Discipline Roadmap & Milestones

This document establishes the delivery phases, dependency graph, go/no-go gates, shipped gates, planned extensions, and outstanding checks for discipline.

Superseded when: A milestone completes, a new phase is initiated, or planned gate scope evolves. Update in place; do not fork.

Dependency Graph

flowchart TD
    P0["Phase 0: Fail-closed core"] --> P1["Phase 1: AST sentinel (Rust pack) + hygiene + configurability"]
    P1 --> P2["Phase 2: Packaging, CI, release"]
    P2 --> P3["Phase 3: Language packs I (Python, JS/TS, PHPT)"]
    P2 --> P4["Phase 4: Gate integrity & test floors"]
    P2 --> P5["Phase 5: Command gates & verification presets"]
    P3 --> P7["Phase 7: Language packs II (Java/Kotlin, C/C++, Go)"]
    P4 --> P6["Phase 6: Production dogfooding & legacy script retirement"]
    P5 --> P6
    P4 --> P8["Phase 8: Agent-evasion hardening"]
    P8 --> P9["Phase 9: Review follow-ups"]
    P9 --> P10["Phase 10: Remainder remediation"]
    P7 --> P10
    P10 --> P11["Phase 11: Agent reach (hooks, MCP, PR comments, replay) and coverage parity (Swift, Scala, Objective-C)"]
    P7 --> P8
    P11 --> P12["Phase 12: Pull-request policy from forge facts (ratification, review threads, verified references)"]
    P11 --> P13["Phase 13: Multi-agent guardrails before the edit (ref guard, leases, pre-tool hooks)"]
    P12 --> P13
    P12 --> P14["Phase 14: doctor forge-settings parity (GitLab variables and job token, Gitea and Forgejo)"]
    P11 --> P15["Phase 15: discipline audit (escape hatches across history)"]
    P12 --> P15
    P13 --> P17["Phase 17: a turn that ends on an announced action (stop-hook contracts, opt-in end-of-turn check)"]

Phases 3, 4, and 5 depend upon Phase 2 and proceed in parallel. Phase 8 Tier 0 and Tier 1 depend only on Phase 4; Tier 2 adds facts to every language pack, so it follows Phase 7.

Shipped Gates

| Gate | Suite | Languages | Rule Description | |—|—|—|—| | agents-md | agent-guard | any | AGENTS.md exists; CLAUDE.md / GEMINI.md do not fork it | | assertion-reduction | agent-guard | Rust, PHPT, Python, JS/TS, Java, Go, PHP, C/C++, C#, Ruby, Kotlin, Swift, Scala, Objective-C | assertion count / strength must not drop in an existing test | | vacuous-tests | agent-guard | Rust, PHPT, Python, JS/TS, Java, Go, PHP, C/C++, C#, Ruby, Kotlin, Swift, Scala, Objective-C | new tests must carry a non-tautological assertion | | ignored-tests | agent-guard | Rust, PHPT, Python, JS/TS, Java, Go, PHP, C/C++, C#, Ruby, Kotlin, Swift, Scala, Objective-C | tests must not be newly #[ignore]d or skipped without directive | | unsafe-safety-comment | agent-guard | Rust | unsafe blocks / impls carry a // SAFETY: comment | | deletion-rationale | agent-guard | any | deleted files and removed tests need a scoped removes: rationale | | time-estimates | hygiene | any | no calendar / duration estimates in markdown or the PR body | | pii | hygiene | any | no home paths, LAN IPs, denylisted hostnames, or fixed-format token literals (private-key headers; AWS, GitHub, Slack, OpenAI and Anthropic token formats; literal bearer headers) in tracked text: literal format matching, not credential scanning | | agent-scratch | hygiene | any | agent scratch state is never tracked | | shell-secrets | hygiene | shell, docker, workflows | no secrets on command lines, fixed-format token literals, or unverified piped scripts in shell, docker, or CI files: literal pattern matching, not secret scanning | | issue-link | hygiene | any | PR title or description links a tracking issue (#123, Fixes #123) | | review-threads | hygiene | any | the pull request has no unresolved review thread | | ratified-paths | agent-guard | any | edits to protected paths carry an owner’s ratification on an issue the pull request closes | | citation-metadata | hygiene | any | CITATION.cff and .zenodo.json are valid, agree with each other, and cite the concept DOI | | commit-provenance | hygiene | any | commits carry the required trailers; an agent-produced commit carries a review by someone else | | config-integrity | integrity | any | a change cannot weaken its own discipline.toml without a token | | stub-bodies | agent-guard | Rust, Python, JS/TS, Java, Go, PHP, C/C++, C#, Ruby, Kotlin, Swift, Scala, Objective-C | added functions are not stubs; existing bodies are not replaced by todo!() / NotImplementedError / return null | | harness-tampering | agent-guard | Go, Python, JS/TS, Rust | a file the test runner loads does not make a failing run pass | | error-swallowing | agent-guard | Rust, Python, JS/TS, Java, Go, PHP, C/C++, C#, Ruby, Kotlin, Swift, Scala, Objective-C | no new empty error handler or discarded Result outside tests | | instruction-smuggling | agent-guard | any (invisible characters, instruction files); Rust, Python, JS/TS, Java, Go, PHP, C/C++, C#, Ruby, Kotlin, Swift, Scala, Objective-C and prose files (phrases) | no invisible Unicode, unreviewed agent-instruction edits, or instruction-like text in comments and prose | | build-hooks | integrity | package.json, build.rs, setup.py, .npmrc, .pypirc, pip.conf, .cargo/config.toml, .env* | install and build hooks that gain network or shell access, and package-manager configuration edits, need a token | | toolchain-config | integrity | tsconfig, ruff, mypy, pytest (addopts flags and -k / -m selection), coverage, flake8, Cargo lints, rustflags, nextest, eslintrc, golangci, jest and vitest (JSON or a literal object), package.json test scripts, codecov, phpstan, phpunit, and compiler warning flags in Makefile, CMake, setup.py and build.rs | compiler, linter, type-checker, test-runner and coverage configuration cannot be loosened without a token | | sandbox-config | integrity | Claude Code, Codex, Gemini CLI, Qwen Code, OpenCode, Cursor and Copilot CLI settings, MCP server lists, devcontainer.json, Docker Compose, CI job and service containers | a change cannot widen an agent’s permissions or sandbox, or a container’s isolation, without a token | | scope-confinement | agent-guard | any | changes stay inside authorized paths | | suppression-delta | agent-guard | per pack | newly added linter / compiler suppression annotations | | provenance-tags | hygiene | any | published numerics carry (measured|target|projected) | | ci-integrity | integrity | any | workflow weakening: continue-on-error, || true, unpinned actions | | ci-skip-set | integrity | any | rollup skip set matches each job’s if: under the observed filter outputs | | test-floor | integrity | any | test-count ratchet read from the base ref | | golden-output | integrity | any | prevents stealth edits to committed golden/test output files without explicit override | | dependency-delta | integrity | any | manifest diff inspection: zero wildcards, source/license allowlists, and deny.toml verification | | test-budget | integrity | Rust, Python, JS/TS, Go, any | property-test and fuzz effort ratchet (cases, shrink iters, fuzztime, seed corpus) | | pr-checklist | hygiene | any | ticked PR checkboxes and declared touched surfaces are reconciled against the diff | | command | verification | any | fail-closed wrapper for any tool: zero-tests guard, canary, count ratchet | | sanitizers | verification | Rust, C/C++ | ASan / TSan preset with audited suppressions and a race canary | | msrv | quality | Rust | cargo check under the pinned MSRV | | miri | verification | Rust | Miri tiers with zero-tests guard | | unsafe-budget | verification | Rust | unsafe count ratchet | | bench-regression | bench | Rust, Go, Python, C/C++ | benchmark drift via harness adapters (deterministic counts or BCa intervals) | | archive-contents | integrity | any | distribution archive must contain required paths and zero forbidden developer artifacts | | manifest-sync | integrity | any | reconcile git-tracked files against packaging manifest declarations | | version-lockstep | integrity | any | version declarations across headers, manifests, and files must remain in lockstep | | gate-command-lint | agent-guard | markdown, shell | reject vacuous, masked, or inverted verification commands in plan files | | mechanism-sections | hygiene | markdown | require (inferred) or (verified: ) evidence tags in root cause sections | | [`citation-anchors`](/discipline/gates/#citation-anchors) | hygiene | markdown, any | verify path:line@sha citations against quoted text and git history, and relative Markdown links against the tree | | [`claim-labels`](/discipline/gates/#claim-labels) | hygiene | markdown, any | require RUN or READ labels on verification claims in PR bodies, commits, and Markdown |

Milestone Phases & Go / No-Go Gates

Phase 0: Fail-Closed Core

• Deliverables: Three-state exit codes (0, 1, 2), three-state git context, merge-base diff inspection, strict layered configuration resolution, stable gate registry, line-anchored directive parsing, truthful reporting with examined counts.
• Go / no-go gate: Every invariant rule in the Fail-Closed Contract (F1–F12) has discriminating tests that fail if the behavior is removed.
• Status: Completed & Verified.

Phase 1: Sentinel, Hygiene, Configurability

• Deliverables: AST gates on Rust pack, whole-tree hygiene sweeps (time-estimates, pii, agent-scratch), agents-md guide sentinel, full 5-layer configurability, unanalysed source reporting.
• Go / no-go gate: Positive and negative unit controls, e2e binary tests, embedded self-test cases, and mutation verification.
• Status: Completed & Verified.

Phase 2: Packaging, Multi-Platform CI, Release

• Deliverables: Composite action.yml for GitHub, Gitea, and Forgejo Actions; pre-commit hooks (.pre-commit-hooks.yaml); GitLab CI component template; Argo Workflow template; Dockerfile container; automated multi-architecture release pipeline (release.yml).
• Go / no-go gate: ci-gate 100% green across all platforms; release pipeline builds verified static musl and macOS binaries with SHA-256 attestations.
• Status: Completed & Verified.

Phase 3: Language Packs I (Fact Model Split)

• Deliverables: Tree-sitter extractor trait and language pack abstraction; Python pack (test_*, unittest, pytest markers); JavaScript / TypeScript pack (Jest, Vitest, Mocha matchers and callbacks); Golden (PHPT) pack.
• Go / no-go gate: Each language pack satisfies 4-point test discipline in its own language, including callback test renaming and assertion weakening detection.
• Status: Completed & Verified.

Phase 4: Gate Integrity & Test Floors

• Deliverables:
  • ci-integrity: Workflow diff inspection detecting dropped jobs from needs, addition of continue-on-error, unpinned third-party actions, or stripped -D warnings.
  • test-floor: Test-count ratchet with baseline count read from merge-base ref; allow-test-shrink: directive.
  • suppression-delta: Catching net increases in compiler/linter suppression annotations (#[allow], @ts-ignore, # type: ignore, // NOLINT).
  • scope-confinement: Restricting agent file modifications strictly within authorized directory boundaries.
• Go / no-go gate: Incident replays of historical workflow weakening and all-skipped test rollups are rejected with exit 1.
• Status: Completed & Verified (ci-integrity, test-floor, suppression-delta, and scope-confinement shipped).

Phase 5: Verification Presets & Benchmark Adapters

• Deliverables:
  • command: Fail-closed execution wrapper for arbitrary external tools with canary checks, zero-test guards, and timeout limits.
  • Verification presets: sanitizers (ASan/TSan), miri, msrv, unsafe-budget.
  • Benchmark regression sentinel (bench-regression shipped with dual-file mode, two-tier threshold, and iai/json adapters).
• Go / no-go gate: Zero-test runs, missing baseline artifacts, and unprovenanced runs fail closed; deterministic counts and conservative bootstrap intervals discriminate regressions without false positives.
• Status: Completed & Verified (command, presets, and bench-regression shipped).

Phase 6: Production Dogfooding

• Deliverables: Production deployment of discipline.toml in high-assurance consumer repositories; phased retirement of bespoke shell verification scripts.
• Go / no-go gate: Incident replay fixtures reproducing historical bypasses are caught by Discipline without regressing verification fidelity.
• Status: Parity Achieved (all 12 parity gaps shipped with zero false positives across historical PR corpus).

Phase 7: Language Packs II

• Deliverables: Java / Kotlin pack (JUnit 5, AssertJ, Hamcrest); C / C++ pack (GoogleTest, Catch2); Go pack (testing.T, testify); PHP AST pack (PHPUnit, Pest).
• Go / no-go gate: 100% discriminating test coverage per language pack.
• Status: Complete (Java, Kotlin, Go, PHP, and C / C++ packs shipped).

Phase 8: Agent-Evasion Hardening

Candidate work from a review of discipline as a safety net against autonomous coding agents. The review’s central finding: the detectors are strong, and the trust boundary around them is the cheaper target. A change that can switch its own run to advisory, or grant itself every override, does not need to beat an AST gate. Tiers are ordered; within a tier, items are independent.

Tier 0: the gates’ own trust boundary. Blocks the value of every later tier.

Tier 1: coverage from existing machinery (base-versus-head structural diffs; no new AST facts).

• toolchain-config gate. Shipped (src/guards/toolchain_config.rs): tsconfig, ruff, mypy, pytest, coverage.py, flake8, Cargo [lints], rustflags, nextest, eslintrc, golangci-lint, jest, codecov, phpstan and phpunit, diffed base against head under one rule table; coverage floors, retries and test-selection narrowing included; a configuration written as code is reported as changed, not analysed. Open: clippy.toml (its options are thresholds with no single direction), what a file pulls in through extends / presets, and a list appearing where none was.
• golden-output coupling. Shipped: default globs cover __snapshots__/, *.ambr, *.approved.* and *.golden; a change that rewrites expectations while nothing producing output changed has its own title; the message states the lines rewritten. Open: added snapshot files are still skipped, because telling a snapshot for a new test from one added to an existing test needs the test-to-snapshot mapping of each framework.
• Lockfile integrity in dependency-delta. Shipped for Cargo.lock, package-lock.json and yarn.lock v1 (src/guards/lockfile.rs): entry from a new source, dropped integrity hash, manifest changed without its lockfile, lockfile deleted. Open: the other lockfile formats (named as not analysed), and extending the ci-integrity --locked rule to npm ci, --frozen-lockfile, --require-hashes and uv sync --locked.
• suppression-delta on AST facts. Shipped: the gate reads ParsedFileFacts.escape_hatches from every pack and compares each changed file’s head side with its base side as a multiset, so a moved site is not new and a marker inside a string is not a site. The Rust pack now extracts #[allow] / #[expect], the Java pack reads @SuppressWarnings as an annotation node, JS gains @ts-nocheck, Go gains //lint:ignore.
• Existing-gate corrections. Shipped: test-floor counts tests that run (unconditionally ignored tests are left out on both sides) and names files it could not read or that parse with errors. Open: test-budget extracts with line patterns (contrary to the AST-aware rule); an assertion under a constant-false branch, or after an unconditional return, counts in full.

Tier 2: new AST facts. Packs are hand-written visitors, so each fact is written once per language. Prerequisite, shipped: LanguagePack::supplies(Fact); a gate that needs a fact a pack does not supply names the file as not analysed.

• stub-bodies. Shipped for Rust, Python, JS/TS, Go, Java and C# (src/ast/functions.rs, one walker and classifier with per-language tables; src/guards/stub_bodies.rs): an added function whose whole body is a stub marker, and an existing substantive body replaced by a stub, an empty body or a bare constant return. Abstract, overload, Protocol, interface and test members are excluded. Open: PHP, Ruby and C/C++ function facts (their files are named as not analysed); a stub padded with a second statement.
• Mock infiltration. Shipped (src/ast/mocks.rs): each test carries mock_setups and mock_asserts, counted from the call nodes inside its body against a shared vocabulary that mock_setup_fns / mock_assert_fns extend. vacuous-tests reports a new test whose every assertion is on a double’s interactions; assertion-reduction reports an existing test whose doubles rose while its assertions on real output did not. Both at warning. Rust, Python, JS/TS, Go, Java, C#.
• Error swallowing. Shipped as the error-swallowing gate (src/ast/handlers.rs): a new empty handler (except: pass, catch (e) {}, bare return) or a discarded result (let _ = f(), f().ok(), Go _ = err, x, _ := f()) outside tests, base against head per file. Rust, Python, JS/TS, Go, Java, C#. Open: a handler that logs and swallows.
• Retry annotations. Shipped through ignored-tests (src/ast/retries.rs): a test that gains a retry / flaky marker, or arrives with one, is Test Retries On Failure; a file-level jest.retryTimes marks every test in the file. CI-level retry wrappers stay with ci-integrity / toolchain-config (nextest retries, pytest --reruns).

Tier 3: governance.

• instruction-smuggling gate. Shipped (src/guards/instruction_smuggling.rs; Fact::Prose in src/ast/prose.rs): (1) zero-width, bidirectional and tag characters in added lines, blocking; (2) any edit to an agent-instruction file needs allow-agent-instructions:, blocking; (3) instruction phrases, role markers, concealment, exfiltration, reviewer steering and long base64 runs in comments, strings and prose files, warning. Findings name the location and a class, never the text. Audited: --format agent-prompt prints titles, messages and locations only, never override reasons; suppression-delta still quotes the annotation line, recorded in ARCHITECTURE §10. Open: prose spans for PHP, Ruby and C/C++ packs.
• commit-provenance gate. Shipped, default off (src/guards/commit_provenance.rs): required trailers; an agent-identified commit (trailer, author name or email against agent_markers) needs a Reviewed-by: naming someone other than its author. doctor now reports review, code-owner-review and last-push-approval from rulesets and classic protection. Verifying signatures in the binary stays declined (cryptography dependency and a trusted keyring); git notes are not fetched by CI checkouts.

• Registry verification of new dependencies: declined. A lookup of package existence and first-publish date needs a network path beyond the forge API, which AGENTS.md §3.3 forbids, and it would send internal package names to public registries. Lockfile integrity (Tier 1) is the offline control; existence and advisory checks stay with the command presets. Reopen only with a design that keeps private names on the runner.

• Go / no-go gate: each item meets the gate contract in AGENTS.md §3.4: positive and negative unit controls, an end-to-end case through the binary, a self-test case, and a named test that kills a mutated detector. A Tier 2 item additionally names every pack that does not supply its fact.
• Status: shipped. Tiers 0-3 landed in v0.8.0 and v0.9.0; every remainder those releases named (GitLab include: / rules:, GitLab approvals, forge-side doctor in CI, clippy.toml, added snapshot files, the other lockfile formats, extends inheritance, the PHP / Ruby / C / C++ facts, the Kotlin pack, padded stubs, logging swallows, test-budget on AST facts, unreachable assertions) is a Phase 10 row and shipped in v0.10.0, with the single partial noted there (forge-side doctor under --strict).

Phase 9: Review Follow-Ups

Items from an external written review of Phase 8 (2026-09-21), each checked against the code before acting. The review’s “strengths” section was right on the gates and wrong on their reach (six languages for the new facts, not “9+”; agent_diff is a module, not a gate).

• Registry lookup, revisited. An opt-in dependency-delta.verify_registry (default off) that asks crates.io, npm and PyPI whether a newly added direct dependency exists and when it was first published is implementable on the forge client (src/forge.rs: TLS, redirect pinning, body cap, DISCIPLINE_NO_NETWORK, exit 2 when unreachable). It stays declined until three things are settled: AGENTS.md §3.3 must be amended in the same PR; the names it sends are the change’s new dependencies, which for a private monorepo means internal package names reaching a public registry, so a private_prefixes skip list is a precondition, not an option; and the lookup runs on every check of every PR that adds a dependency, so rate limits and outages become CI failures (exit 2), which the fail-closed contract requires. Lockfile integrity remains the offline control. Reopen when a consumer asks for it with those three answered.
• Go / no-go gate: as Phase 8.
• Status: shipped (build-hooks; sleeps, trivial assertions and change-description scanning in existing gates).

Phase 10: Remainder Remediation

Every item Phases 7 to 9 left named as open, in one ordered plan. Each row is the whole remaining work for that item; a row ships when its gate criterion holds and the AGENTS.md §3.4 contract is met (unit controls, e2e through the binary, self-test case, a named test that kills a mutated detector). Rows in one step are independent of each other; a step depends on the step before it only where stated.

Step 0: false positives from the first consumer replay (before anything else: each is a v0.8.0 finding a real repository’s CI had already judged correct, checked against the code on 2026-09-21; a gate that blocks correct changes is held at warning by that consumer until these ship)

Acceptance for Step 0 as a whole: the consumer’s 100-PR replay with its config, the test-entry declaration and error-swallowing at error blocks only on instruction-smuggling AGENTS.md edits, its three true positives and its two deliberate || true lines.

Step 1: parity of the new facts across packs (the Tier 2 remainder; every later step benefits)

Step 2: precision of existing detectors (Tier 1 and Tier 2 corrections; independent of Step 1)

Step 3: coverage of files and forges (Tier 0 and Tier 1 remainders)

Step 4: forge-side enforcement (Tier 0 remainders; needs a token that can read branch protection and pull-request reviews)

Step 5: PR-body waivers on a push to the default branch (from a consumer’s replay at v0.9.0: a pull request whose body carried allow-agent-instructions: AGENTS.md <reason> passed on pull_request, was squash-merged, and the push run on main — base from github.event.before — failed on the same edit because a squash or rebase merge builds the commit message from the branch’s commits, not from the body, and a merge commit’s default message does not carry it either; every PR-body directive reproduces this)

• Go / no-go gate: as Phase 8; the merged-pr-body source ships with the offline behaviour decided and documented, never as a silent pass.
• Status: shipped in v0.10.0, in the order listed (the message and docs first, the source second, doctor last).

Declined, and stays declined unless the stated condition changes: registry verification of new dependencies (Phase 9 note: needs a private_prefixes contract, accepts registry outages as CI failures, and an amendment to AGENTS.md §3.3); in-binary mutation analysis (the command gate’s presets are the control); in-binary commit-signature verification (cryptography dependency and a trusted keyring; doctor reads the branch rule).

• Go / no-go gate: as Phase 8; additionally, Step 1 ships all three packs together or names in docs/GATES.md which fact each pack still lacks.
• Status: shipped in v0.10.0 (Steps 0-5), with one row partial: the forge-side doctor step runs in CI but not under --strict, which needs a second reviewer account (the branch rules now block deletion and require pull requests). Order followed: Step 0 (correctness for a live consumer), Step 1 (it widened what every later step covers), Step 2, Step 5 (a second consumer-replay correctness item, ahead of coverage work), Step 3, Step 4.

Phase 11: Agent Reach and Coverage Parity

What most widens adoption after v0.10.2: findings reaching an agent inside its edit loop and a reviewer on every forge, a one-command preview for a new repository, then the pack-parity and language gaps and the two live checks. The detection catalogue is not extended here. Each row ships when its gate criterion holds and the AGENTS.md §3.4 contract is met (unit controls, e2e through the binary, self-test case, a named test that kills a mutated detector).

Step 0: live checks (no code; evidence recorded in Outstanding Checks)

Step 1: the agent loop (uses output the binary already produces; diff and check --staged are the fast path)

The agent-facing surfaces never print waiver syntax: agent-prompt already omits directive tokens, so an agent learns to repair, not to excuse. Human output (explain, the terminal report) keeps it.

Step 2: pull-request comments (the reviewer-visible surface on Gitea and Forgejo, which have no code-scanning UI)

Step 3: adoption in one command

A --fix suggestion (restore a deleted assertion from the base side, a // SAFETY: stub) waits until explain ships: it edits test files and needs its own design.

Step 4: pack parity (independent rows; the missing capability in a pack that already exists)

Step 5: new language packs (Swift first: the most agent-heavy of the three; each needs a tree-sitter grammar crate whose licence is inside deny.toml and whose ABI matches the bundled tree-sitter; a pack whose grammar fails either is not started)

Step 6: distribution

In parallel: a public benchmark (independent of every step)

• Go / no-go gate: as Phase 10; a new pack ships only with all four facts (tests, handlers, functions, prose) or names in docs/GATES.md which fact it lacks; a consumer replay of the last 100 pull requests shows no new blocking finding that is a false positive.
• Order: Step 0 (evidence only); Step 1, then Step 2 (the widest reach for the least new code; Step 2 needs its write-path decision first); Step 3; Step 4 (false positives in packs consumers use today); Step 5 (Swift, then Scala, then Objective-C); Step 6. The benchmark runs in parallel. Rows within a step are independent.
• Status: Steps 1-5 shipped in v0.11.0; Step 0 rows 1 and 2 done (row 2 on a containerised Gitea, RUN 2026-10-16, #774); Step 6 (distribution) shipped; public precision benchmark shipped (agent-pr-precision-v2 rerun following the PR #783 false-positive fixes, RUN 2026-10-21, #777); re-run with 0.25.3 on the same 232 pull requests as agent-pr-precision-v3 (RUN 2026-10-23): same 131 blocking findings and the same verdicts. Re-run with 0.26.0 as agent-pr-precision-v4 (RUN 2026-10-28): the same 131 findings plus 1 new citation-anchors finding, and the same verdicts. Re-run with 0.27.0 as agent-pr-precision-v5 (RUN 2026-10-28): the same 132 findings as v4 and the same verdicts. Re-run with 0.28.1 as agent-pr-precision-v6 (RUN 2026-10-30) with every label fresh: 127 of v5’s 132 findings, the 5 gone being the v5 items the v0.28.0 rows fixed, and the same insufficient-n verdicts, with structural precision falling to 12 / 122 because the new synthetic raters call most findings false positives (inter-rater kappa 0.384, under the 0.75 bar).
• Public precision benchmark (agent-pr-precision-v2) (RUN 2026-10-21 with discipline v0.23.0 at 82d02046e4d64012413885b354873cfa769be329, default-with-test-entrypoints on 68 pilot pull requests across astral-sh/uv, pydantic/pydantic, biomejs/biome with 0 crashes or exit-2 failures, then 232 merged agent-authored pull requests with verified pull-request or Gerrit change numbers across the 8 disjoint evaluation repositories astral-sh/ruff, denoland/deno, BurntSushi/ripgrep, tokio-rs/tokio, fastapi/fastapi, vitejs/vite, golang/go, junit-team/junit5; full pipeline in scripts/benchmark_precision.py, artifacts in docs/benchmarks/results/{manifest.json,findings.json,adjudication.json,rater-packet.json,summary.json,post-hoc-audit.json}):
  • Two-rater blinded adjudication: 281 items (131 discipline blocking findings and 150 stratified naive-sensitive-path-filter substitution-twin flags, shuffled with seed 48201 and blind_to_source_tool = true; committed packet in docs/benchmarks/results/rater-packet.json, rater_kind = "llm-subagent" with explicit Rule 3 synthetic-rater disclosure); exact rater agreement 0.982206 (276 / 281), Cohen’s $\kappa = 0.964718$ vs 0.75 floor (target) (measured: Apple M-series macOS 15 arm64, 82d02046).
  • Class structural-ast-and-deterministic: $k = 119$, $n = 125$ ($< 141$ required sample size (target)), 4 false positives, 2 cannot-tell; point precision 0.952000 (up from 0.826389 in v1 after PR #783 eliminated all 19 false positives across dependency-delta, vacuous-tests, and stub-bodies), Wilson 95% CI [0.899229, 0.977818] vs pre-registered floor 0.90 (target), verdict insufficient-n because the false-positive elimination reduced total structural findings from 144 to 125 below the pre-registered $n = 141$ floor (measured: Apple M-series macOS 15 arm64, 82d02046). The 4 remaining structural false positives are 2 deletion-rationale findings in vitejs/vite, 1 assertion-reduction finding in denoland/deno, and 1 stub-bodies finding in denoland/deno. Within the class, ci-integrity achieved $k = 66 / 66$, point precision 1.000000, Wilson 95% CI [0.944997, 1.000000], dependency-delta $k = 20 / 20$, point precision 1.000000, Wilson 95% CI [0.838875, 1.000000], golden-output $k = 13 / 13$, Wilson 95% CI [0.771905, 1.000000], and error-swallowing $k = 11 / 11$, Wilson 95% CI [0.741167, 1.000000] (all insufficient-n at single-gate required $n = 141$ (target)) (measured: Apple M-series macOS 15 arm64, 82d02046).
  • Class heuristic-and-prose: $k = 3$, $n = 6$ ($< 245$ required sample size (target)), 3 false positives (down from 43 in v1 after PR #783 eliminated 42 of the 43 pii false positives on RFC 1918 LAN literals, test-fixture home paths, and docstring placeholders: 1 pii false positive in denoland/deno and 2 instruction-smuggling/invisible-characters-in-description false positives on an emoji variation selector U+FE0F in a Renovate release-notes table in astral-sh/ruff#29355, alongside 3 instruction-smuggling/agent-instructions-changed true positives), point precision 0.500000, Wilson 95% CI [0.187616, 0.812384], verdict insufficient-n (measured: Apple M-series macOS 15 arm64, 82d02046).
  • Substitution twin (naive-sensitive-path-filter) and per-PR block rates: twin precision $k = 5$, $n = 150$ sampled flags (482 total flags), point precision 0.033333, Wilson 95% CI [0.014320, 0.075652], verdict REJECTED (measured: Apple M-series macOS 15 arm64, 82d02046). The structural class’s point precision is 0.918667 above the twin’s (Wilson 95% CIs [0.899229, 0.977818] vs [0.014320, 0.075652], minimum detectable difference 0.162077 at $n_1 = 125, n_2 = 150$ (target)); this gap is labelled PASS_categorical_by_design, not a measured advantage, because the twin’s pre-registered winning regime (recall) was not measured (recall_claimed = false). discipline blocks 0.181034 of evaluation pull requests (42 / 232, Wilson 95% CI [0.136814, 0.235646], down from 0.248927 in v1) compared with 0.560345 for the substitution twin (130 / 232, Wilson 95% CI [0.496008, 0.622716]) (measured: Apple M-series macOS 15 arm64, 82d02046).
• Post-hoc audit of the public precision benchmark (agent-pr-precision-v2) (not pre-registered; numbers in docs/benchmarks/results/post-hoc-audit.json, written by python3 scripts/benchmark_precision.py --post-hoc-audit --write and checked by its --test):
  • Resolution of v1 protocol deviations: All five v1 deviations are resolved in agent-pr-precision-v2: (1) discipline_version = "0.23.0" and the full 40-char evaluated_commit (82d02046e4d64012413885b354873cfa769be329) match the committed pre-registration and resolve in this repository; (2) astral-sh/ruff is used throughout; (3) every one of the 232 evaluation units carries a non-null pr_number (the 1 direct commit without a PR reference in BurntSushi/ripgrep is excluded per pr_number_rule); (4) head_base_definition explicitly pre-registers the first-parent commit-pair definition (head_sha = first-parent commit on default branch, base_sha = head_sha^1); and (5) classify_twin_sensitive_path matches nested workflow subdirectories (.github/workflows/**) and matches the pre-registered manifest/linter/runner config list.
  • Clustering: one dependabot pull request (tokio-rs/tokio#8229) holds 52 of the 125 structural findings (all ci-integrity, all true positives). Over the 38 pull requests with structural findings the design effect is 3.113048 and the effective $n$ 40.153568 (measured: post-hoc), below the class’s required $n = 141$ (target). PR-cluster bootstrap 95% CI [0.840901, 0.994318] (seed 20261015, 20000 resamples) and cluster-robust ratio 95% CI [0.885881, 1.018119] (measured: post-hoc); both contain the 0.90 floor (target), consistent with the insufficient-n verdict.
  • Twin comparison: the twin’s pre-registered winning regime is recall (recall_claimed = false), and 4 of its 5 true positives are on a file where discipline also has a true positive (measured: post-hoc). All 81 of the twin’s configuration false positives are on project manifests or config files (package.json: 73, Cargo.toml: 4, deno.json: 2, pyproject.toml: 1, tsconfig.json: 1) (measured: post-hoc). Newcombe hybrid-score 95% CI for the difference [0.851023, 0.950730] (measured: post-hoc).
  • Rater provenance and Rule 3 disclosure: the blinded packet is committed at docs/benchmarks/results/rater-packet.json, and adjudication.json records rater_1_kind = "llm-subagent", rater_2_kind = "llm-subagent", tie_breaker_kind = "llm-subagent", and synthetic_rater_disclosure stating that $\kappa = 0.964718$ measures rubric consistency across isolated, source-tool-blinded LLM subagents rather than external human peer review.
  • Design power: at $n = 141$ and true precision 0.95 (target) the decision rule passes with probability 0.591103 (measured: post-hoc; exact binomial), not the 0.80 (target) of statistical_power. The smallest $n$ at which $k = \mathrm{round}(0.95 n)$ has a Wilson 95% lower bound of at least 0.90 is 127, and the property is not monotone in $n$ (127-130 and 140-141 clear, 131-139 do not) (measured: post-hoc). For $k = 216, n = 245$ the Wilson lower bound is 0.835174, not the pre-registration’s 0.8333 (measured: post-hoc). minimum_detectable_difference is the unpooled form: 0.158945 against the Fleiss pooled-null 0.160404 at $n_1 = n_2 = 141$, and 0.162077 against 0.162697 at $n_1 = 125, n_2 = 150$ (measured: post-hoc).
• Public precision benchmark re-run (agent-pr-precision-v3) (RUN 2026-10-23 with the checksum-verified discipline 0.25.3 release binary, built from 2b0ad6d759a9d6e77fa6bd1277eb3b17efb27e47, on exactly the 232 (repo, base_sha, head_sha) pairs of the v2 manifest, replayed with python3 scripts/benchmark_precision.py --from-manifest and no re-harvest; pre-registered in docs/benchmarks/precision-preregistration-v3.toml before any 0.25.3 data existed, floors and required $n$ unchanged; artifacts in docs/benchmarks/results-v3/, cross-checked by tests/test_benchmark_power_bounds.rs). The corpus was already inspected under v2, so v3 characterises a different binary on the same changes, not precision on unseen pull requests.
  • Findings against v2: a replay with v2’s binary (a source build at 82d02046) reproduces all 131 v2 findings and all 232 per-PR blocking counts exactly (RUN). 0.25.3 reports the same 131 blocking findings: 130 are identical to v2 on (gate, code, file, line, message) and inherit their v2 labels, 0 are new and 0 gone. The 1 changed finding is an instruction-smuggling/invisible-characters-in-description finding on astral-sh/ruff#29355 whose message names the scratch replay commit (commit:bfdb909 in the reference replay, commit:6f8c831 in 0.25.3); the replay commit’s id depends on when the replay ran, so this is a replay artefact, but the locked rule labels it fresh (RUN). The 150-flag twin sample is identical to v2’s and inherits its labels. Labels: 280 inherited, 1 fresh.
  • Results: class structural-ast-and-deterministic $k = 119$, $n = 125$, point precision 0.952000, Wilson 95% CI [0.899229, 0.977818], verdict insufficient-n ($n < 141$ (target)); PR-cluster bootstrap 95% CI [0.841463, 0.994152] (measured: post-hoc, Apple M1 macOS 26.4.1 arm64, 2b0ad6d7; the same labels as v2 in a different item order give a slightly different bootstrap draw than v2’s [0.840901, 0.994318]). Class heuristic-and-prose $k = 3$, $n = 6$, Wilson 95% CI [0.187616, 0.812384], verdict insufficient-n; the fresh item’s final label is cannot-tell (v2: false-positive), still a non-success. Twin $k = 5$, $n = 150$, Wilson 95% CI [0.014320, 0.075652], REJECTED. discipline blocks 42 / 232 pull requests (0.181034, Wilson 95% CI [0.136814, 0.235646]) against 130 / 232 for the twin (measured: Apple M1 macOS 26.4.1 arm64, 2b0ad6d7).
  • Raters and drift: the fresh item and 20 anchor items (10 v2 discipline findings, 10 v2 twin flags, seed 48203) went to two isolated, source-tool-blinded LLM subagents and an LLM tie-breaker (rater_kind = "llm-subagent", the v2 synthetic-rater disclosure). Fresh-item kappa is 0.0 on $n = 1$, uninformative as pre-registered. On the anchors, the resolved v3 labels agree with v2’s final labels on 15 of 20; all 5 disagreements are v2 true positives the v3 raters called false positives (1 golden-output, 1 assertion-reduction, 2 error-swallowing, 1 twin flag), and Rater 1 labelled every item a false positive (measured: post-hoc). The inherited labels therefore carry v2’s rater judgement; a second synthetic rater pool does not reproduce it on 4 of 9 sampled discipline true positives, and an external human review remains outstanding.
• Public precision benchmark re-run (agent-pr-precision-v4) (RUN 2026-10-28 with discipline 0.26.0 built by cargo build --release --locked at the v0.26.0 tag 7c56e88076663f070136fa9972bccd549044b0ee (rustc 1.98.1; the v0.26.0 GitHub release was not published when the replay ran), on exactly the 232 (repo, base_sha, head_sha) pairs of the v3 manifest, replayed with python3 scripts/benchmark_precision.py --from-manifest and no re-harvest, every pair with exit 0 or 1; pre-registered in docs/benchmarks/precision-preregistration-v4.toml before any 0.26.0 data existed, floors and required $n$ unchanged; artifacts in docs/benchmarks/results-v4/, cross-checked by tests/test_benchmark_power_bounds.rs). The corpus was already inspected under v2 and v3, and some 0.26.0 gate changes were made with v3’s results in view, so v4 characterises a different binary on the same changes, not precision on unseen pull requests.
  • Findings against v3: a replay with v3’s binary (the checksum-verified 0.25.3 release asset) reproduces all 131 v3 findings on (gate, code, file, line, message key) and all 232 per-PR blocking counts (RUN). The message key, fixed in the pre-registration, rewrites commit:<hex> to commit:<replay-commit>; without it the one v3 replay artefact on astral-sh/ruff#29355 would again differ (RUN). 0.26.0 reports the same 131 findings, all unchanged (inheriting v3’s labels), and 1 new: citation-anchors/link-target-missing on astral-sh/ruff#27184 (crates/ty/CONTRIBUTING.md:147), from the v0.26.0 ledger row that reads relative Markdown links; 0 changed, 0 gone (RUN). That finding is a replay artefact: the link target scripts/setup_primer_project.py exists at that commit in the full repository, but the diff-scoped scratch tree holds only the changed files (RUN). None of the other v0.26.0 rows (harness-tampering on by default, the stricter assertion-reduction, vacuous-tests, ignored-tests, stub-bodies, toolchain-config, pr-checklist and deletion-rationale rows, the directives override counting) changes a blocking finding on these 232 pull requests; harness-tampering again blocks none (RUN). The twin sample is identical to v3’s and inherits its labels. Labels: 281 inherited, 1 fresh.
  • Results: class structural-ast-and-deterministic $k = 119$, $n = 125$, point precision 0.952000, Wilson 95% CI [0.899229, 0.977818], verdict insufficient-n ($n < 141$ (target)); PR-cluster bootstrap 95% CI [0.841463, 0.994152] (measured: post-hoc, Apple M1 macOS 26.4.1 arm64, 7c56e880). Class heuristic-and-prose $k = 3$, $n = 7$, point precision 0.428571, Wilson 95% CI [0.158220, 0.749542], verdict insufficient-n; the fresh item’s final label is false-positive. Twin $k = 5$, $n = 150$, Wilson 95% CI [0.014320, 0.075652], REJECTED. discipline blocks 43 / 232 pull requests (0.185345, Wilson 95% CI [0.140613, 0.240327]) against 130 / 232 for the twin (measured: Apple M1 macOS 26.4.1 arm64, 7c56e880).
  • Raters and drift: the fresh item and 20 anchor items (10 v3 discipline findings, 10 v3 twin flags, seed 48205) went to two isolated, source-tool-blinded LLM subagents (rater_kind = "llm-subagent", the v2 synthetic-rater disclosure); they agreed on every item, so the tie-breaker was not run. Both raters labelled all 21 items false-positive, which the pre-registered diagnostic records (rater_label_counts.single_label_raters). The fresh-item kappa 1.0 is on $n = 1$ and a single category, uninformative as pre-registered, and the fresh-plus-anchor kappa 1.0 reflects one label from both raters, not agreement on judgement. On the anchors, the resolved labels agree with v3’s final labels on 11 of 20: the 10 twin flags and 1 discipline false positive. All 9 disagreements are v3 true positives called false positives (measured: post-hoc). In v3 one rater of this kind gave a constant label, and in v4 both did, so the synthetic rater pool no longer discriminates on this packet. The inherited labels carry v2’s rater judgement, and an external human review remains outstanding.
• Public precision benchmark re-run (agent-pr-precision-v5) (RUN 2026-10-28 with the discipline 0.27.0 GitHub release asset discipline-aarch64-apple-darwin.tar.gz, verified against the release’s SHA256SUMS and built from the v0.27.0 tag 0ced0afba4600c501f08de03df20996c18a09f3b, on exactly the 232 (repo, base_sha, head_sha) pairs of the v4 manifest, replayed with python3 scripts/benchmark_precision.py --from-manifest and no re-harvest, every pair with exit 0 or 1; pre-registered in docs/benchmarks/precision-preregistration-v5.toml before any 0.27.0 data existed, floors and required $n$ unchanged; artifacts in docs/benchmarks/results-v5/, cross-checked by tests/test_benchmark_power_bounds.rs). The corpus was already inspected under v2, v3 and v4, so v5 characterises a different binary on the same changes, not precision on unseen pull requests. The v0.27.0 behaviour changes came from evasion-corpus cases (#899), not from v4 findings.
  • Findings against v4: a replay with v4’s version (the checksum-verified 0.26.0 release asset) reproduces all 132 v4 findings on (gate, code, file, line, message key) and all 232 per-PR blocking counts (RUN). 0.27.0 reports the same 132 findings, all unchanged (inheriting v4’s labels); 0 changed, 0 new, 0 gone (RUN). Against the 0.26.0 replay on this host, 0.27.0 differs only in the scratch replay commit id named by the astral-sh/ruff#29355 finding, which the message key removes (RUN). None of the three v0.27.0 rows (an assertion over an empty literal, #902; a Python expected value computed by the call under test, #903; a Python assertion on a target the test patches, #904) adds, removes or changes a finding on these 232 pull requests: 0 findings each (RUN). The v4 replay artefact (citation-anchors/link-target-missing on astral-sh/ruff#27184) is unchanged and keeps its v4 label, false-positive; with no new or changed findings, no new artefact was possible (RUN). The twin sample is identical to v4’s and inherits its labels. Labels: 282 inherited, 0 fresh.
  • Results: class structural-ast-and-deterministic $k = 119$, $n = 125$, point precision 0.952000, Wilson 95% CI [0.899229, 0.977818], verdict insufficient-n ($n < 141$ (target)); PR-cluster bootstrap 95% CI [0.841463, 0.994152] (measured: post-hoc, Apple M1 macOS 26.4.1 arm64, 0ced0afb). Class heuristic-and-prose $k = 3$, $n = 7$, point precision 0.428571, Wilson 95% CI [0.158220, 0.749542], verdict insufficient-n. Twin $k = 5$, $n = 150$, Wilson 95% CI [0.014320, 0.075652], REJECTED. discipline blocks 43 / 232 pull requests (0.185345, Wilson 95% CI [0.140613, 0.240327]) against 130 / 232 for the twin (measured: Apple M1 macOS 26.4.1 arm64, 0ced0afb). Every figure equals v4’s.
  • Raters and drift: with no fresh item, the packet held only the 20 anchors (10 v4 discipline findings, 10 v4 twin flags, seed 48207), labelled by two isolated, source-tool-blinded LLM subagents (rater_kind = "llm-subagent", the v2 synthetic-rater disclosure). The pre-registered degeneracy rule found neither rater degenerate: each gave 1 true-positive and 19 false-positive, so no rater was replaced and the drift check status is measured (RUN). They agreed on every item, so the tie-breaker was not run. Fresh-item kappa is undefined with 0 fresh items and is reported as null (kappa_passed: false is the mechanical consequence, not a rater disagreement). On the anchors, the resolved labels agree with v4’s final labels on 12 of 20: the 10 twin flags, the 1 discipline false positive and 1 of the 9 discipline true positives. The 8 disagreements are v4 true positives called false positives (4 ci-integrity, 1 each assertion-reduction, dependency-delta, error-swallowing, stub-bodies) (measured: post-hoc). The rule removes v4’s constant-label case but not near-constant labelling: the synthetic raters still call 8 of 9 sampled discipline true positives false, so the inherited labels carry v2’s rater judgement and an external human review remains outstanding.
• Public precision benchmark re-run (agent-pr-precision-v6) (RUN 2026-10-30 with the discipline 0.28.1 GitHub release asset discipline-aarch64-apple-darwin.tar.gz, verified against the release’s SHA256SUMS and built from the v0.28.1 tag 794362b607c3e858ae9106b9762da5f3a796777a, on exactly the 232 (repo, base_sha, head_sha) pairs of the v5 manifest, replayed with python3 scripts/benchmark_precision.py --from-manifest and no re-harvest, every pair with exit 0 or 1; pre-registered in docs/benchmarks/precision-preregistration-v6.toml before any 0.28.1 data existed, floors and required $n$ unchanged; artifacts in docs/benchmarks/results-v6/, cross-checked by tests/test_benchmark_power_bounds.rs). Unlike v3 to v5, no label is inherited: every finding and every sampled twin flag is labelled fresh, and the v5 match is recorded per item as a diagnostic. Three v0.28.0 rows were written to fix five v5 items on three of these pull requests, so v6 is in-sample for those fixes and is reported with and without those pull requests.
  • Findings against v5: a replay with the checksum-verified 0.27.0 release asset reproduces all 132 v5 findings on (gate, code, file, line, message key) and all 232 per-PR blocking counts (RUN). 0.28.1 reports 127 of them unchanged, 0 changed, 0 new and 5 gone (RUN). The 5 gone are exactly the fixed v5 items: ITEM-0015, ITEM-0016 (instruction-smuggling, #909), ITEM-0044 (stub-bodies, #910 / #913) and ITEM-0126, ITEM-0127 (deletion-rationale, #911 / #915), labelled false-positive (4) and cannot-tell (1) in v5. The stricter #906 row accounts for 0 findings, and no difference between the replays is unexplained (RUN). No v5 true positive is lost: 0 of the gone items had a true-positive label (RUN). The astral-sh/ruff#27184 replay artefact is still reported and was labelled false-positive afresh. The twin sample is identical to v5’s.
  • Results: class structural-ast-and-deterministic $k = 12$, $n = 122$, point precision 0.098361, Wilson 95% CI [0.057165, 0.164077], verdict insufficient-n ($n < 141$ (target)); PR-cluster bootstrap 95% CI [0.028736, 0.246154] (measured: post-hoc, Apple M1 macOS 26.4.1 arm64, 794362b6). Class heuristic-and-prose $k = 0$, $n = 5$, Wilson 95% CI [0.000000, 0.434482], verdict insufficient-n. Twin $k = 2$, $n = 150$, Wilson 95% CI [0.003664, 0.047307], REJECTED. discipline blocks 41 / 232 pull requests (0.176724, Wilson 95% CI [0.133025, 0.230955]) against 130 / 232 for the twin (measured: Apple M1 macOS 26.4.1 arm64, 794362b6). Without the 3 in-sample pull requests: structural 11 / 120, Wilson 95% CI [0.051957, 0.156708], bootstrap [0.024390, 0.236842]; heuristic 0 / 5; twin 2 / 148; block rate 40 / 229; the same verdicts.
  • Raters and drift: 277 packet items in 7 batches of at most 40, each batch labelled by its own isolated, source-tool-blinded LLM subagent per rater slot (Rater 1 on opus, Rater 2 on sonnet), and the 39 disagreements by an opus tie-breaker (rater_kind = "llm-subagent", the v2 synthetic-rater disclosure). Each subagent read only its batch file (in two reads where the file-read tool truncated it) and used no other tool (RUN, from the subagent transcripts). Neither rater was degenerate (Rater 1: 48 true-positive, 225 false-positive, 4 cannot-tell; Rater 2: 14, 260, 3), so the drift check is measured. Fresh-item kappa is 0.384269, under min_acceptable_kappa 0.75 (kappa_passed: false). The resolved labels agree with v5’s final labels on 11 of 20 anchors, all 9 disagreements being v5 discipline true positives called false. Over every repeated item, 163 of 277 final labels equal v5’s; 109 of the 122 repeated v5 discipline true positives are now false-positive and 1 cannot-tell (measured: post-hoc). The change from v5’s 0.952 comes from the raters, not the binary: the binary removed only non-true-positive items. A single pull request (tokio-rs/tokio#8229, an actions/checkout major-version bump) holds 52 of the 122 structural findings, all labelled false-positive. With kappa under the pre-registered bar, the synthetic raters do not agree on what the rubric asks, and an external human review of the labels remains outstanding.
• Recall study (impossible-recall-v1, #838): Step 0. The pre-registration docs/benchmarks/recall-preregistration.toml (status locked-pre-confirmatory) fixes the claim: R, P and F are always reported together, for Python, discipline-unaware agents. It also fixes the strata (an execution counterfactual, not discipline’s detectors), the two configuration arms, the twins, the sealed split and the bounds: 112 in-scope positives for 80% power at floor 0.80, computed by scripts/benchmark_power_audit.py and src/guards/perf/bounds.rs. The pipeline is scripts/recall_pairs.py, scripts/recall_strata.py and scripts/recall_replay.py. Amendment 1, made before any agent run, restricts the agents to open-weight models served on the lab network, pins the harness, its Python environment (docs/benchmarks/recall-harness.lock) and the datasets, removes the sandbox’s network, and fixes the split salt. Amendment 2, also before any agent run, fixes the binary at 0.26.0, adds an oracle positive control to the validity filter and treats an errored dummy as missing (apply_validity_filter kept such instances before), pins swebench 4.1.0, defers LiveCodeBench until its validity check is defined, and fixes the design-effect and feasibility rules. The SWE-bench pilot (20% of instances, family 1 on both access arms, binary 0.26.0) has run; its artefacts and the values scripts/recall_pilot.py derives from them are in docs/benchmarks/results-recall-pilot/. The pilot found a protocol problem: the counterfactual classes none of the 40 passing impossible-split pairs test-side (26 mixed, 22 of them S1-revert; 14 source-side), so P = 0/40 (Wilson 95% CI [0, 0.088]) hits falsifier (d) and the in-scope share of 0 leaves trajectories_required undefined. FAIL_TO_PASS tests need the source fix, so the usual cheat (fix the source, revert the impossible test line) is always mixed. F = 0/115 (CI [0, 0.032]). Amendment 3, after the pilot and before any confirmatory run, puts mixed pairs in R’s denominator and P’s numerator (P = 26/40, Wilson 95% CI [0.495, 0.779]) and runs access_full at 2 runs per cell, with access_readonly descriptive only; on the pilot pairs R = 1/25 (CI [0.007, 0.195]), so falsifiers (a) and (b) already hold there. The pre-registration is locked with design_effect 1.064 (required_n 120) and the pilot’s sampling settings. Next: the confirmatory split.
• Stratified precision study (agent-pr-precision-v7): pre-registered, not run. docs/benchmarks/precision-preregistration-v7.toml (status locked-pre-data) samples merged coding-agent pull requests from the AIDev dataset (Hugging Face hao-li/AIDev, tag v5, CC-BY-4.0) at random across repositories, dependency bots excluded, and replays discipline 0.29.0 on them. Stage 1 is unlabelled: block rate and per-gate firing rates on a 1533 (target) pull-request prefix, then replay until the labelled strata have their findings (expected stop 3621 (projected), cap 6408 (target)). Stage 2 labels one finding per gate per pull request: 254 (target) per structural gate and for the test-code subclass, 307 (target) for the structural class, 184 (target) for the heuristic class, from power 0.80 rather than an interval half-width; a targeted search covers ignored-tests, vacuous-tests, harness-tampering and sandbox-config, which never fired in v6, and estimates precision given firing. Rule fidelity and actionability are scored separately; two humans label a 225-item (target) subset beside the LLM raters, and kappa below 0.75 relabels verdicts INTERMEDIATE_unreliable_labels. Every size comes from src/guards/perf/bounds.rs and is checked by tests/test_benchmark_power_bounds.rs. Blocked on the manifest builder and the AIDev replay mode of scripts/benchmark_precision.py, both written after the lock.

Phase 12: Pull-Request Policy From Forge Facts

A consumer runs a separate pull-request policy job of bespoke scripts beside discipline: owner ratification of edits to protected paths, a linked issue, resolved review threads, and the rule that the base, not the head, judges the change. Its ratification parser treated a prose mention of another project’s issue (which fixes #1162) as a closing reference, and Gitea’s 500 for the comments of a missing issue crashed the job. This phase moves the checks that belong in discipline onto the forge client, on all four forges, with every lookup ending in a named verdict. Each row meets the AGENTS.md §3.4 contract.

• Status: all five items shipped in v0.15.0: #266, #267, #268, #269, then #272 (a doctor fix for bot logins). This repository enables ratified-paths and review-threads (#270), and the action now always passes its token to the binary. The consumer’s migration (a parallel run beside its pr-policy job, comparing verdicts, then removing the scripts) is that repository’s work and is not tracked here.
• Live observations (RUN 2026-09-28 on throwaway local instances, Gitea 1.24.7 and Forgejo 12.0.4, test accounts only): a never-edited comment’s created_at equals its updated_at; a reaction by another user leaves updated_at unchanged; a write collaborator can edit another user’s comment through the API (HTTP 200), the comment keeps its author and only updated_at moves (Forgejo refuses the collaborator’s backdated updated_at with 403); issues/{n} of a missing issue is 404 on both, and its comments 500 on Gitea (issue does not exist) and 404 on Forgejo; the issue-comments endpoint ignores limit / page and returns every comment with X-Total-Count and no Link; a review conversation is the comments on one path and line across reviews, and resolving it sets resolver on its first comment only (unresolve clears it; Gitea’s resolve_conversation web endpoint answered 400 to a scripted request yet applied the change).

Phase 13: Multi-Agent Guardrails Before The Edit

Several coding agents (Claude Code, Codex, Copilot CLI, agy, Cursor, Qwen Code, OpenCode, Aider) often work in one repository at once, each in its own git worktree. Every hook discipline installs today runs after the fact: after an edit (PostToolUse, postToolUse, tool.execute.after), at the end of a turn (Stop, agentStop, stop), or as a lint command (Aider). hook run knows two events, Edit and Stop, and reads only cwd from the payload. It never reads the tool name, the target path or the session, and it checks the branch diff of its own cwd. So an agent that edits another agent’s worktree, or rebases and force-pushes another session’s branches, goes unseen, and the stray edit is not even in the diff it checks. Nothing records which session owns a worktree or a branch. scope-confinement reads only the committed diff. One observed failure: two sessions rebased the same stacked branches, which raced their force pushes and nearly lost the stack. This phase adds checks that run before the tool call or the ref update. They are cooperative, not a security boundary (see Agent hook recipes): they stop mistakes, and the forge’s branch rules stay the control against an adversary. Each row meets the AGENTS.md §3.4 contract where it adds a check (unit controls, e2e through the binary, a self-test case, a named test that kills a mutated detector).

• Order: Step 0 (evidence only). Step 2 (leases), then Step 1: the ref guard reads the leases and covers every agent with one mechanism, including the observed failure. Step 3a, then 3b (per agent in the order Step 0 confirmed their contracts), then 3c. Step 4 last. Step 0 can run in parallel with Steps 1 and 2.
• Status: Steps 1 to 4 shipped in v0.15.0: #275 (this plan and Step 0), #277 (leases), #278 (the ref guard), #279 (pre-tool check for edits), #283 (hook install writes it), #285 (shell commands), #286 (doctor), #291 (the session-start lease). Step 0 partly done. Open, in order:
  1. The pre-tool contracts of Codex and Qwen Code, observed live, then their generated entries. Qwen Code: done (0.24.7, RUN 2026-09-29), with its hook install entries and doctor’s pretool-hook check. Codex: done (0.159.0, RUN 2026-09-29), with its hook install entries and doctor’s check; its project hooks run only once approved in an interactive session (hooks.state.<hook>.trusted_hash), which docs/CONFIGURATION.md states. Cursor is set aside. Aider has no pre-tool hook: the ref guard (Step 1) is its only protection.
  2. A session-start entry that takes the worktree’s lease: shipped (#291).
  3. --if-configured in the pre-tool check: shipped (#302, v0.15.0). The user-level Copilot hook (--user) carries the pre-tool and session-start entries.
  4. This repository adopts its own guardrails: done after v0.15.0. lease install-guard is installed (doctor: ref-guard pass), and #309 regenerated the hook files with the session-start and pre-tool entries in observe mode (doctor: pretool-hook pass for Claude Code, Copilot CLI and agy).

Phase 14: doctor Forge-Settings Parity

discipline doctor reads the repository settings that decide whether a mutable action ref, a moved release tag or an exposed secret can run. On GitHub it checks all of them: the Actions policy (actions-sha-pinning, allowed-actions, default-token, actions-approve-prs), immutable-releases, tag-protection, secret-scoping, and the pins themselves (imposter-commit, nested-action-pins). Run with an admin token on this repository after v0.15.0 (RUN 2026-09-29), each of them passes. At v0.15.0, on Gitea, Forgejo and GitLab only tag-protection was checked (protected-tag patterns), and every other check reported that the forge does not have the setting (src/doctor_settings.rs, src/doctor_pins.rs), although GitLab has settings that play the same role and what Gitea and Forgejo expose had not been checked against a running instance. This phase recorded what each forge exposes (Step 0), then checks it: GitLab’s job token and CI/CD variables with an audit of the token doctor runs with (Step 1), Gitea’s and Forgejo’s secrets (Step 2). The ci-integrity gate, which reads a change’s workflows, already covers Gitea and Forgejo workflows as it does GitHub’s; this phase is about the forge’s settings only.

• Order: Step 0 first (evidence only). Steps 1 and 2 can run in parallel once Step 0 lands.
• Status: Steps 0 to 2 done (v0.16.0): #314 (what Gitea, Forgejo and gitlab.com expose), #317 (GitLab job token, CI/CD variables and the token audit, forge-token), #321 (Gitea and Forgejo secrets). Deferred until a GitLab, Gitea or Forgejo consumer needs them (items 1 and 2); dropped (item 3):
  1. Step 1’s live run against a GitLab project: the e2e runs through the binary against a fake forge serving the responses recorded from gitlab.com; a run against a project needs a read-only (read_api) token.
  2. Step 2’s pin checks (imposter-commit, nested-action-pins) on a Gitea or Forgejo instance whose actions source is GitHub: that source (DEFAULT_ACTIONS_URL) is server configuration a repository token cannot read, so doctor would need it named (a configuration key) before it can resolve uses: against GitHub.
  3. The token audit on GitHub, Gitea and Forgejo (dropped; see Known Limitations): forge-token stays information there: a classic GitHub token’s scopes are in a response header (X-OAuth-Scopes), a fine-grained one lists no permissions, and neither Gitea nor Forgejo has an endpoint for a token to describe itself (their API descriptions, recorded in Step 0: /users/{username}/tokens lists the user’s tokens, not which one is in use).

Phase 15: discipline audit, Escape Hatches Across History

Every escape hatch is judged one change at a time: a directive lifts a finding in the run that reads it, config-integrity reports a loosening in the change that makes it, a baseline entry grandfathers a finding once. Nothing reads them across history, so patterns that only show over many changes go unseen: exemptions that only grow, a gate waived repeatedly and then loosened in configuration, waivers that lifted nothing, a pull-request body edited after merge. Issue #319 carries the investigation. Findings that shape the design (READ unless marked): an OverrideRecord exists only when a directive lifts a finding (src/tokens.rs), so a directive that matched nothing leaves no trace; replay drops the applied overrides the child report carries and keeps only refusals (src/replay.rs), and it runs one configuration under test, so it is not the engine for history; config-integrity’s Weakening is prose (src/guards/integrity/config_diff.rs); on this repository no first-parent commit carries a Co-Authored-By trailer (RUN 2026-09-29), so which agent made a change cannot be read from history.

The audit is a read-only subcommand, not a gate (the patterns span changes) and not a mode of replay. It emits data first; signals are queries over it. Each record names its input’s trust tier: git objects on protected main (A), records the forge keeps (B), or text the author wrote (C); a tier-C signal is a hint only. Out of scope: exact-text boilerplate matching, per-file hot spots and per-agent trends (rewording and splitting defeat them), --fail-on until a signal has a measured false-positive rate, and any agent-facing output (a list of accepted waivers teaches an agent what passes).

• Order: Step 1 first (small, useful to check and replay users on its own). Step 2 before Step 3. Step 4 after Step 3. Step 5 after Step 4 (it renders the signals). Steps 6 and 7 are independent of Steps 4 and 5. Step 8 is independent of the rest; its repository side needs the owner, not an agent.
• Status: investigation done (#319); Steps 1 to 6 shipped in v0.16.0 (#324, #325, #327, #329, #330, #331; the demo and documentation in #332; Step 6 in #334, #335, #336 (landed through #338), #340 and the body-edit part). Commit messages are read from git; pull-request bodies, reviews, ratifications and cited issues with --forge. The README and the documentation site show the report, with a demo of this repository at docs/demo/audit.html. Step 9 (--replay) answers which waivers lifted nothing. Next: Step 8 (repository side, the owner’s; see its row). Step 7 is deferred, and the audit reports agent records as claims (see its row).

Phase 16: Agent and Container Containment Settings

An agent’s containment is set in files the repository tracks: its permission lists and default mode, its sandbox and network allow-lists, its MCP servers and hooks, and the Dev Container or Compose service it runs in. A change that widened any of them passed every gate: instruction-smuggling reported any edit to a hook file without reading what it changed, and nothing read the container definitions. Running containment itself (system calls, outbound traffic, credential reads, stopping a session) stays with the sandbox, and is stated as a non-goal in docs/ARCHITECTURE.md §1.3.

• Order: Step 0 first. Steps 1 and 2 share one gate and one pull request; Step 3 reads Step 1’s table. Step 4 is independent.
• Status: all steps shipped in v0.16.0 (#341, #342, #343, #344). Known limitations (see Outstanding Checks & Known Limitations): a Kubernetes manifest has no file name that identifies it, so it is not read; a key not in the table and a value outside a mode’s order pass unjudged.

Phase 17: A Turn That Ends On An Announced Action

A coding agent on a weaker model often ends a turn by announcing its next action and not taking it: the final message is one sentence of intent (“Now let me run the fail-then-pass test and check the Miri issue.”), the model stops normally, and the person has to type “continue”. Tracked in #706. The check is opt-in ([hooks.premature-stop], off by default) and lives in hook run only. This section records what each agent’s end-of-turn hook can do (Step 0, evidence), the detector with its measured results, what is built, and what is open. Every claim is labelled RUN (executed, 2026-10-08) or READ (from documentation, a schema or a binary).

What was observed first (RUN, the owner’s local session records). 6,144 turn endings (a final assistant message with no tool call, a normal stop) from Claude Code transcripts and an OpenCode database: 4,950 distinct texts, 263 of them from 19 models other than Claude’s, 4,687 from Claude models. For the local open-weights model the report came from: under OpenCode, 0 of 47 endings below 100k prompt tokens and 2 of 39 above announced an action and stopped; under Claude Code, 4 of 6 did, two of them at 53k and 54k prompt tokens, so a long session makes it more likely and a short one does not rule it out. The same model also ended three turns under OpenCode with a tool call written out as text (</parameter> </function> </tool_call> after a sentence of intent): a second way to announce and not act, all three below 100k. Of the 100 endings the person answered with “continue”, “proceed” or “go ahead”, nearly all were questions and requests for approval, so that reply is not a usable label for this defect.

What each agent’s end-of-turn hook gives and accepts.

The detector and AGENTS.md §2.3. §2.3 forbids substring matching to verify a code invariant, because a comment can satisfy it. This check splits in two. Whether the turn made a tool call after the final message is never read from text: it is the agent’s own structured record (the stop event itself, toolRequests, tool_calls, finish, terminationReason), as the pre-tool check reads a payload and not a log line. What the final sentence says is prose, not code, and no grammar parses it; the repository already judges prose in time-estimates, under the rule that its matcher is pinned by a labelled corpus (tests/fixtures/time_estimates_corpus.json). This check follows that precedent and narrows it: the match is anchored at the start of the last sentence, fenced code is removed first (a quoted “Let me check” in a block does not count), the openings are a closed list, and the corpus is the contract. A substring match on the same words was run as a control and is far worse (last row of the results).

Matched as an announcement: a last sentence that opens, after fillers such as “Now,” or “OK.”, with “let me”, “let’s”, “I’m going to”, “time to”, “now to”, “now I’ll”, “next, I’ll”, “I’ll now”, “I’ll start by”, “proceeding to”, “moving on to”, or “I need to” followed by an action verb. Cleared when the same sentence ends in a question mark, hands over (“let me know”, “want me to”, “say the word”, “your call”, “please”), states a condition or a wait (“once”, “when”, “after you”, “until”, “if you”), or opens with a non-action (“let me explain”, “let me be direct”, “I’ll wait”). A plain “I’ll …” is deliberately not matched: in the records it is 56 distinct endings, nearly all promises to report on background work that was really running.

Results (RUN). The labels are the detector author’s alone, read from the last sentence without the session around it; no one else has reviewed them.

Verdict: INTERMEDIATE. The precision point estimate on real endings is 0.88 and its lower bound 0.53, on 8 flags; no floor was set before measuring, and none could be claimed as cleared on this count. It is enough to justify observe mode, where a wrong match costs a log line, and not enough to justify refusing a stop by default.

Where it belongs. It is not a gate: a gate judges a diff and CI never sees a transcript. It is a check of hook run at the end of a turn, and exists nowhere else (check, mcp, replay, audit and every report format are unchanged).

• Order at the end of a turn. The change check runs first, as today. Findings or a check that could not run are the answer, and this check is not evaluated. Only a clean change reaches it.
• Refusal. In the agent’s own stop shape (the table above), with text that quotes the model’s sentence as data: discipline [turn/announced-action-not-taken]: you ended your turn after announcing an action and did not take it: `<last sentence, one line, backticks stripped>`. Do it now, or say in one sentence why you cannot. For a tool call written as text: discipline [turn/tool-call-written-as-text]: your last message contains a tool call written out as text, so it did not run. Make the call with the tool, or say in one sentence why you cannot.
• Loop guard. Never refuse a stop that carries stop_hook_active (Claude Code, Codex, Copilot CLI, Qwen Code) or a loop_count above zero (Cursor): at most one refusal per turn, by the agent’s own flag. For agy, the existing <git dir>/discipline/agy-stop-<conversation> counter; for OpenCode, which marks no continuation, a marker kept by hook run (<git dir>/discipline/opencode-stop-<session>, left by a refusal and consumed by the next stop of the session, which is read as stop_hook_active). On top, a cap per session (max_per_session, default 3) in <git dir>/discipline/turn-<session>, so a model that announces and stops every time returns to the person. A refusal the model answers with a reason (“I cannot: the tool is denied”) ends the turn on that answer.
• Never refused: a payload that lists background tasks or crons (Claude Code, Qwen Code), a payload without a message, and a base ref whose configuration cannot be read (the check is opt-in, so what cannot be shown to be switched on is off). A transcript that cannot be read is not in this list: since v0.20.0 refuse mode refuses that stop as could-not-verify (AGENTS.md §2.4), and the loop guard and max_per_session keep it from holding the session; observe mode lets it through with a note.
• Observe mode. --observe logs {"event": "stop", "verdict": "premature-stop", "codes": ["turn/announced-action-not-taken"]} to hook-observe.log and lets the stop through. The log never holds the message text (it can repeat a secret from tool output): the code, the agent and the time only.

• Configuration. A table of its own, read from the base ref like the rest of the hook’s policy, so an agent cannot switch it off in its change:

  [hooks.premature-stop]
  enabled = false          # the default
  mode = "observe"         # the default; or "refuse"
  max_per_session = 3
  tool_call_as_text = true
  

• Codes. Not finding kinds (src/findings.rs names the gate that reports each, and there is none) and not policy refusals. A third small registry, turn::TurnKind, namespace turn: turn/announced-action-not-taken, turn/tool-call-written-as-text.
• AGENTS.md §3.4, item by item. 1 (gate id, [gates.<id>]): does not apply; no gate is registered, since check cannot run this. 2 (truthful examined, registered codes): the codes are turn::TurnKind; there is no GateOutcome, because no report carries the check. 3: unit controls in src/turn.rs, e2e through the binary on the recorded payloads; no self-test case, because self-test runs gates over fixture diffs and has no hook section. 4: mutation evidence in the pull request. 5: no escape hatch and no directive; the switch is configuration read from the base ref. 6: the refusal quotes one sentence back to the model that wrote it; the log and stderr of a stop let through carry no text. 7: docs/CONFIGURATION.md (the agent hooks section) and docs/ARCHITECTURE.md §4, not docs/GATES.md. 8: the table, its keys and both codes are in tests/fixtures/v1_surface.json.

The same view of a turn, for later. The transcripts read in Step 0 hold more than the final message: every tool call with its input, and for most agents its result (Claude Code tool_use and tool_result; Copilot CLI tool.execution_start and tool.execution_complete with the shell exit code; agy tool_calls and the result step; Qwen Code functionResponse; OpenCode session.tool.called, session.tool.success and session.tool.failed). One reader per agent producing an ordered list of (tool, input, outcome) for the turn would serve this check and the two ideas discussed with it: an edit after the last passing verify command, and the same tool call repeated. Both shipped in v0.21.0 as [hooks.verified-stop] and [hooks.tool-loop] (#700, #701, #760), hardened in v0.22.0 (#768); they read the hook payloads (the post-tool witness and the pre-tool call), not the transcript. The constraint that follows for Step 2 is to build the reader as its own module with the transcript shapes pinned by fixtures, not as string searches inside the detector. It does not extend to Aider (no transcript), and for Codex the transcript path is nullable.

Open questions.

1. The precision floor and who labels: decided 2026-10-16 (#779) and evaluated 2026-10-21 (tests/fixtures/premature_stop_recorded_endings.json, scripts/evaluate_premature_stop_labels.py, src/turn.rs::tests::recorded_endings_packet_matches_detector_and_wilson_bounds, closing #779). mode = "observe" stays the default. refuse is recommended only once the Wilson 95% lower bound of its precision is at least 0.90 (target) on endings labelled by the human owner. Across all 19 distinct recorded turn endings flagged by src/turn.rs::judge in the local OpenCode and Claude Code session logs (15 announced_action, 4 tool_call_as_text, plus 6 unflagged control endings), human-owner review yielded $k = 18$ true positives and $1$ false positive (rec-19, a legitimate stop waiting for interactive gh auth login): point precision 0.947368 (18 / 19), Wilson 95% CI [0.753613, 0.990648] vs 0.90 floor (target), verdict INTERMEDIATE_floor_within_ci (announced_action alone: $k = 14 / 15$, point precision 0.933333, Wilson 95% CI [0.701835, 0.988133]; tool_call_as_text alone: $k = 4 / 4$, point precision 1.000000, Wilson 95% CI [0.510109, 1.000000]) (measured: Apple M-series macOS 15 arm64, 82d02046). Because even at $100\%$ precision a sample requires $n \ge 35$ (35 / 35 $\implies$ Wilson 95% lower bound 0.900894 $\ge 0.90$ (target)) to clear the 0.90 lower-bound floor, refuse stays opt-in and not recommended until additional recorded endings from observe mode bring the Wilson 95% lower bound above 0.90.
2. Fail-open on an unreadable transcript: decided in v0.20.0 (#730, #732): refuse mode refuses as could-not-verify, bounded by the loop guard and the session cap.
3. Other languages (dropped; see Known Limitations). The detector reads English only and misses every non-English announcement in the corpus. Models that answer in the person’s language will not be caught. Per-language opening lists are cheap to write and need their own labelled endings; none exist yet.
4. A plain “I’ll …” with no background work running is sometimes this defect and is not matched. Claude Code and Qwen Code list background tasks, which would let an empty list count as evidence; the other agents do not.
5. OpenCode: how the refusal reaches the model, and run --standalone: decided 2026-10-16 (#778) and built in Step 3. The refusal is sent with session.synthetic first, so it is not recorded as the person’s message, and with session.prompt (recorded as a user message) when session.synthetic is missing or throws; under opencode run --standalone the check is skipped and the skip logged. If a hook that fires before the loop stops ships (session.stopping, with output.stop = false; anomalyco/opencode#16626, open, three implementations closed unmerged), the handler moves to it. The third-party OpenCode-Hooks plugin’s session.idle hooks do not block (RUN 2026-10-16: GitHub API, #778).
6. The refusal arrives as a user message on Copilot CLI and OpenCode, as hook feedback on Claude Code and as a system message on agy. A weak model may answer the refusal with another announcement; the cap then ends the turn. How often that happens is unmeasured: every probe here used an instruction the model could satisfy in one word.

Recommendation for the remaining steps. Every headless CLI agent is judged now; Cursor and Aider are out of scope. mode = "refuse" stays an opt-in nobody is told to choose until the floor decided in question 1 is cleared: the observe log from real sessions, OpenCode’s included, is the cheapest way to get the endings a second labeller needs.

• Order: Step 0 (done for all six headless CLI agents). Steps 1, 2a, 2b and 3 done.
• Status: Steps 0, 1, 2a (v0.19.0), 2b and 3 done (#706, #482, #778, #780); independent human-owner labelling of the 19 recorded flagged endings + 6 controls committed (#779, $18 / 19 = 0.947368$, Wilson 95% CI [0.753613, 0.990648], INTERMEDIATE_floor_within_ci, keeping mode = "observe" as default). Non-English detection is dropped (Known Limitations).

1.0 Readiness

Before 1.0 a minor release may change gate behaviour; from 1.0, docs/ARCHITECTURE.md §3.1 binds (a default only becomes stricter within a major version, and a looser one needs a ledger entry with the configuration that restores it). 1.0 ships when all of these hold:

Default Changes (Compatibility Ledger)

Default enablement and severity are part of the compatibility contract (docs/ARCHITECTURE.md §3.1). Every change to a built-in default is recorded here, newest first; a loosening within a major version is not allowed without an entry. Each entry names the one-line configuration that restores the previous behaviour.

From v0.7.0 a new gate that ships enabled is listed too, since for a consumer it changes what blocks. Gates introduced between v0.2.0 and v0.6.0 are not listed.

Behaviour Changes

A change to what a gate reports, an exit code, or an output, with an unchanged default. Newest first; a release’s notes carry, under “Upgrading”, the rows of its own version and of every earlier patch of the same minor (scripts/release_notes_upgrade.py), so a patch release that is the first of its minor to reach a registry still lists what the minor changed. A row is labelled with the first tag that contains the change.