codex-mmo/CHANGELOG.md

Changelog

8.0.0 — 2026-08-21

Durable long-running app-server operation

• Collapse every MMO-owned serialized artifact onto one schema generation derived from the package major (8), remove the redundant lifecycle version, and require exact package/profile version 8.0.0. Other generations are rejected at load time; there is no migration, compatibility-inspection, or fallback surface. Upstream Codex, MCP, provider, and Switchyard formats retain their own version identifiers.
• Make session and supervised-worker pause cold and capacity-releasing: persist the pause and partial evidence first, then retire fingerprint-matched runner/app-server groups. Continue re-admits the same durable threads and resumes the exact paused worker set; detach remains the explicit live-background mode.
• Normalize authoritative failed turn/completed records into durable typed failures. Provider usage limits and recoverable transports retain the raw Codex error, retryability, reset evidence, and partial output. An attached TUI keeps its healthy app-server after a retryable failed turn; headless execution or explicit detach cold-suspends the same thread for later resume.
• Add exact package/code fingerprints to root and worker state and expose whether a live or retained host matches the installed runtime. Historical evidence must live in an external manual archive and re-enter only through an explicit handoff.
• Make agents_wait compact and change-aware through per-job progress_revision cursors, with result previews disabled by default. Add lossless cursor paging for an individual oversized filtered trace record; durable results and empirical trace evidence no longer require direct supervisor-file reads.
• Add session compact for paused durable roots. It briefly hosts the exact thread, invokes native app-server compaction, and returns the complete session to a cold pause.
• Require every profile to match the exact package version. Identical content is an idempotent no-op; differing current-generation or opaque incompatible installed content requires explicit staged atomic --replace, without upgrade/downgrade comparisons or migration.
• Update all bundled profiles and the reverse-engineering bundle to version 8.0.0. Reverse engineering reserves capacity for a semantic specialist's nested challenger and requires worker-private IDA copies with hash provenance so IDALib side effects cannot modify the canonical database through a nominally read-only worker.

Command-line interaction audit — 2026-08-23

• Give every command and option useful local help, examples for the primary workflows, conservative typo suggestions, non-abbreviated parsing, and early validation for contradictory or ignored options. The primary and control wrappers now delegate to one Python router instead of maintaining a second command allowlist.
• Render structured results for people on interactive terminals and strict JSON in pipes and redirected files, with --json as an explicit override. Preserve raw TUI/log/auth streams and concise scalar output, keep identifiers lossless in narrow terminals, and make empty results unambiguous.
• Keep requested data on stdout and progress, warnings, usage, and failures on stderr. Add quiet, debug, structured error, signal, broken-pipe, and nonblocking exec stdin contracts plus stage-oriented progress for long diagnostics and evaluations.
• Document CLI concepts, configuration precedence, lifecycle verbs, exit statuses, paging, and automation behavior; add focused regression coverage for the complete command surface and installer-generated wrappers.

External-veracity audit — 2026-08-23

• Repin the only supported Codex runtime and app-server contract to exactly 0.149.0. Runtime admission, optional installation, generated-schema verification, built-in model evidence, tests, profiles, and documentation now share that one version; 401 generated schema files hash to fcfeaf23728b96ab73916a21302eb7a16629e67ee99f7ee47b60fad6b6e5ee1a. No compatibility reader, migration, or alternate-version path was added.
• Match the official app-server wire contract by omitting the JSON-RPC version member, validating response envelopes, and retrying only the documented overload error with exponential delay and jitter. Harden the Unix WebSocket client to RFC 6455 handshake, masking, framing, fragmentation, UTF-8, length, close, and protocol-error requirements.
• Refresh the exact 0.149 built-in model source and the 2026-08-23 public inventories: 29 OpenCode Go, 64 OpenCode Zen, and 422 OpenRouter records. Preserve tiered, dash-valued, missing-documentation, provider-protocol-disagreement, and listing-only evidence without manufacturing scalar prices or capabilities; the generated catalog contains 560 models, including 462 agent-compatible bindings.
• Keep OpenRouter discovery credentials scoped to the reviewed official origin, so explicit blank-key and custom-source diagnostics do not consult stored credentials. Identify catalog discovery with the package version and strengthen source-specific regression coverage.

Free-model tool compatibility — 2026-08-23

• Represent OpenAI Responses custom-tool support independently from ordinary function-tool support. Codex 0.149 can now omit its free-form apply_patch tool for a qualified endpoint while preserving function-based shell and MCP tools, instead of incorrectly treating tool calling as an all-or-nothing capability.
• Restore Codex 0.149 MCP tools across Switchyard 0.2.0 by exposing Codex-granted MCP schemas as flat app-server dynamic functions and routing calls back through Codex's own allowlist-enforcing MCP API. Use the non-reserved mmo_mcp__ dynamic prefix after live qualification proved Codex rejects its native mcp__ prefix for dynamic declarations, and omit only structured result copies that are exactly represented by an existing JSON text block. Pin activation to the gateway's recorded 0.2.0 executable identity; a baseline-change test and documented live-qualification checklist require complete removal when upstream preserves Responses namespace tools natively. Track merged upstream Switchyard PR #384/commit c7beccd4891fa5cfe3a3b94fdd376f5765864507; the first published release containing it is the explicit removal trigger.
• Teach smoke evidence verification to recognize successful temporary dynamic-tool bridge calls as the required canonical server.tool, while ignoring unrelated nested objects whose own type member is not a string. Contract-valid worker prose without the required direct calls remains a failed qualification.

7.0.0 — 2026-08-20

Reusable active capacity, lossless terminalization, and root-context succession

• Replace lifetime max_total_spawns and per-role max_spawns quotas with active-only admission. Terminal jobs release capacity while global, role, child, depth, resource, writer, write-scope, trust, and atomic-batch constraints remain mechanical. Profile schema 5 rejects both retired keys without aliases, migrations, fallbacks, or compatibility readers.
• Preserve the canonical worker control-socket identity across suspended continuation and finalization. A resumed worker proves its private socket is bound before model work proceeds; startup failure returns durable suspension instead of an uncaught control-thread RuntimeError.
• Re-admit both continuation and evidence-only finalization against current scheduler and write leases, reuse the exact app-server thread, and make recovery-control delivery pending until the relaunched worker publishes a usable control socket.
• When Codex reports budgetLimited or usageLimited, allow the already-admitted turn to reach its authoritative turn/completed event. Publish a fully contract-valid terminal message as completed_with_warnings; otherwise retain partial evidence and permit explicit same-thread finalization without reactivating the goal.
• Update all twelve bundled profiles and the external reverse-engineering profile to schema 5/version 7.0.0. Session schema 7/lifecycle 4 adds an ordered root-thread lineage and staged successor transition; job schema 7 and run schema 2 remain unchanged. Earlier session/lifecycle records are rejected without a compatibility reader or automatic migration.
• Treat a fresh top-level context observed while a fingerprinted stock TUI is attached as a new canonical root-thread generation inside the same immutable MMO session/run. Native/fork threads are excluded, predecessor IDs still locate the session, and controller recovery consults only the pinned app-server's session-isolated thread index rather than rollout files.
• Restore a stopped Switchyard gateway before validating generated homes on resume, recycle the root app-server only when its effective gateway endpoint or compiled route availability changes, and reconcile dead current-run workers to suspended partial evidence before returning control. A replacement turn-mode worker settles an orphaned turn interruption before launching one continuation, preserving a result that completed during the race.

6.0.0 — 2026-08-19

Lossless app-server lifecycle and result delivery

• Keep full root prompts and delegated task briefs in their initial turns while bounding only the Codex goal objective to 4,000 characters. Long objectives retain a deterministic prefix and SHA-256 correlation note; an oversized goal label can no longer discard task context or leave an empty allocated thread falsely recoverable.
• Seed interactive goal sessions with a persistent paused objective before the TUI attaches, activate it only after the first accepted turn, and map active, paused/blocked, usage-limited, detached, recovering, and terminal states without conflating them. Controller and worker replacement preserve the original start timestamp, reuse the exact thread, and emit distinct resume audit events.
• Derive root terminal output from the last completed user-presentable plan or agentMessage item for the exact completed turn. A stale turn summary or older turn can no longer replace a later plan, and failed startup without durable work no longer manufactures partial evidence.
• Replace head/tail result truncation with contiguous cursor pagination. agent_result returns content once per page with total_chars and next_cursor; agents_wait returns a bounded preview and instructs callers to consume all pages. Model-visible MCP responses omit supervisor result/event/stderr/socket metadata without rewriting same-named fields inside opaque model results, and compiled guidance prohibits bypassing the lifecycle through direct state-file reads.
• Verify historical snapshots against the exact guidance bytes already bound into their content address instead of regenerating prose with the currently installed compiler. Guidance evolution across an MMO upgrade no longer makes an intact immutable session appear corrupt; non-guidance payloads, manifest semantics, and stored guidance remain cryptographically checked without rewriting or migrating the snapshot.
• Advertise one stable object-root spawn schema for each caller and enforce the selected role's exact task, literal-task, permission, and length rules server-side. Keep both single and atomic batch spawn tools without top-level schema unions that fragile clients mis-handle.
• Apply the lifecycle guidance and release version to all twelve bundled profiles and the reverse-engineering bundle. This is a breaking in-place release with no migration, compatibility, alias, fallback, or alternate-host surface.

5.0.0 — 2026-08-18

Canonical Unix app-server session lifecycle

• Make one isolated codex app-server --listen unix://… host the only execution host for every root and supervised MCP worker; native agents remain durable child threads in their root host. Interactive Codex is now a detachable --remote client of that same root host and thread; startup, reattach, controller replacement, and transport recovery never create a replacement MMO run.
• Replace profile schema 3 with schema 4, session schema 5 with schema 6, job schema 5 with schema 7, and lifecycle 2 with lifecycle 3. Job schema 7 pins both app-server and control sockets to stable hashed private runtime paths, avoiding AF_UNIX path loss under long state roots. Reject the retired active-work policy, rollout-path, and flat can_control fields. There is no compatibility reader, migration, alias, fallback host, or automatic rewrite.
• Replace model-blind wall clocks with Codex goal/turn lifecycle. Goal roles have host-observed token budgets and a compiled maximum; turn roles have no task deadline. Stall intervals warn without interrupting, provider slowness never erases evidence, and only external smoke/evaluation harnesses retain explicit wall limits.
• Add lossless pause, detach, continue, full stop, interrupt, finalization, compaction, steering, pending-request response, effort change, trace, inspection, and fork controls for root, native, and MCP runs through opaque run references and action-specific control grants. Full stop retires the host; detach leaves it working; interruption affects only the current turn.
• Persist authoritative app-server event streams and terminal thread history independently of controller processes. Recovery resumes the exact recorded thread, consumes a turn already committed before transport loss, and retains partial results, patches, server requests, goal state, and terminal evidence on every non-success path.
• Pin runtime admission to the exact reported Codex 0.147.0 release and validate the reviewed message/response shapes in-process. doctor --live performs the complete 361-file generated-schema digest check (a29c348318b077f122e8e271340f25dfc0b19d74f77e452b27f539fbf5444221). Server requests use their exact method-specific response contracts; unimplemented requests fail explicitly.
• Compile the complete lifecycle and control surface into immutable per-role AGENTS.md and mmo-profile-orchestration/SKILL.md guidance. Update all twelve bundled profiles and the external reverse-engineering profile in place, including bounded goal budgets, warning-only stall policy, exact action grants, and autonomous app-server operation.
• Teach generated goal-role guidance and bounded doctor/smoke prompts to call update_goal(status="complete") only after their required evidence is ready. A terminal message no longer leaves a harness goal auto-continuing until its token budget merely because the probe prohibited the lifecycle tool. Root and worker hosts now wait for the authoritative terminal turn/completed after a goal-completion event, so an in-flight final message cannot be discarded; the doctor also requires the exact probe marker rather than a substring.
• Preserve one protected session capability set across detach/restart and destroy it when the immutable session becomes terminal. Terminal transcripts and evidence remain readable; terminal sessions cannot be resumed or regain control authority.
• Refresh the OpenCode Go inventory to its 2026-08-19 public 28-model listing, including a fully evidenced Muse Spark 1.2 Responses binding and a non-agent-compatible contributor ID, while retaining the changed DeepSeek Flash tier evidence exactly. The generated catalog now contains 548 models, of which 452 are agent compatible; unresolved live Go, Z.AI-document, and OpenRouter endpoint-health evidence remains explicit rather than triggering a route fallback.

4.0.0 — 2026-08-17

Breaking durable app-server execution cutover

• Replace every Agent-MCP codex exec child with a privately hosted Codex app-server thread. Persist exact thread and rollout identity, a complete JSON-RPC event trace, terminal output, bounded partial evidence, and isolated writable patches independently of the disposable transport process.
• Replace profile and smoke schema 2 with schema 3, session/job schema 4 with schema 5, and the prior session lifecycle with lifecycle 2. Old execution-timeout/progress fields and smoke timeout_seconds are rejected; there is no reader, migration, alias, fallback key, or automatic state rewrite.
• Replace model-timed progress/watchdog policy with supervisor-measured renewable_active_work and explicit hard_wall policy. Pending input and deliberate pauses do not consume active-work capacity; slow provider/model execution does. Renewable allowances grow host-side to a compiled maximum, then reserve a bounded evidence-only finalization grace.
• Add policy-bounded cross-agent app-server control: inspect, filtered durable trace, steer, interrupt, same-thread continue, evidence-only finalize, native compaction, pending-input/MCP-elicitation/approval response, reasoning-effort change, active-work-cap change, and durable thread fork. Every mutation uses a compare-and-swap revision, exact can_control edges, session/run identity, and auditable delivery status.
• Keep strict JSON contracts on the same agent thread. Send a projected strict outputSchema through app-server when the route supports structured output, validate the full original schema independently, and permit one same-thread shape-only repair turn. No JSON-fixer role can manufacture missing evidence.
• Make noninteractive roots persistent app-server threads too, with the canonical v5 state value session_kind = "noninteractive". External --wall-timeout now detaches rather than deletes work, pending input detaches for interactive resumption, and profile active-work/finalization policy is enforced independently of that harness wall limit.
• Record each run's actual root execution host and whether MMO is enforcing its app-server execution policy, so a noninteractive session resumed through the native TUI does not misreport the lifecycle controlling that run.
• Add session detach (root disconnect while independently hosted workers continue), session stop --grace (full evidence-preserving finalization followed by bounded termination), and retain session cancel as immediate cancellation. A disappeared worker host becomes suspended, never lost; its thread, trace, partial result, and patch remain available for authorized continuation.
• Publish app-server PID/process-group ownership before protocol bootstrap, retain root ownership until detach termination succeeds, fingerprint it against PID reuse, retire orphan descendants even after their recorded leader exits, and rerun full admission before hosting a suspended continuation.
• Compile lifecycle/control guidance into every immutable profile snapshot, update all twelve bundled profiles and the reverse-engineering profile with realistic long-running limits and explicit control graphs, and update smoke/evaluation harnesses to use wall_timeout_seconds only at their external boundary.
• Require the locally installed Codex app-server v2 thread, turn, control, pending-input, elicitation, and approval method/parameter/response contracts during doctor validation. Thread lifecycle requests allow slow external MCP initialization without using model-authored clock instructions.

3.0.1 — 2026-08-16

Breaking route/catalog/runtime/profile v2 cutover

• Compile exact profile-derived AGENTS.md and mmo-profile-orchestration/SKILL.md guidance into immutable snapshot identity, enable the skill only for spawn-or-control coordination roles through standard Codex skill discovery, require an early three-call delegation decision, and make positive evaluation tasks measure whether their intended MCP roles participated. Legacy snapshots without canonical guidance are rejected rather than migrated.
• Replace the provider-shaped catalog with schema-v2 route identity: maker, API operator, access product, wire protocol, billing mode, endpoint, credential contract, gateway, and reported serving provider remain distinct. Replace every binding with an exact route-qualified key and hard-reject v1 keys and schemas.
• Make the cutover cleanly breaking. Remove retired profile/evaluation IDs and empty directories; add no migration command, compatibility reader, lookup alias, automatic rewrite, fallback key, or compatibility profile. Legacy durable session/job state is rejected in place without mutation.
• Put OpenRouter, OpenCode Go/Zen, Z.AI General API, Z.AI Coding Plan, Codex, and local deployments through one declarative inventory-snapshot and full-record-fingerprint pipeline. The 2026-08-16 baseline contains 21 routes, 546 models, 451 agent-compatible models, and 9 resource groups.
• Make OpenCode Go transport provenance explicit: the provider endpoint table is route authority, current Models.dev disagreements for four Qwen records are retained in fingerprint evidence, and live verification reads current docs instead of mistaking an immutable reviewed capture for a current source.
• Add typed OpenRouter route policies and serving telemetry. Bundled OpenRouter roles pin an allowlist and disable fallback; records distinguish the requested aggregator route from the downstream serving provider actually reported.
• Refresh the complete OpenRouter snapshot after the live DeepSeek Flash Latest price changed, verify both selected endpoints as healthy, and normalize OpenRouter's ~maker/... rolling IDs to the actual maker without turning them into lookup aliases.
• Bind every bundled GLM-5.3 role exactly to zai_coding_responses__glm_5_3 with ZAI_CODING_API_KEY. The separate Z.AI General API remains available only as an explicit route and is never a fallback for Coding Plan roles.
• Add route-level startup availability. An unavailable root blocks session creation; unavailable optional workers remain explicit typed admission failures without creating jobs or silently substituting a model.
• Add lifetime max_spawns, structured literal_task admission for low-trust roles, monotonic result read/accept/reject/integrate states, isolated Git worktrees, binary-safe patch/artifact capture, taint, command/artifact correlation, and root-controlled canonical integration.
• Split token/cost telemetry into actual API dollars, API-equivalent estimates, subscription request units, and local resource seconds. Record root activity events during worker execution without mislabelling unobserved time as productive cognition.
• Replace the previous portfolio with eight featured profiles—adaptive-engineering, codex-harness-team, high-confidence-debugging, research-backed-engineering, secure-change, visual-engineering, contract-first-refactoring, and incident-hypothesis-triage—plus four experimental labs: access-efficient-escalation-lab, route-resilience-lab, bounded-research-organization-lab, and competing-implementations-lab.
• Balance maker and access diversity intentionally: ChatGPT-backed Codex, DeepSeek/MiniMax/Kimi through economical Go access, Claude/MiniMax through Zen, GLM-5.3 through the Z.AI Coding Plan, pinned Nemotron/DeepSeek through OpenRouter, and one mechanically contained local Qwen role.
• Replace topology-coupled evaluation with schema v2: topology-neutral outcomes, optional orchestration diagnostics, matched root/single/access/full variants, complete worker ablations, deterministic hidden mutations, holdouts, negative controls, three development trials, five CLI-selectable release trials, explicit promotion gates, and no aggregate cost/quality score.
• Use real Playwright screenshots and image-preserving worker transport for visual evaluation. Add workload-specific suites for all twelve profiles and retain labs as experiments rather than unearned flagship claims.

Persistent interactive session lifecycle — 2026-08-16

• Add codex-mmo resume as the only MMO resume route. A logical interactive session retains its immutable snapshot, generated Codex home, working-directory boundary, pinned executable, and exact root Codex thread; retained pre-lifecycle sessions are not adopted or migrated.
• Separate the logical session from bounded execution runs. Each explicit resume creates a durable run record, rotates Agent-MCP capabilities, revalidates routes and generated model-catalog hashes, rejects stale worker and launcher identities, and replenishes the documented per-run spawn budgets.
• Preserve one-shot exec behavior, make cleanup age persistent sessions from their latest run, and expose run history and job filtering through the normal session/job CLI surfaces.

Post-cutover implementation audit

• Correct the Z.AI Coding Plan Responses client to the provider's dedicated Codex base https://api.z.ai/api/v1; keep the Chat-compatible /api/coding/paas/v4 route separate and add no route fallback or compatibility shim.
• Replace permissive JSON Schema format checks with dependency-free RFC 3339 date/date-time and RFC 3986 absolute-URI validation, including leap seconds, lowercase t/z, strict offsets, percent encodings, IP literals, and case-insensitive HTTP header-name collision rejection.
• Refresh the unchanged 26-ID Go, 62-ID Zen, and 413-ID OpenRouter inventories from current primary sources. Preserve OpenCode's DeepSeek peak/off-peak rows without flattening them into false scalar prices, and update current Qwen, Nemotron, and rolling DeepSeek OpenRouter fingerprints.
• Remove the last catalog model-alias field and the unused general Z.AI URL shortcut from generators, snapshots, CLI parsing, and tests. Both are rejected rather than migrated; exact route-qualified keys and explicit discovery commands are the only v2 surfaces.
• Validate the complete merged catalog, including unused profile-local rows and resource references, before resolving bindings or generating catalog output. Reject non-finite OpenRouter price policy values.
• Derive profile and evaluation-ablation concurrency from one exact weighted-resource calculation covering root reservations and the lifetime spawn budget, and reject any role whose requested units exceed its resource capacity.
• Share Switchyard only when deterministic transport/model route semantics match, keep injected faults session-local, validate persisted loopback endpoints before network use, and terminate and reap superseded or partially initialized gateway processes.
• Bind durable session and job identity to their containing directory, fail strict accounting closed on invalid state, expose the complete result disposition/integration lifecycle in generated Agent MCP configuration, and correct MCP mutability annotations.
• Attempt to roll back an applied worker patch if publishing its integrated lifecycle state fails; if reverse application also fails, persist a session taint when possible and report explicitly when even that durable containment marker cannot be written.
• Add opt-in bounded Agent-MCP progress checkpoints with a monotonic watchdog when a job timeout exceeds its configured checkpoint interval, pass compatible strict worker contracts through Codex's output-schema interface where the selected route supports it, and forward authenticated job identity into a delegated worker's own mmo_mesh server.
• Let smoke tasks require successful direct server.tool calls from Codex event evidence, so contract-valid blocked prose cannot pass a live integration check. Limit staged core-install validation to bundled profiles so unrelated operator profile packs remain preserved and cannot break a runtime upgrade.

Comprehensive quality audit follow-up — 2026-08-15

• Enforce per-role MCP concurrency across sessions of the same stable profile, prevent root exec from raising a read-only profile root to workspace-write, and pin every evaluation task to the one immutable snapshot validated at run creation.
• Terminate a launched worker child when runner setup or state publication fails, retire residual worker process-group descendants after normal completion, skip malformed non-object records during non-destructive state enumeration, fail admission accounting and idle-gateway cleanup closed when durable ownership is unreadable, and return explicit object-root errors when a selected runtime state document is corrupt.
• Require complete inventory discovery metadata, HTTP(S)-only discovery URLs, a live Codex source before installing an overlay, well-formed discovery reasoning/modalities, and model input modalities that the selected provider transport can carry.
• Replace OpenCode Go's inferred blanket high reasoning setting with exact Models.dev effort selectors; omit the parameter for routes that expose only toggle/budget controls or no verified selector, while retaining the supported high bindings for DeepSeek V4 Flash.
• Reject NUL-bearing Tool MCP arguments and duplicate runtime bindings, report bound models consistently during profile validation, dispatch tool-mcp through the primary installed wrapper, and require the Tool MCP module explicitly in release archives.
• Consolidate HTTP header-value validation at the shared utility boundary, use canonical plural credential configuration in provider documentation, and add focused regressions for each corrected contract.

Independent adversarial verification follow-up — 2026-08-15

• Make pre-spawn interactive setup failures terminalize their already-created session and discard its root MCP capability; make blank process credentials fall back consistently to a configured nonblank credential; validate cancellation reasons instead of truncating audit and state differently.
• Keep diagnostic records for an atomic batch whose runners could not all launch without charging that rejected batch to the lifetime spawn budget.
• Make generated evaluation run IDs loadable at the maximum valid profile/suite ID lengths, reject blank pattern/command entries, and align the CLI result-length boundary with the runtime/MCP contract.
• Remove the retired OpenCode credential-name rewrite entirely; installation preserves credential files byte-for-byte and obsolete names remain invalid. Use a unique validation-state directory rather than deleting a fixed name.
• Refuse to let retained uninstall ownership markers authorize a recreated install path, reject symlink/special release publication targets, and report successful non-check catalog regeneration truthfully.

Profile-scoped Tool MCP support — 2026-08-15

• Add an operator-owned, lexically layered Tool MCP registry for reviewed STDIO and Streamable HTTP servers, with closed transport-specific schemas, finite tool allowlists, explicit approval policy, environment-backed authentication, and no profile-supplied executable, endpoint, or OAuth state.
• Add per-agent grants that can only narrow operator tool exposure, include normalized definitions and grants in immutable snapshots, and compile an explicit enable/disable matrix that remains safe across native-agent config merges while coexisting with the reserved internal mmo_mesh Agent MCP server.
• Forward only selected Tool MCP environment variables into generated Codex processes, warn when native roles share credential scope, add non-launching tool-mcp list/show/validate diagnostics and doctor gates, and document the external-server sandbox and prompt-injection boundary.

OpenRouter, OpenCode Zen, and unified inventory snapshots — 2026-08-15

• Add all 62 currently live OpenCode Zen IDs by joining the public listing to OpenCode-maintained Models.dev metadata and commit-pinned provider documentation. Route 24 through Responses, 19 through Chat Completions, and 13 through Anthropic Messages with the shared OPENCODE_API_KEY; retain 6 Google-native entries as catalog-only until a faithful installed transport exists; label 9 still-listed but officially deprecated IDs with their effective dates.
• Preserve exact Zen reasoning controls and structured-output claims, take scalar billing rates from the provider's own table, omit unrepresentable budget-only efforts and context-tiered prices, expose executable translated routes as text-only, and add public discovery/drift comparison plus snapshot reconstruction and route-contract coverage. Normalize away the live endpoint's request-time created field while retaining its raw capture hash, and confirm all three executable protocols with a real Switchyard 0.2.0/local-mock transport probe.
• Add an executable OpenRouter Switchyard provider using https://openrouter.ai/api/v1, OpenAI Chat format, and OPENROUTER_API_KEY.
• Populate a reviewed 2026-08-15 OpenRouter baseline with all 413 text-input/text-output IDs from the official Models API, including exact supported-parameter, reasoning, expiry, alias, modality, and pricing evidence.
• Expose only evidence-backed OpenRouter capabilities: 346 tool-capable entries, 335 structured-output entries, 6 parallel-tool-call entries, and exact advertised reasoning efforts. Keep the executable route text-only until translated multimodal fidelity is verified.
• Omit misleading scalar OpenRouter rates for dynamic, tiered, fixed, or differently priced internal-reasoning cases while retaining the upstream pricing evidence and provenance.
• Add public/optional-auth OpenRouter discovery, remote drift comparison, CLI endpoint overrides, and secret-leakage regression coverage.
• Replace the size-dependent embedded inventory tables with one versioned, canonical-hash-checked config/inventory-snapshots/ envelope for OpenRouter, OpenCode Zen/Go, Z.AI API, Z.AI Coding Plan, and Codex. Catalog generation remains deterministic and offline for every inventory size.
• Replace the OpenCode credential contract with the shared OPENCODE_API_KEY and update all generated routes and examples. The installer does not recognize or rewrite OPENCODE_GO_API_KEY.
• Derive aggregate inventory metadata from the common snapshots, verify exact normalized snapshot-to-catalog records at runtime, require complete OpenRouter pagination metadata, and prevent discovery URL overrides from receiving stored OpenRouter credentials.
• Replace every model key with the exact route-qualified form <route>__<model>, update every bundled profile directly, and reject mismatched namespaces or duplicate route/upstream bindings. Remove the duplicate OpenCode Go DeepSeek V4 Flash and Z.AI Coding Plan GLM-5.3 rows rather than retaining aliases.
• Complete the key cutover by removing catalog lookup's case-insensitive raw upstream-ID/search-alias fallback; catalog model now accepts only an exact provider-qualified key, including when an upstream ID is currently unique.
• Refresh the official 413-row OpenRouter capture after Kimi K2.6 pricing and Qwen3.6 27B pricing/output-limit changes; the advertised ID set remains unchanged.

Runtime quality and security remediation — 2026-08-15

• Serialize stale session/job reconciliation with normal state transitions and re-read state under the runtime lock before publishing recovery results.
• Close descendant admission atomically when cancellation begins, and enforce absolute write-scope leases across active sessions even when their workspace roots are nested.
• Authenticate root, job, and native MCP callers with distinct capabilities tied to durable lineage; persist only root/job digests, keep the root plaintext process-local, discard it at terminal session state, and confine native-role plaintext to its protected generated configuration.
• Forward the caller capability through Codex's declared MCP environment-variable allowlist without writing it into generated TOML, and validate every tool call against its advertised input schema.
• Reject cross-origin catalog-discovery redirects before authorization can be forwarded, and restrict implicit OpenRouter/Z.AI credentials to their reviewed official endpoints.
• Reject pre-v2 gateway state in place; never validate, rekey, rewrite, or otherwise mutate it into a current state document.
• Return structured worker results only after a successfully enforced contract, validate smoke tasks against the same task/backend/permission boundaries as runtime admission, and reject contradictory shared resource capacities or transport capabilities.
• Remove correctness-critical assert statements from optimized-Python execution paths, harden profile cloning across valid TOML quoting styles, and make per-native-role network policy explicit in generated configuration.
• Add regression coverage for state races, cancellation/admission races, nested workspaces, capability forgery and lifetime, redirect credential leakage, v1 gateway-state rejection, result contracts, resource definitions, and generated MCP/native configuration.

External contract audit — 2026-08-15

• Enforce the MCP 2025-06-18 initialization lifecycle, supported-version negotiation (including the doctor's two-phase probe), string/integer request IDs, object-only parameters, strict finite JSON, and pre-initialization tool rejection; return JSON-RPC invalid-params errors for unknown tools/schema-invalid arguments and reserve isError results for execution failures.
• Follow XDG Base Directory 0.8 handling for empty/relative environment values and document XDG_BIN_HOME as a project extension.
• Parse Linux /proc/<pid>/stat without misreading command names containing spaces or closing parentheses.
• Normalize provider header aliases to the exact Codex (http_headers, env_http_headers) and Switchyard 0.2.0 (extra_headers) schemas, reject the complete downstream-invalid control-character set, preserve configured Codex environment-backed header secrets, and reject unsupported environment-backed Switchyard headers.
• Reject malformed or suffix-unsafe provider base URLs before Codex/Switchyard endpoint construction, while accepting the HTTP-standard case-insensitive scheme.
• Validate direct Codex retry and idle-timeout settings as non-negative TOML integers before materialization instead of coercing incompatible catalog types late.
• Document Switchyard retries as additional attempts, including MMO's explicit default of one versus Switchyard 0.2.0's omitted-field default of two and its exact maximum of ten.
• Validate the exact Switchyard IP-address host type before launch and restrict its unauthenticated managed gateway ingress to IPv4/IPv6 loopback literals.
• Include context-window, tool-calling, and reasoning route semantics in the reusable Switchyard gateway identity so distinct route configurations cannot collide.
• Require live Switchyard route discovery to match the snapshot exactly, reporting both missing and unexpected advertisements.
• Align root/worker usage extraction with Codex 0.147's cache-write and reasoning-output JSONL fields; retain usage from failed workers, calculate cached tokens at their own rate, and include root usage in total cost estimates.
• Price cache reads, cache writes, and base input as distinct token categories; omit misleading scalar prices for context-tiered OpenCode Go models and make estimates unknown when an observed category lacks a rate.
• Stop defaulting OpenCode Go structured-output support to true: assert it only for the nine IDs explicitly marked by the OpenCode-maintained Models.dev snapshot, and document the conservative text-only translated-route boundary for upstream multimodal models.
• Gate doctor credential success for built-in models on both Codex's actual login status result and file-backed auth transferable into the generated home; report home-scoped keyring-only login as unsupported.
• Fail an explicitly requested Codex catalog verification when no installed-client source runs; continue treating account-gated omissions from a working client as non-fatal.
• Defer built-in context/summary capabilities to the active Codex catalog, align the static 0.147 baseline reasoning/context metadata, and distinguish public, deprecated, and internal discovered rows.
• Record split OpenCode Go provenance for live availability, provider pricing/protocol documentation, and OpenCode-maintained Models.dev capabilities; mark hy3-preview limits unverified.
• Split Z.AI provenance by availability, Codex integration, core parameters, and pricing; correct the GLM-5.3 slug, low/high/max effort set, Coding Plan alias behavior, older-model effort support, and documented output limits.
• Mark the Z.AI Coding Plan Anthropic-compatible route catalog-only because its documented Bearer authentication cannot be represented by Switchyard 0.2.0's fixed Anthropic x-api-key behavior; Responses and Chat paths remain executable.
• Parse and emit RFC 8259 finite JSON, TOML 1.0 basic strings (including U+007F), Draft 2020-12 boolean/integer schema semantics, and RFC 9110 2xx-only readiness behavior.
• Keep the truncation marker inside, rather than beyond, the configured hard result-character ceiling.
• Verify exact archive file and directory permission modes and enforce member-count and expanded-size limits progressively while streaming tar archives and profile packs.
• Require release archives to contain exactly the explicit parent-directory entries implied by their payload, rejecting both implicit missing entries and extra empty directories.
• Filter optional npm/Cargo installer subprocess environments and require the requested Codex or Switchyard executable to exist after a successful package-manager exit.
• Document Switchyard 0.2.0's declared Rust 1.96.1 minimum for the optional Cargo installation path and replace its broken registry-page citation with the versioned published-package documentation.
• Audit both sides of staged and committed Git renames with --no-renames/NUL-delimited paths, include permission-only changes to pre-dirty files, and preserve legal whitespace in git rev-parse --show-toplevel output.
• Decode and re-encode Git's verbatim NUL-delimited pathname bytes with Python's filesystem codec and surrogateescape, rather than assuming UTF-8 independently of the runtime locale.
• Correct the single-model profile guide and document the deliberately limited JSON Schema contract language and Python/ECMA-portable regex boundary.
• Describe the control plane as free of third-party Python packages rather than free of all runtime dependencies, and list Bash as an installer/wrapper requirement.
• Distinguish Qwen3.5-9B's native 262K multimodal capability from the intentional text-only 32K/8K local scout cap, and pin matching current llama.cpp example flags.
• Terminate Codex option parsing before stdin prompts so its variadic --image flag cannot consume -, and pin optional Switchyard installation to the verified 0.2.0 schema target.
• Correct troubleshooting to use the package's codex-mmo version control command; codex-mmo --version is intentionally passed through to the underlying Codex CLI.
• Correct the interactive image example to put -- before Codex-owned options, keeping them unambiguous from orchestrator run options.
• Correct the profile smoke-task example to use the implemented task, task_kind, and mode fields and document its actual pass criteria.
• Resolve and pin one Codex executable per session so detached workers honor settings.toml and cannot diverge from the root after PATH or configuration changes.
• Make the global built-in auth link mode effective, force file storage in generated homes, and stop propagating Codex's unrelated .credentials.json MCP OAuth state.
• Return nonzero CLI status for invalid validation, failed evaluation tasks, and unfinished waits; reject a model probe without live mode and honor configured/explicit catalog discovery sources without silent option loss.
• Expose generated homes and pinned runtime details from session show, and document the name-based environment-filter boundary without claiming arbitrary secret discovery.
• Reject missing, linked, or special source-install payload members and require manifest-bound ownership for uninstall/purge targets, including retained-state manifests for later purges.
• Close schema-v1 settings, profile, catalog, agent, resource, and smoke field sets so typos and missing explicitly named files fail validation instead of becoming inert configuration.
• Remove config/model-catalog keys absent from Codex 0.147's exact ConfigToml/ModelInfo/ModelMessages schemas; retain no MMO compatibility fields.
• Admit Codex 0.147's indexed web-search mode and reject arbitrary approval-policy strings outside its canonical scalar policy set.
• Reject unknown fields in schema-v1 evaluation suites and tasks rather than silently ignoring misspelled execution or validation controls.
• Preserve and validate Switchyard 0.2.0's per-target extra_body map in the now-closed model schema, including finite JSON/TOML value checks.
• Enforce provider fields per selected driver so a recognized but inapplicable transport/authentication key cannot be silently retained and ignored.
• Prevent profile.smoke paths from escaping the profile pack, require non-empty relative catalog/smoke paths, and enforce the documented required profile metadata.
• Refuse installer upgrades over an unrelated nonempty install root unless its version-3 ownership manifest matches the canonical target.
• Enforce schema-v1 scalar/container types without Python boolean/integer equivalence or string coercion, constrain role instruction/contract members to their documented pack directories, require an absolute expanded base Codex home, and validate exact Codex 0.147 built-in provider/auth pairs before generation.
• Make evaluation validation reject boolean schema versions, coerced task IDs, nonrelative fixtures, and nested fixture links/special files before a dry run can report success.
• Reject duplicate JSON object members, lone surrogate code points, and boolean-as-integer manifest schema versions across runtime state, MCP input, output contracts, ownership records, and release verification.
• Correct the documented active-agent count to include the root and the derived native subagent ceiling to reserve that root slot; describe the exact Codex/Switchyard endpoint normalization behavior rather than generic string concatenation.

Interactive terminal fidelity

• Run interactive Codex as a real foreground terminal process group instead of detaching it into a new session.
• Translate Python's negative signal return codes to the shell's 128 + signal convention at CLI and worker-runner exit boundaries.
• Preserve the user's terminal capability environment and stop forcing NO_COLOR for interactive runs.
• Restore terminal foreground ownership and attributes on normal exit, errors, and shell job-control transitions.
• Treat terminal stdin/stdout as interactive even when stderr is intentionally redirected to a log.
• Add a PTY regression test that verifies redirected stderr does not detach the TUI, ANSI color bytes pass through unchanged, and SIGWINCH delivers a live 80x24 to 132x42 resize.

Model metadata

• Generate an exact per-process Codex startup model catalog for every external or translated model alias.
• Preserve the active Codex binary's bundled catalog when built-in and external models share one native-agent process.
• Cache bundled catalog discovery by Codex binary fingerprint and perform discovery outside the runtime admission lock.
• Generate schema-valid freeform apply_patch metadata for tool-capable external route rows and omit patch-tool metadata for models that do not support tools.
• Add regression coverage for GLM-5.3, DeepSeek V4 Flash, Qwen3.5-9B, mixed native/external catalogs, reasoning levels, context windows, and exact generated slugs.

Lifecycle

• Record whether the root owns an isolated process group and use single-process termination when a group cannot safely be targeted.
• Preserve cancellation authority during the narrow process-launch/session-publication race.
• Match persisted process IDs with Linux start-time fingerprints before acting on them, and retire residual root descendants after normal completion as well as cancellation.

Correctness hardening

• Serialize concurrent audit-log appends across short-write retries and preserve cancellation diagnostics at terminal-state races.
• Audit paths committed by a worker even when its worktree is clean at completion.
• Enforce strict finite JSON output, JSON Schema numeric equality, and arbitrarily large finite integer handling.
• Publish archives and their validation/integrity metadata as one verified rollback-safe release set.

3.0.0 — 2026-08-14

Architecture

• Replaced the fixed GLM/DeepSeek/Qwen runtime with a provider- and model-neutral profile compiler.
• Added immutable, content-addressed profile snapshots with cryptographically verified payload manifests so active sessions cannot be changed by profile switching or unnoticed on-disk mutation.
• Added generic provider drivers for built-in Codex/ChatGPT, Codex custom Responses endpoints, Switchyard, Ollama, LM Studio, and catalog-only services.
• Added per-snapshot Switchyard gateways with deterministic route generation, credential isolation, reuse, idle shutdown, and routing logs.

Orchestration

• Added first-class Codex native subagent, Agent MCP, and hybrid orchestration modes.
• Added bounded nested delegation, caller authentication, directed spawn graphs, depth limits, per-agent child limits, session spawn budgets, ancestor-role rejection, result visibility, and cancellation cascades.
• Added atomic asynchronous batch spawning with whole-batch capacity reservation and rollback if any runner fails to launch, plus a root productivity contract that keeps the critical path active while participants run.
• Added native-agent role generation and authenticated native-to-MCP delegation for enforceable nested hybrid meshes.

Safety and correctness

• Added weighted resource groups and global capacity admission.
• Added disjoint MCP write-scope leasing and completed-job Git audits, including detection of modifications to files that were already dirty before a job started.
• Added static profile-pack validation, safe archive extraction, no-symlink policy, and atomic install/replace/remove/clone operations.
• Added low-trust mechanical constraints: MCP-only, read-only, mandatory verification, strict structured output, and bounded task categories.
• Added multimodal model/provider transport validation to reject lossy role bindings at compile time.
• Added isolated worker homes, credential filtering, bounded execution, process-group cancellation, durable state, and descendant termination when a root exits.

Catalog

• Added the complete release-time OpenCode Go inventory.
• Added the complete release-time Z.AI API and Z.AI Coding Plan inventories, including catalog-only media and hosted-agent services.
• Added all officially documented models available through Codex at release time.
• Added live OpenCode Go, authenticated Z.AI, and installed/authenticated Codex discovery and verification.
• Added conservative authenticated Codex discovery overlays without guessing capabilities for unknown external provider IDs.

Profiles

• Added glm-deepseek-qwen.
• Added codex-glm-deepseek.
• Added three-expert-council.
• Added actor-critic.
• Added proposal-debate-judge.
• Added security-review-council.
• Added vision-code-verifier.
• Added local-first.
• Added single-model-parallel.
• Added codex-ultra-native, a native-only Codex expert team spanning architecture, implementation, testing, review, and research.

Operations

• Added unified codex-mmo command dispatch while retaining codex-mmoctl.
• Added profile selection, validation, compilation, installation, removal, cloning, and runtime model rebinding.
• Added catalog inspection, inventory verification, live discovery, and refresh commands.
• Added session, job, gateway, smoke-test, doctor, cleanup, authentication, and evaluation commands.
• Added atomic XDG-compliant installation, credential-preserving upgrades, backups, and clean uninstallation.
• Added deterministic release archives, schema-v2 per-file manifests, SHA-256 checksums, safe clean-extraction verification, and byte-for-byte reproducibility verification.
• Added atomic publication and clean-extraction manifest verification so incomplete staging trees cannot be released.

Evaluation and validation

• Added the engineering-core evaluation suite and cross-profile comparison metrics.
• Added a standard-library JSON Schema subset for worker result contracts.
• Added an offline integration suite using deterministic Codex and Switchyard stand-ins.
• Added a release acceptance validator that checks source syntax, catalogs, profiles, snapshots, static safety, installer behavior, runtime controls, evaluation, and release hygiene.

2.0.0

• Introduced the GLM-5.3 root, DeepSeek V4 Flash engineering workers, constrained local Qwen scout, and isolated Agent MCP worker supervisor.
• Added scope leasing, worker cancellation, persistent results, Switchyard integration, and an installable per-user package.