeping its own heading and its existing "content authority ≠ milestone data" wording. Catalog facts and the store/projection freshness block are unchanged, and a refused roadmap read still renders its notice — never an empty board, never the empty-milestones state.
• Dashboard roadmap entry is projects-first: opening #roadmap without a ?project= now lists every catalog project (title, id, lifecycle, open-issue count) and each entry links into that project's read-only roadmap, replacing the "add the project to the URL" dead end.
• New projects dashboard read view end to end: engine DashboardView + ProjectListDTO/ProjectListItem (complete, deliberately unpaged read over the catalog table with an open-issue count), the param-free /api/projects transport route, and the regenerated offline dashboard bundle.
• A duplicated v1 plan id is a refused, skippable source instead of a whole-conversion abort. convertLegacyV1Tree orders the competing plans[] rows by plan id, then by the owning lifecycle id (the iteration compass registering that id; empty when unregistered), then by row ordinal; the first row survives and every later duplicate is reported. store upgrade refuses naming that plan id, and --ack-skip-workflow <id> acknowledges losing exactly the duplicate rows: the surviving row and every other source still import, and the receipt reports each skipped duplicate with its plans[] ordinal and with the status, progress and notes that stay only in the legacy status.json. docs/commands.md carries the ordering rule beside the acknowledgement prose.
• The Dsh retry recovery names every acknowledgement the retry needs. When a refused legacy Dsh phase runs after the execution import already committed, the refusal and the command's structured recovery name the complete retry — the --ack-skip-dsh selectors, --ack-skip-workflow <id...> for the union of the ids that invocation committed (native collisions on the next invocation) and the original acknowledgements the unchanged root still requires (such as a duplicated v1 plan id), plus, for a v1 root, the exact --delivery <json> declaration(s) and --ack-skip-compass <iteration-id> acknowledgement(s) that invocation used — so the advertised retry is reachable in one invocation instead of refusing on a still-required source, in declaration application, or on the refused Dsh selector first.
• A non-regular v1 iteration compass has an acknowledgement vocabulary. store upgrade accepts a variadic --ack-skip-compass <iteration-id...> (CLI and MCP) taking the iteration DIRECTORY name under iterations/. The acknowledged compass is never read, that iteration produces no lifecycle, and the plan rows it registered convert as standalone plan rows — each active one still needing its own --delivery declaration — with the skipped iteration and that grouping loss reported per item in the receipt. The compass refusal now names this acknowledgement beside the two filesystem repairs, and an id that names no compass the invocation refused is a usage error (exit 2).
• L1 worktree ownership: ignore a row claiming the recorded main-worktree branch when checking residency and identify the owning workflow and plan for real ownership conflicts.
• Plan preparation: refuse to use the control checkout's current branch for any plan row, including report-only workflows, and fail closed when that branch cannot be resolved.
• L1 worktree checks now derive workflow, plan, lease, and lifecycle-branch inputs from the ACTIVE execution authority graph instead of retired snapshots and sibling scans.
• Sibling worktree root: moved the default for feature/L2 worktrees and pr-review worktree-setup to <parent>/<repo>.worktrees/, outside the checkout. The repository root is the realpath of the Git top-level; in-repo .worktrees/ remains a legal manual/override location. Removed the default setup's .git/info/exclude append, which is obsolete outside the repository.
• Convention alignment: updated the skills and AGENTS.md to teach the sibling-root convention, keeping linked checkouts out of the repository scan/edit surface and permission guidance independent of cwd or unverified glob semantics.
• Added an executor-side worktree checkout gate: when an Assignment carries Worktree path, leaf roles must cd there and verify the checkout root with git rev-parse --show-toplevel before the first repo write or commit, and disclose Worktree path used (absolute) in the Completion Report — closing the gap where subagents inherited the primary checkout and wrote product files into it.
• Updated mstar-branch-worktree (可写角色执行规则 + 回报要求), the shared mstar-roles/references/_shared/leaf-executor-core.md Git NEVER block, and the frontend-dev / ops-engineer role files to match the existing fullstack-dev-shared.md instruction.
• Fixed worktree cleanup attribution after stopped and failed (cancelled-terminal) registrations are superseded: the terminal owner no longer makes a shared worktree/branch appear foreign. The real-store dry-run now plans the merged worktree for removal; branch deletion remains deferred until the worktree is removed and cleanup is replanned.
• Safer worktree cleanup ownership: Completion retains the plan's exact branch and worktree path after lease release. Cleanup can also recover a claim from a valid completed Done-row handoff; degraded parseable snapshots preserve handoff resources as protective, nonterminal metadata but never authorize removal. Unreadable snapshots withhold removals unless explicitly ignored. Applying cleanup re-plans after deferred integration worktrees are removed before deleting newly-unchecked-out branches. Ambiguous ownership still refuses removal.
• Ignored-content cleanup: Ignored-only files no longer make a worktree dirty for cleanup. Applying an eligible removal deletes those ignored files without a Git recovery backstop; tracked changes and non-ignored untracked files still block removal, and cleanup never forces it.
• plan complete now advertises the argument shape its own parser accepts: the refusal recovery names --file <absolute-evidence.json>, so following it verbatim completes the plan instead of being rejected as invalid JSON.
• session run keeps the child exit code its admission assigned: a missing executable surfaces the admitted 127 in the session.child-exit envelope instead of a generic launcher exit 1.
• status workflow-close re-run against a lifecycle this control root already recorded as completed and unregistered is the documented idempotent re-run — exit 0 with an explicit nothing-to-close receipt — while a foreign scope and any recorded outcome other than the requested completed keep refusing.
• A dashboard service stopped by SIGTERM exits with the signal's own status (128+15) instead of the start receipt's 0.
• The CLI stdin reader is bounded and self-cleaning: every settle path detaches its listeners and pauses the stream, and a non-interactive stream that delivers nothing refuses (command.stdin-unavailable) instead of holding the command open forever, while an interactive terminal keeps its read.
• Terminal adoption no longer requires a recorded stop reason. adoptTerminalWorkflow no longer refuses a stopped/failed header whose state.stop_reason is missing — nothing in the engine ever writes that field, so the guard stranded every normally stopped workflow's ACTIVE coordinator session row behind a hand-edited SQLite row. Registry membership, revision CAS, self-settlement refusal, adoption-record read-back and per-header ACTIVE-session coverage are unchanged, and the retired recovery branch is gone from the CLI refusal vocabulary.
• An unregistered header is adopted by registry membership, not by its own status. Eligibility is now "this header is not ACTIVE registry membership", so a header that left the registry without ever reaching a terminal value — reachable only by importing an unregistered snapshot — is adopted instead of refused with "no supported exit exists". The adoption terminalizes it to stopped with an ended_at in the SAME transaction as its adoption record and its settled session rows, so no committed state pairs an adoption with a still-running header; an already-terminal header keeps its recorded status, ended_at and updated_at untouched. The registered-row guard, revision CAS, attestation validation, non-self-settlement refusal, per-header ACTIVE-session coverage and whole-transaction rollback are unchanged, and the "capture an issue with mstar issue add" dead end left the CLI refusal vocabulary with the refusal.
• A terminal plan header without a registered delivery_kind is accepted history, not an unclearable violation. The read-only Phase-6 gate consulted consultDeliveryEvidence for a completed lifecycle and reported PHASE6_DELIVERY_KIND_UNREGISTERED as an actionable high — yet the kind is fixed at registration, so no operation can add it, and the recovery text's only remedy (close as failed, register a replacement) needs an ACTIVE lifecycle. On a completed/failed/stopped header the condition now emits nothing; the ACTIVE paths (registration-time evidence and a completion-time close, which pass a non-terminal header) keep the violation, its wording and its remedies unchanged, and the completion branch still refuses an incomplete-delivery completion.
• Added @mstar-harness/opencode-v2 — the OpenCode 2.x native plugin package, authored on the pinned @opencode/plugin 2.0.26 SDK. It registers the same bundled mstar-* skills, role agents, and iteration commands through the V2 native editor surface, and its write/edit/subagent gates refuse for real through the typed Tool.Error channel (the V1 package's warn-only no-refusal-channel limitation does not apply here). patch, shell, and Code Mode stay explicit non-claims; installed-host behavior is unverified.
• Made mstar init --target opencode / doctor --target opencode generation-aware: --opencode-generation <v1|v2> always wins; a real install otherwise probes opencode --version (major ≥ 2 → @mstar-harness/opencode-v2, 1.x → @mstar-harness/opencode); probe failure refuses with the flag recovery — no silent v1 fallback — and --dry-run previews with probes skipped (an unresolved generation is annotated, never guessed). Config markers are a consistency guard only.
• The V2 config write set keeps the V1 key untouched and preserves user values: plural plugins with owned-slot dedupe, agents.<role>.model only when supplied, a non-destructive mcp.servers["morning-star"] merge, and $schema preserved — never invented.
• Docs: new packages/opencode-v2/README.md + INSTALL.md, dual-generation pointers in the OpenCode (V1) package docs, the V2 section in the mstar-host OpenCode reference, and the root README install row.
• BREAKING — remove the entire plan-PM product route. One workflow primary coordinator now drives every row through ordinary prepare, progress, issue-add, issue-close and direct complete. Per-plan sessions/roles/claims/binding, sealed Assignment admission and handoff/accept/return/integration-start/integration-accept/reconcile/repair/release protocols are removed, without aliases or a relocated transfer sequence. Coordinator bootstrap/resume and explicit stopped workflow-coordinator recovery remain.
• No-argument iteration drive only. /iteration-drive rejects all nonempty input before boot; old scoped flags never silently become whole-iteration authorization. OMP removes extra-primary preferences, capacity/terminal transports and launch journals; native leaf dispatch and the bounded bind/checkpoint/read-only-history scheduling observer remain. Model-handoff behavior is unchanged.
• Ordinary revisable configuration. Source branch/worktree metadata and QA/cleanup are configured through prepare, including while active. Defaults are mandatory QA and allow-residual cleanup. Valid metadata/defaults require no ceremonial prepare record or immutable plan/Assignment bytes. Transactions, CAS, exact-request receipts, explicit authorization, L1/L2 checkout isolation, SDD, QC tri and QA remain.
• Three distinct completion obligations remain. Iteration completion verifies the actual already-performed serial two-parent merge in the clean recorded integration checkout and leaves parent compound/PR/verified-merge/close intact, with no child PR. Standalone development verifies its registered source without iteration integration and retains its own delivery tail. Standalone report-only consumes explicit matching policy fulfilment recorded before Done and retains evidence-backed close, without fabricated Git/integration/compound-before-PR/PR. Complete releases only applicable integration exclusion, retains ownership and preserves timestamps on exact replay; it never performs or repeats Git merge.
• Explicit authority and historical cutover. An already-selected store root is never rediscovered: missing or empty --harness targets refuse without opening another ACTIVE store and remain recoverable through public store upgrade. Schema-8 retirement requires full operator-stop attestation and preserves business provenance; imported completed ownership uses current metadata/completion, never a retained plan-PM handoff reader.
• Authority, phase and retained-track corrections. ACTIVE authority veto precedes malformed plan-read payload validation; recorded numeric progress contributes to iteration phase derivation. FILE worktree checks retain the selected row's track ownership and expose ordinary observed-revision progress recovery with the explicit control root, without clearing live tracks or weakening checkout/identity guards.
• Policy/host parity. Canonical skills, command text, templates, routing pressure data, bounded-resolution dispositions and README pairs use the same direct route across hosts. DSh keeps real writable scope checks against row metadata and their existing public refusal codes, not a per-row holder. Superseded unreleased seal/admission/stopped-plan-owner fragments are retired, while unrelated issue/transport/model-handoff behavior is preserved.
• Reviewer least privilege. Remove the deleted plan-lease verifier's exact/wildcard Bash permissions from QC tri and code-reviewer thin shells. Do not replace them with integration/business mutation or build/test grants; role prompts remain thin and existing review boundaries remain unchanged.
• Report-only policy-evidence idempotency. The recorded fulfilment remains the basis that authorized Done on both transports: re-pointing its evidence reference after completion refuses with the same stable code, while identical re-recording is an idempotent no-op. The development tail remains write-time-only.
• Completed-row coherence stays positive under direct completion. A Done standalone row must satisfy its declared completion kind and applicable integration/no-lease constraints, not bypass them through another state label. The former validateStandaloneCompletedCoherence handoff-state bug let a one-word rewrite bypass integration contamination, integration_worktree_path / branch.integration and no-lease checks, allowing close to stamp completed/ended_at, unregister the root and pass phase 6 while a handoff was still accepted; the direct route retains completion coherence without reinstating that retired handoff reader.
• One severity vocabulary: critical | high | medium | low | nit. The wrong info value had spread into the residual/issue severity axis — the engine SSOT, residual validation, CLI payloads and rollups, the dsh view/schema, and the mstar-artifacts reference — so every severity site names nit again and info is refused as an out-of-enum value.
• Stored severities are converted by a new schema migration, never by hand-edited rows: it rebuilds the issues table with the nit CHECK and rewrites the stored info values to nit while copying, preserving every row. Earlier migration statements and the warning → low legacy read normalization are unchanged.