Changelog

Escape-aware condition parsing, reconciled with dippin v0.49. dippin-lang bumped v0.48.0 → v0.49.0; no breaking changes; core embedded workflows hold their A grades on dippin doctor.

Changed

• Condition parsing is now escape-aware (#444 reconciliation, #470). Logical splitting (||/&&) and comparison-operator discovery (=/==/!= and the word operators) both ignore content inside double quotes; exactly one surrounding quote pair is stripped from every RHS and \"/\\ are decoded inside it. An unmatched double quote is now a loud error — carrying the original expression and, at load, the .dip source location — instead of a silent mis-parse. Semantic validation applies the same quote-aware grammar to every logical branch independently.
• dippin-lang bumped v0.48.0 → v0.49.0. The library dep, the CI dippin CLI, and tracker_doctor.go's pinned version move together.
• tracker-swebench main() decomposed (#469). The 200-line entrypoint (cyclomatic 44 / cognitive 74) was split into behavior-preserving helpers under the complexity-8 gate; each container is now bounded to 1 CPU and the prompt temp file is co-located under the run's results dir.
• Added a rolling ROADMAP.md (Now/Next/Later) and a matching website Roadmap page; corrected inaccurate CLI/workflow examples on the site.

Engine-correctness hardening and a real, CI-enforced complexity gate. dippin-lang bumped v0.43.0 → v0.48.0; no breaking changes; core embedded workflows hold their A grades on dippin doctor.

Fixed

• Condition evaluator no longer misroutes on ||/&& inside values (#444). Splitting is now quote-aware, so a condition value containing ||/&& (a URL, regex, or stderr fragment) evaluates correctly instead of silently splitting into phantom clauses.
• Human-gate timeouts no longer leak the interviewer goroutine (#446). On timeout the handler now cancels the interviewer, turning a permanently-blocked goroutine into orderly teardown.
• claude-code error classification is no longer flipped by benign output (#447). Network/budget matchers are anchored to error-shaped phrases instead of bare words, so an unrelated log line can't turn a hard failure into an infinite retry.
• The interview-result handler fails the node instead of panicking (#448) on a JSON marshal failure.
• The make ci complexity gate is real, green, and CI-enforced (#468). A checked-in ratchet baseline grandfathers existing debt and may only shrink; a new or worsened violation now fails the build.

Changed

• Outcome.Status is now typed TerminalStatus (#445). A typoed status string now fails to compile instead of silently routing to the wrong branch.

An autonomous spec-forge loop lets build_product self-heal a failing spec-coherence gate instead of dead-ending at a human. No breaking changes; core embedded workflows hold their A grades on dippin doctor.

Added

• Autonomous spec-forge loop in build_product. A failing SpecLint gate now routes to a ForgeSpec agent that edits SPEC.md to resolve findings, a CheckSpecFidelity oracle proves no requirement was silently dropped, and the loop re-lints until clean — capped at 3 attempts and failing closed via SpecForgeFailed so autopilot/auto-approve can't ship a broken spec. The original spec is snapshotted and every ruling logged to .ai/decisions/, surfaced to the operator at ApprovePlan.

Fixed

• Packed .dipx runs fail loud when a workflow needs ${graph.workflow_dir} (#430). A content-addressed bundle has no source dir, so the value was silently empty; a packed run referencing it now errors before any node executes, naming the offending node(s).

build_product's milestone gate loop gets six fixes closing a cluster of false-positive "missing output" and lint-scope bugs found during dogfooding. No breaking changes; core embedded workflows hold their A grades on dippin doctor.

Fixed

• Milestone lint gate is now milestone-scoped (#436), so a milestone no longer fails on earlier, already-accepted milestones' lint debt.
• FixMilestone now sees the failing gate's real stdout (#437) instead of being blind to the lint/CI failure it never ran.
• CheckMilestoneOutputs no longer flags unbuilt future milestones (#439) or misparses declared paths from prose instead of backticked tokens (#440).
• Milestone retry cap is exact (#443) — a cap of 3 now runs exactly 3 attempts, not 4.

Changed

• Lint failures now have an in-band escape hatch (#441) via a checked-in suppression file, and absent golangci-lint now warns loudly instead of silently skipping (#442).

Review-fidelity hardening for build_product plus two new engine-resilience primitives: opt-in node-output memoization and sleep-aware budgets. No breaking changes; core embedded workflows hold their A grades on dippin doctor.

Added

• Opt-in content-hash node-output memoization (#421). Annotating an agent node with params: { memoize: true } lets a loop-restart replay a stored successful outcome instead of re-running — keyed on a SHA-256 of resolved inputs; off by default; never applied to writable_paths nodes.
• Sleep-aware budgets (#422). Opt-in --sleep-aware-budget excludes OS-suspend spans from max_wall_time and stall_timeout accounting via the monotonic clock, so a laptop that sleeps mid-run no longer spuriously trips the budget on resume.
• build_product derives spec-contract artifacts (#306) and catches self-ratifying tests (#417) and contract-fidelity gaps at external seams (#416).

Fixed

• Silent error swallowing in the Gemini translator, TUI review, and CLI env loading (#397) is now surfaced instead of dropped.

Removed

• Dead code and unwired middleware abstractions removed (#394) — deletion-only, no behavior changes.

Human gates now display their authored prompt: body, and build_product's plan-approval gate finally shows the actual plan. One fix, one behavioral change; no breaking changes; core embedded workflows hold their A grades on dippin doctor.

Fixed

• Human gates now display their prompt: body, not just the label:. The wait.human handler built the gate prompt from node.Label alone and silently dropped node.Attrs["prompt"] for freeform/choice/yes_no modes. Every human gate that authored a multi-line prompt: — including v0.40.1's EscalateMilestone "Verify currently" block (#407) and the new ApprovePlan plan review — was therefore showing only its one-line label at runtime, and any ${ctx.tool_stdout} / ${ctx.*} interpolation the gate relied on to surface live state never rendered. resolveHumanPrompt now appends the expanded prompt body to the label; label-only gates are unchanged. (Surfaced by automated review of the #414 super-PR; the prior #407 test only asserted the attribute's content, never that it was displayed.)

Changed

• build_product plan-approval gate now shows the actual plan. The ApprovePlan human gate previously displayed only its one-line label, so an operator had no plan to review and could only rubber-stamp approve. A new ShowPlan tool node cats .ai/decisions/milestones.md (the milestone plan) and .ai/decisions/requirement-coverage.md (the spec-coverage table, with the COVERAGE_GAPS count) into ctx.tool_stdout (with a 1MB output_limit so a large plan isn't clipped), and ApprovePlan interpolates it under a ## Plan under review heading — rendering the full plan in the fullscreen review modal. Decompose success now routes -> ShowPlan -> ApprovePlan; the approve/adjust/reject routes are unchanged.

build_product dogfood hardening — a single super-PR fixing a real case-study cascade (run 634a2527ff56) where a finished, green build was discarded. Five fixes plus the automated-review hardening pass; no breaking changes; core embedded workflows hold their A grades on dippin doctor.

Fixed

• Turn-limit green fix no longer abandoned uncommitted (#406). The commit-if-green breach guard (#303/#297) never fired on the Implement/FixMilestone fix loop because no verify_command was wired, so a breach with a passing tree classified as operator_decision instead of verified_green. Fixed with one shared green gate: Setup writes .ai/build/verify.sh, TestMilestone delegates to it, and the fix-loop nodes set verify_command: sh .ai/build/verify.sh; a FixMilestone -> CommitIfDirty when ctx.turn_breach_class = verified_green edge commits the green tree before escalating.
• Build artifacts no longer swept into checkpoint commits (#405). Setup seeds .gitignore with toolchain build outputs (not just .ai/), and CommitIfDirty detects untracked executable binaries (git-native git diff --no-index --numstat binary check) and gitignores them instead of committing — a compiled binary like goblin no longer FAILs Verify as out-of-scope work.
• Escalation no longer discards green trees silently (#407). EscalateMilestone surfaces the live verify result (${ctx.tool_stdout}), defaults to "mark done" to preserve finished work on the unattended path, and reframes abandon as a destructive last resort.
• Behaviorally-correct code no longer FAILed over prose identifiers (#408). VerifyMilestone gains an ADR-aware three-tier severity system (FAIL / WARN / PASS): a prose-named identifier that differs from the spec wording but whose behavioral tests are green and which is documented in a .ai/decisions/ ADR now WARNs instead of hard-FAILing. Scope, unmet-behavior, and test-contract violations remain categorical FAILs.
• Tests that pass but don't verify the contract (#409). Implement self-applies the same TEST-VERIFIES-CONTRACT rubric VerifyMilestone grades against, including a test-shape rule: a "built binary" smoke test must spawn the built binary, not call an unexported function in-process.
• PR #411 review hardening (automated multi-bot review of the super-PR). verify.sh collapses every non-zero language-test-runner exit to 1, reserving exit 2 strictly for the "make present but not installed" escalation (a pytest collection error exiting 2 no longer masquerades as the env-missing escalate); CommitIfDirty writes the runtime binary-artifact ignore to the local, untracked .git/info/exclude rather than the tracked .gitignore, so the skip itself is not an out-of-scope tree change; and the FixMilestone green-breach commit edge is guarded by a when ctx.outcome = fail -> TestMilestone short-circuit declared ahead of it, so a stale (sticky) verified_green class from an earlier milestone can no longer checkpoint a non-green tree on a normal fail.

dippin-lang v0.43.0 lands four newly-wired IR fields, the engine grows per-node cost and no-progress guards, and the commit-only node gains a real filesystem jail. Six additions, three behavioral changes, six fixes; no breaking changes; core embedded workflows hold their A grades on dippin doctor.

Added

• override: edge attribute wired end-to-end (dippin-lang v0.40.0, closes #271 input gap). override: true on a .dip edge now flows through the adapter into pipeline.Edge.Override, producing OutcomeValidationOverridden on success. The runtime field finally has a .dip input path.
• last_response_truncate: agent attribute enforced (dippin-lang v0.40.0, #56 chain-attack mitigation). Caps the Unicode character count of the prior node's response injected into a prompt, on both agent nodes and per-branch parallel overrides. The stored context value is unchanged — only the injected excerpt is capped.
• choice: edge attribute wired for human-gate routing (dippin-lang v0.42.0, DIP150). choice: approve declares a stable machine-readable routing key separate from the human-readable label:. The TUI always shows label:; choice: becomes the ctx.preferred_label value matched by the edge selector in both choice and freeform mode.
• stall_timeout graph-level default enforced at runtime (#310). When no node completes within the declared wall-clock window, the run aborts through the same OutcomeBudgetExceeded / on_failure cascade as other budget breaches. Set via the defaults: block; flows through the adapter into graph.Attrs, resolved by ResolveBudgetLimits, enforced by BudgetGuard with a per-node progress clock reset on each node completion.
• Per-node cost ceiling and no-progress detector (#304). max_cost_usd: "0.50" halts a node when its cumulative session cost exceeds the threshold; no_progress_turns: 5 halts after five consecutive turns with no tool calls. Both route OutcomeRetry into the existing retry/escalation path, support graph-level defaults with per-node overrides, and emit EventNodeCostLimitExceeded / EventNodeNoProgressDetected. max_turns is now a coarse backstop that should rarely bind.
• commit_only node attribute for codergen agents (#349). params: commit_only: true prepends a hardcoded scope-restriction block to the system prompt, preventing the agent from authoring new implementation even when failure context is present. Enforced across all three backends (native, claude-code, ACP).

Changed

• dippin-lang upgraded to v0.43.0 (from v0.39.0). Wires the four IR fields above and adapts two internal load paths to the v0.43.0 API cleanup that removed validator.Result.Errors() (now counts SeverityError diagnostics directly) and dipx.Bundle.Lookup (replaced by Bundle.Workflow(ctx, refPath, relativeTo)); also carries validator explain-text fixes (DIP109/113/114/116). The v0.43.0 else -> section-level funnel default is not yet wired in the adapter (follow-up).
• build_product.dip FinalCommit is now mechanically commit-only (#349). On top of the commit_only prompt/engine guard, FinalCommit declares writable_paths: .git/**, .ai/**, wiring the native fs-jail (#272) so its file-mutation tools can only write under .git/ and .ai/. It physically cannot author product source even when failure context primes it to "just fix it." Linux native backend only.
• build-context.md refreshed with active source files at each MarkMilestoneDone (#351 item 3). MarkMilestoneDone appends an updated "Active source files" entry per milestone so agents reading the orientation file see what's being actively worked, not just the initial entry-point list.

Fixed

• Git subprocesses no longer inherit leaked GIT_DIR/GIT_INDEX_FILE (#399). When tracker runs from inside a git hook, git honors inherited repo pointers over a command's -C <dir>, redirecting the artifact-repo git init/add/commit — and ExportBundle's git bundle create — at the outer repository. gitSafeEnv now strips GIT_DIR, GIT_INDEX_FILE, GIT_WORK_TREE, GIT_OBJECT_DIRECTORY, and GIT_COMMON_DIR unconditionally (even under TRACKER_PASS_ENV=1), with case-normalized key comparison.
• build_product milestone test-gate scope and accept verification bypass (#392). (T1) TestMilestone ran a whole-tree go test ./... inside a milestone-scoped fix loop, so an unrelated package failure was un-fixable on every retry; the test run is now scoped to the packages the milestone actually changed, with the whole-tree suite still gating at FinalBuild. (T2) The accept escalation option bypassed cross-review + final build/test + spec-check; it now routes through CheckMilestoneOutputs so accepting still earns every gate. No engine changes.
• Remaining example workflows now hold A grades under dippin doctor (#335 scope 3). megaplan, megaplan_quality, ralph-loop, and semport were structurally hardened with graph-level on_failure: Exit catch-alls and max_restarts defaults (resolving DIP134 restart-budget confusion). All four now reach A/100.
• build_product FinalCommit commit scope (#349). The FinalCommit agent node now carries commit_only: true (engine-level scope guard) to prevent it from authoring new implementation when failure context is present in the conversation window. The prompt already contained explicit "do NOT implement" language; the engine-level guard makes that restriction structurally enforced rather than advisory-only.
• Non-embedded example workflows now hold A grades under dippin doctor (#335 scope 2). Nine example .dip files (consensus_task, consensus_task_parity, sprint_exec, human_gate_showcase, parallel-ralph-dev, semport_thematic, fix-tracker-visibility, human_gate_test_suite, reasoning_effort_demo) were structurally hardened with on_failure catch-alls, max_restarts defaults, corrected subgraph ref: paths, and removal of label: edges on interview-mode nodes (DIP129). All now reach A/95–A/100; core embedded pipelines unchanged.
• ${ctx.tool_stdout} / ${ctx.tool_stderr} in agent prompts render as fenced blocks (#352 item 3). Interpolating these keys mid-sentence previously pasted raw tool output inline, garbling instructions. The expansion layer now wraps the values in a ```text fenced block under their own heading, including per-node scoped references.

Case-study hardening rounds 5–6 — the audit log stops double-counting, per-branch security overrides actually apply, a silently-inert failure route is refused at dispatch, and the embedded built-ins clean up their act. Six fixes, no breaking changes; all four embedded workflows hold A grades on dippin doctor.

Fixed

• activity.jsonl no longer logs every LLM event twice (#354). The client-level trace observer and the agent session both wrote the same stream — doubling audit volume and skewing tracker diagnose event counts. One writer now owns the stream.
• Per-branch tool_access: / writable_paths: overrides reach the runtime (#368). The adapter silently dropped the per-branch security overrides the IR carries; they now propagate with the same fail-closed canonicalization and jail refuse-to-start treatment as agent-level attrs, and duplicate-target branches resolve deterministically (last branch wins).
• Inert per-branch fallback_target is refused at parallel dispatch (#313 defect 2 — closes the issue). A fallback declared on a parallel branch target never did anything: branches bypass the engine's strict-failure path. The handler now fails fast before dispatching any branch — either attr spelling, on the target node or any branch.N.* group (shadowed duplicates included) — pointing at the supported pattern: fan_in_policy + a conditional fail edge at the aggregating node.
• build_product_with_superspec: a failed cross-reviewer can no longer be masked (#313). ReviewParallel declares fan_in_policy: all with a fail edge to EscalateToHuman, so a single failed reviewer escalates instead of vanishing into success-if-any aggregation.
• Embedded deep_review goes from F/35 to A/100 under dippin doctor (#335 scope 1). A graph-level on_failure catch-all + escalation gate replace eleven dead-stop failure paths; the review goal flows verbatim via the per-node scoped context key instead of an LLM-copied file; the analysis fan-out demands all three analyzers succeed.
• build_product stops leaking tracker's own issue/PR numbers into agent-visible text (#316). 64 references excised from prompt text and tool echo strings — rules now state themselves on their own terms (#355 swept the last template-domain cruft, too).

The case-study hardening arc lands — agents stop hallucinating their location, injected context stops lying, and the expensive review fan-out is guarded by a sub-second structural check. All six changes trace to one real run that shipped an empty final milestone — and the review pipeline spent ~$10 rediscovering it.

Added

• Runtime-facts block in every codergen prompt (#347). Every agent prompt opens with a machine-written # Runtime section: the absolute working directory (“all commands already run here; never cd elsewhere”), the current date, and the run/node identity. In the case-study run, an agent cd'd to a hallucinated path, read the resulting clean tree as “the milestone is already complete,” and shipped nothing. Covers all three backends uniformly; codergen nodes only.
• build_product: structural existence gate before the review fan-out (#350). A sub-second CheckMilestoneOutputs tool node reconciles the outputs Decompose declared (per-milestone **Files**: lists) against what is on disk, on both fan-out entries. A missing declared directory or a broken go build ./... escalates to a human before any reviewer token is spent; missing files alone only warn — deletion milestones are legitimate.

Fixed

• Top-level tool_access: now actually restricts the agent (#366). The dippin adapter dropped the typed IR field, so the documented tool_access: none spelling was silently ignored at runtime — the agent ran with its full tool surface. The typed field now propagates into node attrs, with precedence over the params: spelling (which already worked).
• Context injection capped and one-shot (#352 items 1–2). The auto-appended “Previous Node Output” is capped at 4KB — head+tail truncation with an explicit elision marker, per-node injection_cap override — instead of pasting whole 9KB transcripts into every downstream prompt and mis-anchoring reviewers. And a human gate's response is consumed by the first prompt-consuming node instead of replaying one stale “approve” into every later prompt as implied sign-off; the gate's scoped node.<id>.human_response copy keeps it for explicit reference, and the clear persists across checkpoint resume.
• FinalCommit is commit-only in both build_product workflows (#349). A failure report in context once led the commit node to author an entire missing milestone (~700 lines) through zero quality gates. FinalCommit now stages and commits existing work only, fails closed on truncation, and escalates instead of implementing.
• .tracker/ run metadata stays out of the product repo (#351 items 1–2). CommitIfDirty's git add -A swept run internals into checkpoint commits, polluting history and drowning the per-node build-context file. Setup now excludes .tracker/ via .git/info/exclude and untracks anything a pre-fix run already committed.

Two gate-integrity holes that let a failed run report success are closed. Both came from one real case-study run that finished “completed” with its final quality gate at outcome: fail: the gate's verdict arrived as a markdown heading the parser missed, and the goal-gate retry replayed the escalation tail without ever re-running the gate.

Fixed

• auto_status no longer fails open on goal gates, and heading-mangled STATUS lines parse (#346). Leading markdown heading markers are stripped so ## STATUS:fail registers like the bold shapes from #233; and when an auto_status node completes with no parseable STATUS line, goal_gate: true nodes resolve to fail — an unparseable verdict on a gate is an anomaly, not a pass. Plain auto_status nodes keep the legacy success default. Either way the anomaly is observable: a new auto_status_missing audit event lands in activity.jsonl and tracker diagnose surfaces a per-node suggestion.
• Goal-gate retry re-executes the gate instead of replaying the escalation tail (#348 defect 1). A persisted gate_recheck_pending marker keeps redirected gates visible to the exit-time check even after clearDownstream drops them from the completed set, and a still-pending gate re-enters at the gate itself so remediation done on the escalation path gets re-judged — a budget-free completion of the redirect cycle that fires even with max_retries: 1. A never-satisfied gate now drains its budget and fails the run instead of reporting plain success. Checkpoint-resume deterministic; fix-loop retry targets behave exactly as before.

A parallel fan-out can finally demand that every branch succeed — and four LLM stream adapters stop swallowing mid-stream errors. Parallel and fan_in nodes accept a configurable aggregation policy (any / all / quorum), so a single failed adversarial reviewer can no longer be masked by success-if-any. A full-project fresh-eyes review landed 25 individually verified fixes, and build_product now tests every detected language stack in polyglot repos.

Added

• Configurable parallel fan-in aggregation policy (#313 defect 1). Parallel and fan_in nodes accept a params: block (dippin-lang v0.39.0) with fan_in_policy: any | all | quorum (plus quorum: <n>). Default stays any (success-if-any, back-compat); both aggregation code paths honor the policy, misconfiguration fails fast, and a policy-caused failure names the failed branch IDs in EventParallelCompleted and the fan_in.policy_detail context key. build_product's ReviewParallel opts into all, routing a single failed reviewer to EscalateReview instead of silently proceeding with a partial review set.

Fixed

• Fresh-eyes review: 25 verified fixes across stream-error surfacing, pipeline core, CLI, handlers, TUI, and examples (#356). Mid-stream SSE errors now surface on all four providers (Anthropic overloaded_error/rate_limit_error events, Gemini {"error":...} chunks, OpenAI unparseable error payloads, openai-compat code/type-only errors); interleaved tool-call starts no longer drop the first call's arguments; ExpandGraphVariables is a true single pass (no prefix clobbering, substituted values never re-scanned); tracker update stages binaries under collision-proof temp names with close-error checks; ACP init failures reap the subprocess; webhook gates abort their in-flight POST on cancel; TUI search highlighting survives UTF-8 width-changing lowercasing.
• build_product runs ALL detected build stacks in TestMilestone and FinalBuild (#305). The first-match if/elif chain skipped every stack after the first — a Go+JS repo never ran npm test. Every detected stack now runs and failures accumulate; sentinels, known_failures skips, and single-language behavior unchanged.

Tool subprocesses learn the run's identity, and build_product's CI gate stops crying wolf to humans. Locally-executed tool subprocesses now carry TRACKER_RUN_ID / TRACKER_RUN_DIR / TRACKER_WORKDIR, closing the tool_access: none agent → tool data-flow gap without the concurrent-run-unsafe ls -dt mtime heuristic. Multi-file workflow trees also get two quality-of-life fixes: graph.workflow_dir seeding and command_file: resolution on the raw .dip load path.

Added

• Run identity env vars in tool subprocesses (#323). Locally-executed tool commands receive TRACKER_RUN_ID, TRACKER_RUN_DIR (the same root WriteStageArtifacts uses), and TRACKER_WORKDIR — so a downstream tool can cat "$TRACKER_RUN_DIR/<NodeID>/response.md" for a specific upstream agent's output. Injected after sensitive-env filtering (and under TRACKER_PASS_ENV=1); operator exports of the same names are overridden, never duplicated. Env-only — no new ${ctx.*} expansion keys.
• graph.workflow_dir seeded from the pipeline file's parent directory (#332). Workflows reference sibling files from any cwd: command: bash ${graph.workflow_dir}/scripts/setup.sh. Not seeded for embedded built-ins or .dipx bundles; an author-declared attr is never clobbered.

Fixed

• build_product: a failing make ci/check/lint target no longer escalates to a human as “make not installed” (#320). GNU make exits 2 on any recipe error, colliding with the rc=2 the CI probe reserves for make-missing — so fixable failures skipped the fix loop and reset the circuit breaker. Make failures now collapse to rc=1; rc=2 is sole-sourced to the command -v make check.
• exec * denylist no longer false-positives on fd-only redirects (#333). POSIX idioms like exec 3>"$tmp" / exec 3>&- are exempt from the built-in pattern; the exemption fails closed (command substitution, unbalanced quotes, or any bare command word stays denied), and denylist matching is now whitespace-normalized so tab-separated commands can't evade space-separated patterns.
• Raw .dip load path resolves command_file: / prompt_file: / system_prompt_file: (#331). Multi-file workflow trees run via tracker /path/to/foo.dip from any cwd; resolution failures are fatal and name the node ID and path.

Epic #308 Phases 0–2 land — build_product no longer dead-stops, loses work, or builds on a broken spec. The epic's case study was a real run that went green, exhausted its turn budget before committing, and silently halted the whole pipeline — skipping the entire cross-review safety net. Phase 0 stops the bleeding (failure routing at both the engine and workflow layers), Phase 1 preserves work (commit-WIP, commit-first discipline, turn-limit guard), Phase 2 enforces quality regardless of spec or language (language-native gates, requirement coverage, spec-coherence preflight). Also ships reasoning_effort for Anthropic/Gemini and the dippin v0.38 pin.

Added

• Spec-coherence preflight (SpecLint) in both build_product workflows (#301). Runs once, strictly before any decomposition; hard-fails dangling doc/section refs, contradictory constants, contract/signature mismatches, and unassignable mandated tests; warns on uncheckable guarantees and contradicting example code. Findings with evidence land in .ai/decisions/spec-quality.md; fails closed via the auto_status last-line-wins STATUS contract.
• reasoning_effort wired through to Anthropic and Gemini (#329). Anthropic maps to output_config.effort; Gemini 3+ maps to thinkingConfig.thinkingLevel (dropped for Gemini 2.5 and earlier, which reject it).
• Operator-decision gate + warm continue +N for steady-progress turn breaches (#318). A turn-limit breach that classifies as steady progress routes to a freeform human gate (stop / abandon / commit-advance / continue) with a deterministically safe stop default for unattended runs.
• Graph-level on_failure default failure route (#309, with dippin-lang v0.38). Authors declare one fallback instead of wiring fail edges per node; node-level routes take precedence.

Changed

• dippin-lang pin bumped v0.35.0 → v0.38.0 (consumes graph-level on_failure, the agent-failure-route lint, and declarable budget/limit attrs).
• build_product: no-requirement-left-behind (#300) — Decompose builds a requirement-coverage table (every spec-mandated verification owned or explicitly deferred); Verify enforces owner-or-fail.
• build_product: language-native quality gates when no Makefile exists (#299) — go vet / golangci-lint / tsc / eslint / ruff / mypy / cargo fmt+clippy fallbacks in the shared CI probe.
• build_product: per-node build-context file (#298) cures rediscovery amnesia — agents stop re-burning ~20% of each turn budget re-reading the repo.
• engine: turn-limit breach = guard, not guillotine (#303) — verify → commit-if-green → classify before any routing decision.
• engine: commit-WIP to a recoverable ref before routing a failed/exhausted node (#302); build_product: commit-first / stop-when-green + CommitIfDirty checkpoint (#297).
• TRACKER_GATEWAY_KIND routing dispatch for bedrock-style gateways (#276–#278) with tracker doctor routing notes and operator docs.

Fixed

• Unhandled agent failure no longer dead-stops the pipeline (#295) — routes to fallback_target / graph on_failure; every build_product agent node routes failure/turn-exhaustion to escalation (#296).
• A silently-missing cross-review report can no longer reach FinalBuild (#313 guard) — CheckReviewsComplete fails the gate when any of the three review reports is missing or empty.

Joint-release closeout for tracker v0.35.0 ↔ dippin v0.35.0. go.mod swaps the joint-release-window pseudo-version (v0.34.1-0.20260601154018-792e6e644e9f) for the published dippin v0.35.0 tag. PinnedDippinVersion in tracker_doctor.go updated in lockstep. No functional changes vs v0.35.0 — the underlying dippin code is byte-identical (792e6e6 is the commit dippin v0.35.0 tagged). Same shape as the v0.31.0 → v0.32.0 closeout.

Changed

• dippin-lang dependency bumped to v0.35.0 tag. go.mod swaps the joint-release-window pseudo-version (v0.34.1-0.20260601154018-792e6e644e9f) for the published v0.35.0 tag. PinnedDippinVersion in tracker_doctor.go updated in lockstep.

Closes Gap 5.2 of #233 (#271). Runs that accept a failed validation through a human gate now terminate as a new fourth status — validation_overridden — instead of being silently bucketed as success. The audit trail, JSON output, TUI completion row, and exit code can all distinguish operator-accepted overrides from clean successes.

Added

• New terminal EngineResult.Status value validation_overridden. Runs that traverse a wait.human gate edge marked override: true in their .dip workflow now terminate with Status == "validation_overridden" instead of "success", recording in the audit trail that a non-workflow decision (a human at the TUI, an autopilot persona, or a webhook callback) accepted a result the automated checks flagged as failed. The Override: line in tracker audit traces the routing; the --json output carries a stable status_class: succeeded|failed companion field for downstream consumers.
• New edge attribute override: true in .dip syntax, valid only on edges from wait.human nodes. Adapter rejects misuse at compile-time.
• New CLI flag --fail-on-override (and env var TRACKER_FAIL_ON_OVERRIDE=1, strict-=1 parsing matching the existing TRACKER_PASS_* convention). Causes tracker run to exit code 2 (distinguishable from generic-fail exit 1) when a run terminates as validation_overridden. Default unchanged: exit 0.
• New dippin doctor lint rule TRK102 (warn-level): fires on wait.human edges with label accept / mark done / approve (case-insensitive) that route to a forward-progress target, are upstream-reachable from an outcome = fail edge, and lack override: true. Surfaces the migration opportunity without false-positive on plan-approval gates.
• TUI live override rendering: MsgPipelineCompleted gains a typed Status field; the TUI completion row renders the amber override badge in real-time. No more identical green badges for success and validation_overridden.

Changed

• Library-API delta: EngineResult.Status, tracker.Result.Status, tracker.AuditReport.Status, tracker.RunSummary.Status are re-typed from string to pipeline.TerminalStatus (a named string type). Existing literal-string comparisons (result.Status == "success") continue to compile and produce the same answer. Assignments from a string variable into a Status field require an explicit cast — this is the one breaking change in the re-typing. Embedded library callers should migrate to the new TerminalStatus.IsSuccess() helper for forward-compat across future status additions.
• New exported symbols (additive): pipeline.TerminalStatus (type), pipeline.OutcomeValidationOverridden, pipeline.OverrideDetail, pipeline.Actor (type), pipeline.ActorHuman / ActorAutopilot / ActorWebhook / ActorUnknown, pipeline.Edge.Override, pipeline.Outcome.ChildOverride, pipeline.Outcome.OverrideActor, pipeline.EngineResult.ValidationOverrides, pipeline.Checkpoint.ValidationOverrides, pipeline.EventValidationOverridden, pipeline.PipelineEvent.Override, pipeline.ErrValidationOverridden. Plus mirrored fields on tracker.Result, tracker.AuditReport, tracker.RunSummary, tracker.DiagnoseReport.
• tracker_audit.AuditReport.Recommendations is no longer alphabetically sorted — entries appear in priority order (override notes first, then per-override entries chronologically, then retry/budget notes). Downstream tools that sort on receipt are unaffected; tools that displayed in receive-order will see a different order.

Fixed

• tracker_audit.classifyStatus previously collapsed budget_exceeded events to "fail", so tracker audit and tracker list reported budget-halted runs as failures. Audit surfaces now surface budget_exceeded correctly. User-visible behavior change: scripts filtering on status == "fail" will see budget-halted runs move out of the fail bucket into a new budget_exceeded bucket. Update filters to status_class == "failed" (introduced in this release) for a stable bucket that survives future enum extensions.

Operator notes

Two surfaces silently change behavior on upgrade:

1. Monitoring dashboards filtering JSON output on status == "success" will silently undercount completed runs. Override runs surface as status == "validation_overridden" — update filters to status_class == "succeeded" or to the union status IN ("success", "validation_overridden").
2. Scripts counting failed runs via status == "fail" will see budget-halted runs disappear from the failure bucket. Update to status_class == "failed" for a stable bucket.

CI integrations that should NOT auto-deploy on overrides must opt in with tracker run --fail-on-override workflow.dip && deploy.sh. Without the flag, override runs exit 0 — the default treats them as audit-positive deliberate operator decisions.

The workflows/ mirror is gone — built-in workflows are now embedded directly from examples/ via explicit-file //go:embed lines (#256). No functional change for CLI users. The library-API WorkflowInfo.File field now reports paths with the examples/ prefix instead of workflows/ — the only externally visible delta.

Changed

• Collapsed workflows/ mirror into examples/ via explicit-file go:embed (#267). The repo previously kept four byte-identical copies of the built-in workflow .dip files under workflows/ and examples/, synchronized by a make sync-workflows / make check-workflows target, a pre-commit gate, and a CI step — guardrails that still let the two copies drift three times. The //go:embed workflows/*.dip glob is replaced with four explicit //go:embed examples/<name>.dip lines pointing directly at the canonical copies. The workflows/ directory and all of the sync infrastructure (Makefile targets, pre-commit gate #9, CI Embedded workflows in sync step) are deleted. WorkflowInfo.File (library API) now reports paths with the examples/ prefix instead of workflows/; that's the only externally visible delta. ~3,200 lines deleted net.

The last two visible build_product audit gaps from #233 close. The eight-gap audit thread is now down to a single design-scope follow-up — Gap 5.2 (OutcomeHumanOverride), tracked separately because pipeline.Outcome has wide blast radius across every consumer.

Changed

• Gap 5.1 — parseAutoStatus tolerates markdown-emphasis on STATUS lines (#263). The audit observed **STATUS: fail** (bold) silently falling back to the default success because HasPrefix("**STATUS:", "STATUS:") returns false, and LLMs commonly bold/italicize STATUS lines when they want the verdict to draw the eye. parseStatusLine now strings.Trims the line and value with the "*_" cutset, so **STATUS: fail** / *STATUS: fail* / STATUS: **fail** / __STATUS: success__ all parse correctly. Locked semantics from TestParseAutoStatus_V3FailFirstContract are unchanged: last-line-wins + default-success-on-empty. New regression coverage in TestParseAutoStatus_Gap5_1_AuditedShapes (11 sub-tests) — six previously RED, now GREEN; five pin existing behavior (uppercase value, whitespace trimming, last-wins under emphasis, code-fence skip).
• Gap 5.3 — build_product re-runs reviewers after ApplyReviewFixes with a one-shot budget (#264). Pre-fix, the workflow only ran reviewers once and routed straight to FinalBuild after fixes, so a fix commit introducing W4 (zero-assertion stubs), W5 (wrong-target tests), or W13 (DI bypass) regressions reached Done unchecked — FinalSpecCheck per Gap 8 v5 scopes to W17 + iface + SPEC.md and explicitly delegates W4/W5/W13 to reviewer rubric point 3, which only ran pre-fix. New CheckReviewFixBudget tool node increments .ai/build/review_fix_attempts and routes ApplyReviewFixes → CheckReviewFixBudget → ReviewParallel restart:true (one re-review pass) or → EscalateReview (budget exhausted, MAX_ATTEMPTS=1). A ResetReviewBudget tool node sits on the EscalateReview "retry" → Decompose edge so the counter clears when the human picks retry — otherwise the stale counter would immediately fail-close the retry's first re-review pass (caught by Codex / Copilot during PR review). Pattern mirrors the existing TestMilestone fix_attempts precedent.

Joint-release closeout for #258 / dippin-lang#41. v0.31.0 shipped with a transient pseudo-version pin pointing at the dippin-lang#41 merge SHA because dippin v0.32.0 didn't exist yet when tracker was tagged. dippin v0.32.0 (whose go.mod pins tracker v0.31.0) is now published, so tracker v0.32.0 swaps the SHA for the tag. No functional changes vs v0.31.0 — the underlying dippin code is byte-identical. Joint-release loop closed: tracker v0.32.0 ↔ dippin v0.32.0 mutually pinned, both tags published.

Changed

• dippin-lang dependency bumped to v0.32.0 tag (#261). go.mod swaps the joint-release-window pseudo-version (v0.31.1-0.20260526211025-53c24f13a4d0) for the published v0.32.0 tag. PinnedDippinVersion in tracker_doctor.go updated in lockstep. The window-godoc paragraph explaining the transient pin was removed since the swap is now complete.

Two more build_product audit gaps closed plus new tool_access runtime enforcement bounding the v0.28.2 single-agent multi-tool-call vector. Seven of the eight #233 audit gaps now closed (1, 2, 3, 4, 6, 7, 8); only Gap 5 (engine-level auto_status audit + OutcomeHumanOverride + post-ApplyReviewFixes re-check) remains as a follow-up.

Added

• tool_access: none runtime enforcement on agent nodes (#258, joint with dippin-lang#41). Bounds the v0.28.2 single-agent multi-tool-call vector: an LLM emitting [bash(...), write(...), bash(...)] in one response would otherwise dispatch all of them before max_turns checks the cap. With tool_access: none set on an agent node, tracker hands the LLM zero tools so the response comes back as plain text. Defense in depth: built-in registry gate + post-WithTools registry clear in NewSession + request.ToolChoice = ToolChoiceNone() + executeToolCalls early-exit + Params-bypass defense (allowed_tools / disallowed_tools / permission_mode ignored when tool_access is set). Backend coverage: native full honor; claude-code best-effort via --disallowedTools enumeration; ACP refuses session creation with a clear error pointing to #258 (no verified deny-equivalent yet). Fail-closed for typos — noen / None / off all disable tools so a misspelling can't ship full tools.

Changed

• build_product Gap 7 — interface-method reachability (#254). FinalSpecCheck now enforces that every interface method defined in the codebase has a non-test production caller, with shown-work grep evidence. Setup writes .ai/build/iface-reachability-rubric.md (language detection + per-language enumeration patterns + caller-discipline rules + stdlib carve-out principle + waiver discipline + known-limitation skips) and the prompt + three reviewers reference it so the discipline lives in one place. The prompt opens with an inverted STATUS contract — STATUS:fail as the FIRST line, STATUS:success as the LAST line only on full pass — so a truncated response fails closed under last-line-wins parsing, defending against the parseAutoStatus default-success-on-empty shape that was the original Gap 7 bug. Reviewer rubric point 2 strengthened from 3-line prose to 9-line shown-work-grep requirement matching point 1's standard.
• build_product Gap 8 — test-quality smells (#257). FinalSpecCheck adds a sleep-as-fence section restricted to tracked test files via git grep (so dependency dirs like node_modules/, vendor/, .venv/, target/ are excluded by construction); each hit needs disposition — cite a SPEC.md timing-contract section, OR cite a deterministic primitive that replaced the sleep, OR a .ai/decisions/ waiver naming the specific test. Reviewer rubric point 3 strengthened across all three reviewers: Gemini's "stdlib-only tests FAIL" sentence promoted to ReviewClaude and ReviewCodex (covers W5 wrong-target), plus shown-work demands for zero-assertion test bodies (W4) and DI bypass when a Clock/Random/IO seam exists (W13). The legacy STATUS tail at FinalSpecCheck was rewritten to align with PR #254's inverted contract. W21 (Go subtest case-fold collision) is explicit non-goal — golangci-lint territory.

build_product workflow hardened against five of the eight failure modes the #233 audit uncovered. The audit ran build_product end-to-end on a real Phase 1 spec and found 38 issues the workflow declared "Done" on — wrong API shape, off-by-one retries, red CI, dead interface methods, Phase-6 features built in Phase 1 with green tests pinning the bug. Five gaps closed in this release; three (Gap 5 auto_status engine audit, Gap 7 interface reachability, Gap 8 TestQuality step) remain.

Changed

• build_product Gap 1 — project CI gate (#246). TestMilestone + FinalBuild now probe for a project Makefile and run the first defined target out of ci / check / lint (parsed via sed+awk that handles multi-target rules and rejects variable assignments); a missing make binary fails loud instead of silently skipping. The probe lives in a shared .ai/build/ci-probe.sh written by Setup, sourced by both nodes — round-5 review found the awk had silently drifted between the two pre-shared-file copies; this prevents that class of bug.
• build_product Gaps 3 + 6 — spec-literal anchoring + DO NOT list (#246). Implement carries explicit "spec literals are contracts" + "tests verify the contract, not your code" + "snapshot tests must be hand-verified" rules. Decompose now produces a per-milestone "DO NOT implement" list (Phase 2+ scope) so deferred-phase affordances stay inert — green tests on Phase-6 features built in Phase 1 was a top-5 audit finding.
• build_product Gap 2 — cross-reviewer rubric overhaul (#249). The three cross-reviewers (ReviewClaude, ReviewCodex, ReviewGemini) now share a 5-point structured rubric (spec literals grep, interface reachability, test-verifies-contract, scope, architecture); each carries a "do not trust spec ✅ markers" warning; ReviewGemini is now explicitly adversarial ("faithful and high-quality realization" is a forbidden phrase); SynthesizeReviews weights findings by evidence not vote count, so a single reviewer with grep / file:line evidence flips STATUS:fail over two evidence-free PASSes. Synthesis missed ~33 of 38 real audit findings pre-#249.
• build_product Gap 4 — VerifyMilestone reads SPEC.md (#249). VerifyMilestone now reads SPEC.md directly (not just the milestone notes), runs spec-literal greps inline (with a .ai/decisions/ documented-deviation carve-out matching Implement's contract), applies the test-asserts-contract check, and confirms tests + CI passed via the tests-pass sentinel rather than scanning for visible test output (which the 64KB stdout tail-cap routinely elides).
• dippin-lang dependency bumped v0.27.0 → v0.29.0 across two passthrough PRs (#248, #250). ir.ToolConfig gains MarkerGrep / RouteRequired / OutputLimit / Outputs adapter forwarding; dippin-side polish lands lint suppression on marker_grep tools (DIP138), parseBoolAttr normalization (yes / 1 / TRUE now parse correctly on goal_gate / auto_status / cache_tools / route_required), and Outputs DOT round-trip parity.

Maintenance release — picks up dippin-lang v0.27.0 (2026-05-18 model/pricing catalog refresh). Combined with v0.29.1's lint deduplication, DIP108 now covers the full current catalog so workflows using gemini-3-flash-preview, redirected grok-4-1-fast-* IDs, and other recent models validate clean. No tracker-side feature changes; no breaking changes.

Changed

• dippin-lang dependency bumped v0.26.0 → v0.27.0 (#242). Picks up the 2026-05-18 model / pricing catalog refresh and a bug fix where redirected grok-4-1-fast-* IDs stay callable when their target gets renamed. No IR or adapter changes — drop-in. PinnedDippinVersion in tracker_doctor.go updated in lockstep so tracker doctor's dippin-version mismatch check uses the new pin.

Defers all DIP-coded lint to dippin-lang. Tracker had been maintaining a parallel implementation of DIP101–DIP112 + DIP120–DIP121 in pipeline/lint_dippin*.go while already calling validator.Lint() from dippin on every .dip / .dipx load — and the duplicates had drifted, producing false-positive warnings on current model names like gemini-3-flash-preview even though dippin doctor accepted the same file cleanly.

Changed

• Single source of truth for DIP-coded lint (#239, #240). Deleted pipeline/lint_dippin.go + lint_dippin_extra.go (660+ lines covering DIP101–DIP112 + tracker's local DIP120 / DIP121, which semantically collided with dippin-lang's own DIP120 / DIP121 — different checks under the same codes). Tracker now has zero DIP-coded lint implementations; dippin-lang/validator.Lint() is the sole authority and a model catalog edit happens in one place. Lint warnings still surface through tracker validate / simulate / doctor via the new Graph.LintWarnings field, populated by LoadDippinWorkflowFromIR from dippin's lint output and appended to ValidateAll's warnings channel.
• validateNodeAttributes gated behind !g.DippinValidated. The typed-attribute checks (max_retries, cache_tool_results, context_compaction, context_compaction_threshold) were re-validating fields that dippin's typed IR already enforces at parse time and DIP116 lints for range. Worse, tracker errored when compaction_threshold = 0.0 while dippin only warned — exactly the kind of "dippin doctor and tracker validate disagree" divergence the architecture is supposed to prevent. The gate matches the existing pattern for DIP001–DIP009 structural checks: .dip sources defer fully to dippin; DOT graphs and programmatically-constructed graphs still get the runtime sanity checks.
• TRK1XX rules retained. LintTrackerRules (currently TRK101, the tool_stdout tail-window routing pitfall from #208 / #210 / #211) stays — those encode tracker-runtime concerns that don't belong upstream.

Workflows can now declare environmental dependencies in the header (requires: <list>) and tracker preflights them before any node runs — failing in seconds with a copy-paste remediation instead of burning $20–$100 of LLM spend before the first git operation. Requires dippin-lang v0.26.0.

Added

• requires: workflow header keyword (#234). Comma-separated dependency list in the .dip workflow header. v0.29.0 implements git: when declared, tracker verifies git is installed AND the workdir is inside a real work tree AND HEAD points at a real commit before any node executes. Unrecognized entries (docker, gh, jq, etc.) parse fine and emit a "not yet implemented" warning so workflow authors can forward-declare deps that future tracker versions will check. The mechanism lives at the library + CLI boundary, not inside the engine — pipeline.Preflight is invoked once at run start; subgraph and manager_loop children inherit the parent's check.
• --git=auto|off|warn|require|init CLI flag overrides policy per run. Default auto respects the workflow's requires:. off bypasses, warn downgrades hard-fails to warnings, require forces the check even if not declared, init (with mandatory --allow-init latch in non-interactive runs, or a [Y/n] prompt in interactive runs) auto-runs git init + an empty initial commit so HEAD is born and worktree workflows work immediately. Safety refusals fire for $HOME, /, and nested git contexts — bare repos, linked worktrees (.git is a file), submodules (same); $HOME and root comparisons fold case on Windows. Auto-init refuses in non-empty workdirs rather than silently git add -A-ing content that might be secrets / build artifacts. All git probes run under LANG=C LC_ALL=C so the "not a git repository" stderr classifier is stable on localized installs.
• Born-HEAD check via git rev-parse --verify HEAD^{commit}. --is-inside-work-tree returns true for a git init'd repo with no commits, so without this probe a requires: git workflow could pass preflight and crash mid-run on git worktree add ... HEAD after burning LLM turns. ^{commit} forces commit peeling so a dangling/non-commit OID at HEAD doesn't masquerade as born. Stderr is inspected via the two upstream-stable phrases (Needed a single revision, unknown revision or path not in the working tree) so corruption-class errors surface as wrapped errors instead of collapsing to "unborn."
• tracker doctor Git Requires check previews the runtime decision: OK (env satisfies requires: git, or --git=init --allow-init would succeed in this clean dir), Warn (downgrade under --git=warn, or auto-init OK + unknown deps surfaced), Error (hard-fail), Skip (--git=off). The Hint field carries the exact remediation command including dual paths for non-repo / unborn-HEAD cases (capture existing files vs empty baseline).
• Library API surface. tracker.Config.Git *GitConfig for embedded callers (zero value resolves to GitPreflightAuto). GitPreflight constants re-exported from the tracker package. tracker.WithGitConfig(policy, allowInit) functional option for tracker.Doctor. pipeline.SafetyLatches, pipeline.HasBornHEAD, pipeline.WorkdirHasContent exported so Doctor preview models the same latches the runtime preflight enforces. tracker.NewEngineWithContext(ctx, source, cfg) is the ctx-aware constructor so cancellation reaches every git subprocess including the --git=init side effect.
• Built-in workflows that commit / branch / merge mid-run declare requires: git — ask_and_execute, build_product, build_product_with_superspec. Running them in a non-git directory now fails in seconds with copy-paste remediation instead of burning LLM spend before the first git operation. tracker workflows shows a new REQUIRES column.

Changed

• dippin-lang dependency bumped v0.25.0 → v0.26.0. Picks up ir.Workflow.Requires []string and the parser / formatter support for the requires: workflow header keyword.

Patch release fixing a runaway-agent bug in three of the four built-in workflows. No engine changes; no breaking changes.

Fixed

• Built-in workflows no longer run an unconstrained agent in Start / Done (#230). workflows/ask_and_execute.dip, workflows/build_product.dip, and workflows/build_product_with_superspec.dip (and their examples/ mirrors) defined Start/Done as agent nodes with prompt: Initialize pipeline. / prompt: Pipeline complete.. Because the prompt attribute was present, ensureStartExitNodes skipped the passthrough handler and these nodes became real codergen sessions — system message limited to the file-path reminder, full default tool access (read/write/bash/glob/edit/grep_search), no per-node turn cap. A real build_product run was observed spending ~10 minutes and ~39k output tokens inside Start, implementing an entire separate Go project from a SPEC.md found on disk, before getting context canceled and being classified outcome: retry. Dropping the prompt lines makes Start/Done passthroughs (matching deep_review.dip, which was already correct). The broader engine policy gaps surfaced by this incident — outcome: retry on cancellation, no default max_turns cap, runaway nodes invisible to tracker diagnose, missing tool-call args in activity.jsonl, suspect per-node token accounting — are tracked in #230 for separate follow-up.

Maintenance release — picks up dippin-lang v0.25.0 (.dipx format v1.1). No tracker-side feature changes; no breaking changes.

Changed

• dippin-lang dependency bumped v0.24.0 → v0.25.0. Three bundle-load improvements arrive automatically: dipx.Open cycle detection now walks every manifest-listed workflow (was: rooted only at m.Entry, could miss cycles in entry-unreachable workflows that parseAllWorkflows had already loaded); dipx.Open enriches ErrManifestInvalid / ErrUnsupportedFormatVersion errors with the bundle path; dipx.Pack correctly classifies subgraph parse failures as ErrSubgraphParse instead of ErrEntryParse. Plus context-cancellation through Open / Pack hot paths (per-entry ctx.Err() checks). The Source.Workflow signature change in dippin-lang v0.25.0 doesn't affect tracker — we use Bundle.Entry() / Bundle.Lookup() directly.

The full #208 follow-up arc lands: typed routing channels, validate-time lint, and integrity-protected audit log.

Added

• marker_grep: typed routing channel on tool nodes (closes #210). Declarative regex on a tool node populates ctx.tool_marker from the last match's capture group — routing reads when ctx.tool_marker = pass instead of grepping ctx.tool_stdout. Missing match fails the node with OutcomeFail and emits EventToolMarkerMissing rather than silently falling through. ctx.tool_marker is LLM-origin so it's blocked from tool_command interpolation. Compatible with the v0.27.0 tail-window: regex runs over the captured tail, so end-of-output markers survive by construction.
• _TRACKER_ROUTE=<value> reserved routing sentinel (closes #212). Complement to marker_grep for tools that can't change schema. Runtime scans every tool node's captured stdout for ^\s*_TRACKER_ROUTE=(.+?)\s*$, takes the last match, populates ctx.tool_route. Author pattern: printf '_TRACKER_ROUTE=tests-pass\n' once the routing decision is known, then when ctx.tool_route = tests-pass. Optional route_required: true opts in to strict mode — node fails with OutcomeFail + EventToolRouteMissing if no sentinel was emitted.
• TRK101 validate-time lint for risky tool-stdout routing (closes #211). New TRK1XX namespace (distinct from dippin's DIP1XX). Fires at tracker validate / tracker doctor time on tool nodes that route on ctx.tool_stdout via one conditional + unconditional fallback + no marker_grep + no output_limit + volume-emitting body (tee or 2>&1). Suggests marker_grep as the primary remediation. Heuristics tuned for low false-positive rate across examples/*.dip.
• Activity log integrity hardening (closes #213). Pre-fix, the audit log at <workDir>/.tracker/runs/<runID>/activity.jsonl mode 0o644 was reachable via relative path from any tool subprocess with cmd.Dir = workDir — an LLM-controlled subprocess could inject fake decision_edge lines, truncate to suppress tool_output_truncated, or forge pipeline_completed. (A) Live writes relocated to $XDG_STATE_HOME/tracker/runs/<runID>/activity.jsonl (default $HOME/.local/state/tracker/, mode 0o600, TRACKER_AUDIT_DIR override, %LOCALAPPDATA% fallback on Windows). (B) Every runtime-written line prefixed with \x1f\x1e (pipeline.ActivityLogSentinel); tracker diagnose validates and surfaces non-sentinel lines as SuggestionAuditLogInjection. On Close() a sentinel-stripped snapshot is written to the legacy run-dir path (mode 0o644, O_NOFOLLOW on unix) so bundle export and git_artifacts keep working. Detection-only, not authentication — by design; per-line HMAC was explicitly out of scope.
• Property-based tests for tailBuffer (closes #214). New dev dep pgregory.net/rapid v1.3.0. Generalizes the v0.27.0 hand-rolled boundary tests to the full state space: for any sequence of writes with total N bytes and limit L, tb.String() equals the last min(N, L) bytes. 100 random cases per property, < 2ms per property.

Tail-window tool output capture + diagnostic events for routing-marker truncation.

Fixed

• Tool stdout/stderr truncation now keeps the tail, not the head (closes #208). Pre-fix, the per-stream 64KB cap in agent/exec/local.go kept the first 64KB of output, silently dropping routing markers (printf 'tests-pass') past the boundary — pipeline routing then fell through the unconditional fallback edge and could ship broken code as if it had passed. The notebook_smoke pipeline reproduced this twice in one day. New tailBuffer ring-buffer keeps the trailing limit bytes (O(1) amortized per-byte, single limit-sized allocation, exact tail match regardless of write boundaries). CommandResult gains structured StdoutTruncated / StdoutBytesDropped / StderrTruncated / StderrBytesDropped fields; the in-band "...(output truncated at N bytes)" suffix is gone — consumers must read the new flags (or the new EventToolOutputTruncated event below) to detect truncation. Symmetric for stderr, closing a pre-existing zero-stderr-truncation-tests coverage gap.

Added

• EventToolOutputTruncated activity event (Tier 1). Emitted once per truncated stream after each tool node, with TruncationDetail{Stream, Limit, CapturedBytes, DroppedBytes, TotalBytes}. Written to activity.jsonl so tracker diagnose, tracker.Audit, and NDJSON consumers can detect truncation retrospectively. tracker diagnose surfaces a SuggestionToolOutputTruncated suggestion explaining the elision and pointing at output_limit as the escape hatch.
• EventConditionalFallthrough activity event (Tier 2). Fires when at least one conditional outgoing edge from a node was evaluated, all evaluated false, and routing fell through to a fallback (label, suggested, or weight). Carries the list of ConditionEval{EdgeTo, Condition} entries that missed. Does NOT fire on intentional all-unconditional routing — distinguishes "stated routing intent missed" from "fallback is the only option". tracker diagnose correlates this with EventToolOutputTruncated on the same node and surfaces a combined suggestion ("your routing marker may have been dropped") — the canonical diagnostic narrative for the #208 failure shape.
• Five hardening follow-ups filed from the 6-expert design panel that reviewed the #208 fixes: #210 marker_grep primitive, #211 validate-time lint for risky stdout-routing patterns, #212 _TRACKER_ROUTE reserved sentinel, #213 activity.jsonl integrity, #214 property tests via pgregory.net/rapid.

Native .dipx bundle support across the entire CLI.

Added

• Native .dipx bundle support (#209): tracker now accepts content-addressed .dipx bundles (produced by dippin pack) anywhere it accepts a pipeline file — tracker validate, tracker simulate, tracker run, tracker doctor, and tracker -r <runID> resume. Pre-fix, tracker read the bundle's ZIP bytes as .dip source and failed with bogus DIP001/DIP002 validation errors. New pipeline.LoadDipxBundle opens the bundle via dipx.Open (SHA-256 verifies every file in manifest.json before any content reaches the parser), uses the bundle's pre-parsed *ir.Workflow directly, and bypasses the filesystem subgraph walker entirely since dipx already verifies ref closure + acyclicity on Open. The bundle's content-addressed identity (sha256:<hex>) is stamped on every line of activity.jsonl (engine emissions, parallel/manager_loop emissions that bypass the engine's emit chokepoint, and agent/llm JSONL writes that bypass both — three composable layers), persisted into checkpoint.json for resume verification, and surfaced in tracker list (new Bundle column) and tracker audit (new Bundle: header line). Bundle identity is exposed on tracker.Result.BundleIdentity and tracker.RunSummary.BundleIdentity for embedded library callers. Resume against a .dipx strictly verifies the stored identity matches the one being resumed — mismatch aborts with both hashes shown; --force-bundle-mismatch is the escape hatch (loud warning to stderr).

Changed

• dippin-lang dependency bumped v0.23.0 → v0.24.0 for the new dipx package (Open, Bundle.Workflow, Bundle.Identity). PinnedDippinVersion in tracker_doctor.go updated to match so tracker doctor's version-mismatch check reflects the new pin.
• pipeline.LoadDipxBundle returns diagnostics instead of writing to os.Stderr: the library API no longer prints to the process-global stderr; the signature gains a []validator.Diagnostic return so embedded callers can route them through their own logger. CLI callers (cmd/tracker/loadDipxPipeline, tracker doctor's bundle check) print to stderr as before. Mirrors the existing pipeline.LoadDippinWorkflow contract for the .dip path.

Bedrock Gateway integration polish + Gemini token-usage fix.

Changed

• Bedrock Gateway integration guide refreshed for upstream gateway fixes (#4 Gemini /v1beta paths and #5 Cloudflare AI Gateway native routing prefixes /anthropic /openai /google-ai-studio /compat, both closed 2026-04-30). Tracker's --gateway-url flag now works end-to-end against https://bedrock-gateway.2389-research-inc.workers.dev and provider: gemini is no longer broken. docs/bedrock-gateway.md rewritten to lead with the recommended --gateway-url recipe; compatibility matrix flips Gemini to working; obsolete workarounds dropped. provider: openai (Responses API) row stays as broken pending gateway #3, which was reopened after discovering it had been auto-closed by an unrelated commit's "Fix #3" wording.
• Gemini SSE parser coalesces split finish + usage chunks into a single EventFinish: when an upstream emits the finish reason and usageMetadata in two separate chunks (the bedrock gateway does this; real Google can too), the parser now buffers the finish reason in geminiStreamState.pendingFinish and emits one combined event when the usage chunk arrives. A flushPendingFinish helper guarantees the buffered reason is emitted before every early-return path — clean stream exit, scanner error, JSON parse error — so partial-failure streams still produce a terminal EventFinish ahead of any EventError, preserving accumulator bookkeeping. Net effect: the llm finish trace line prints exactly once per turn regardless of upstream chunking shape.

Fixed

• Gemini token usage no longer reports 0 when the upstream emits usageMetadata as a standalone trailing SSE chunk: tracker's llm/google/adapter.go SSE parser used to bail on any chunk with no candidates array, which dropped trailing usage-only chunks on the floor. Surfaced while smoke-testing tracker against the bedrock gateway where the streaming reply is three chunks: text → finishReason:"STOP" → usageMetadata. End-to-end verified: provider: gemini smoke run now reports 1,408 in / 4 out instead of 0 in / 0 out, and per-provider cost rollup is correct (no double-counting because AggregateUsage folds per-node SessionStats, not per TraceEvent).

Architect-side machinery for local codegen + self-healing declared writes.

Added

• Architect-side machinery for local codegen: new agent-runtime primitive TerminalTool ends the session loop the moment a tool flagged terminal succeeds — no wasted post-dispatch turns. Three new tools land via env-gated registration (TRACKER_SPRINT_WRITER_MODEL / TRACKER_CODEGEN_MODEL): dispatch_sprints reads a {path, description} JSONL plan and runs the per-sprint author+audit pipeline once per line via a deterministic in-tool loop with bounded retry+backoff for transient provider errors (5xx, rate-limit, timeout, network); write_enriched_sprint calls a mid-tier LLM once per sprint with a 4-strategy SEARCH/REPLACE matcher (exact → indent-preserving → whitespace-insensitive → fuzzy with Levenshtein ratio ≥ 0.9), partial-apply semantics distinguishing PATCHED-PARTIAL from clean PATCHED, and a tolerant audit-verdict parser; generate_code expands a contract into one or more files via a cheap/fast model. Validated end-to-end on Notebook synthetic (41/41 pytest passing, ~$2, 28min) and NIFB architect-only (16 sprints, ~$5, 47min).
• Self-healing JSON extraction cascade for declared writes: when an LLM responds with prose instead of valid JSON for a node with writes:, the runner now attempts (1) direct JSON parse; (2) extraction of any ```...``` fenced block via a strict-shape regex (so a text/bash preamble and stray inline backticks don't fool it); (3) balanced-brace scan for the first top-level {…} span that parses as an object (handles prose with stray brace pairs around real JSON; { inside JSON-string values and inside […] arrays correctly skipped); (4) single-key fallback to the raw response with writes_warning, capped at 8 KiB. Multi-key writes still hard-fail. Fallback is gated on "no extractable JSON found" — a model that returned valid JSON missing the declared key gets a hard contract failure with a specific error.
• Bedrock Gateway integration guide: new docs/bedrock-gateway.md walks through pointing tracker at the 2389 Cloudflare Worker — per-provider *_BASE_URL recipes, provider compatibility matrix, authentication via Cloudflare AI Gateway tokens, and verification guidance.

Changed

• writes: declarations are rejected when they collide with reserved key names: two reserved sets — (a) the tool_command safe-key allowlist (outcome, preferred_label, human_response, interview_answers); allowing writes: outcome would funnel LLM-controlled content into a reserved name and bypass the sanitization that keeps LLM output out of shell input. (b) the writes-signal keys (writes_error, writes_warning); allowing them via writes would let an LLM spoof a failure/healed signal that tracker diagnose and when ctx.writes_error != "" edges branch on. Collision rejection runs before any value is written. No existing pipelines used these collisions.

Fixed

• tracker doctor provider probe restored to 16-token max output: the probe had been using maxTok:= 1, but OpenAI's Responses API requires max_output_tokens ≥ 16 and returns HTTP 400 (Invalid 'max_output_tokens': integer below minimum) below that — breaking tracker doctor for OpenAI keys entirely.

Security and correctness fixes from a 13-expert panel audit of v0.24.1.

Fixed

• ACP CreateTerminal now validates commands against the built-in denylist and constrains cwd to the working directory: previously an LLM-directed ACP agent could execute arbitrary commands, completely bypassing the denylist that protects tool_command. Bare denylisted commands (e.g. eval with no args) are also blocked.
• Claude Code backend kills subprocess process group on pipeline cancellation: added SysProcAttr.Setpgid + cmd.Cancel (SIGKILL to process group) to prevent orphaned claude subprocesses consuming API credits after ctrl-C or budget breach.
• TRACKER_PASS_API_KEYS now requires =1 instead of any non-empty value: previously TRACKER_PASS_API_KEYS=false or =0 silently leaked all API keys to the claude subprocess. tracker doctor env warning updated to match.
• Engine fails on unknown outcome status instead of treating as success: the default: case in handleOutcomeStatus previously called MarkCompleted, silently promoting handler bugs to success. Now emits EventStageFailed and sets OutcomeFail.
• Pipeline goroutine panic recovery: runPipelineAsync now has defer/recover so a handler panic produces a clean error instead of crashing the TUI.
• PinnedDippinVersion updated to v0.23.0 to match go.mod.
• DefaultModel updated to claude-sonnet-4-6.
• Autopilot LLM calls now respect pipeline context cancellation: all call sites used context.Background() — pipeline cancellation had no effect on in-flight autopilot requests.
• Example manager_loop_child.dip updated for steer.* namespace.
• escapeOsascript now escapes newlines to prevent injection in macOS notification strings.

Changed

• stack.manager_loop steer_context keys namespaced under steer.*: prevents collision with safe-allowlisted bare ctx keys used in tool_command variable expansion. Behavior change: pipelines reading steer values via ${ctx.hint} must update to ${ctx.steer.hint}.

Fixed

• claude-code backend now parses cache-token usage from the NDJSON result envelope: the Claude CLI already emits cache_read_input_tokens and cache_creation_input_tokens in its result message, but storeResult was silently dropping both. For heavy-cache Sonnet workloads (typically 60–90% cache-read), that meant ~3× input-cost overcount because llm.EstimateCost priced every input token at the fresh rate. Fix populates *int pointers on llm.Usage so EstimateCost prices cache reads at 10% and cache writes at 25% of the input rate (Anthropic pricing convention). TotalTokens stays fresh-input + output per the cross-provider convention so BudgetGuard's --max-tokens semantics stay uniform.

Added

• TRACKER_ACP_CACHE_READ_RATIO env var for ACP cost-estimate tuning: ACP protocol doesn't expose cache tokens, so the estimator defaulted to pricing all estimated input as fresh. Conservative but up to ~3× high for bridges that keep a stable prompt cache. Setting TRACKER_ACP_CACHE_READ_RATIO to a value in (0, 1] routes that fraction of estimated input to Usage.CacheReadTokens. Typical values for stable-context Claude workloads: 0.5–0.8. NaN/Inf/out-of-range ignored with a one-time warning.
• --tool-denylist-add <glob> CLI flag + tool_denylist_add graph attribute: operators and workflow authors can extend the built-in tool-command denylist with additional glob patterns for defense in depth. User patterns are strictly additive — cannot remove a built-in; --bypass-denylist still disables everything (built-in + user-added); allowlist and user-denylist are independent gates (both must pass). Completes the deferred WorkflowDefaults.ToolDenylistAdd adapter wiring from v0.24.0's dippin v0.23.0 bump.
• Estimated-usage flag plumbed from ACP backend through trace → CLI → TUI → NDJSON: ACPUsageMarker on llm.Usage.Raw is now preserved by a new extractEstimateMarker helper that populates SessionStats.Estimated + EstimateSource before Usage.Raw gets dropped. Trace.AggregateUsage OR-propagates the flag across sessions and child rollups, so any estimated session taints the per-provider bucket and summary. CLI "Tokens by Provider" table suffixes estimated providers with (estimated), total-cost line renders as ~$X.XXXX (estimated), TUI header cost badge prefixes with ~, and NDJSON cost_updated/budget_exceeded events carry CostSnapshot.Estimated. Mixed native+ACP runs no longer misleadingly present heuristic spend as metered.

Fixed

• subgraph nodes no longer bypass --max-tokens/--max-cost budgets: pre-fix, a pipeline author could place cost-intensive nodes inside a subgraph and both token and cost ceilings became silently non-binding. Now child engines inherit the parent's BudgetGuard + baseline-usage snapshot via a new ChildRunContextFromContext(ctx) channel; Outcome and TraceEntry gain a ChildUsage field so child spend rolls up through Trace.AggregateUsage into parent ProviderTotals and fires the parent's guard at the next between-node check. A child-side OutcomeBudgetExceeded propagates as OutcomeSuccess + ChildUsage so the parent's own guard reports the correct halt status instead of tripping the strict-failure-edges rule. Four regression tests cover rollup, delayed parent-halt, mid-subgraph child-guard halt, and two-level nesting.
• stack.manager_loop nodes no longer bypass budgets: same shape of bug as the subgraph fix. ManagerLoopHandler.Execute now reads ChildRunContextFromContext and threads BudgetGuard + baseline usage into the child engine, and handleChildResult sets Outcome.ChildUsage on every return path. Especially load-bearing given manager_loop is the canonical place where tokens pile up — specifically designed for cycle-heavy async supervision (Attractor spec 4.11). Three regression tests mirror the subgraph suite.
• SessionResult.Provider now populated for claude-code and acp backends: previously left empty, so Trace.AggregateUsage bucketed their usage under the "unknown" provider. Dashboards and library consumers reading EngineResult.Usage.ProviderTotals now see populated buckets.
• trackExternalBackendUsage threads cfg.Model into TokenTracker.AddUsage: previously the model arg was omitted, so TokenTracker.CostByProvider's resolver fell back to (often empty) graph.Attrs["llm_model"] and priced at $0. Library tracker.Result.Cost.ByProvider["claude-code"|"acp"] and --max-cost enforcement were silently disabled for those backends.
• llm.EstimateCost logs a one-time warning per unknown model instead of returning $0 silently: violates the project's "never silently swallow errors" rule and hides the real consequence that --max-cost ceilings can't apply to usage priced under a model that isn't in the catalog.
• steer_context keys with : rejected at adapter time: dippin-lang's block-form formatter writes entries as key: value, so a colon in a key breaks .dip → IR →.dip round-trip. flattenSteerContext now returns ErrInvalidSteerContextKey instead of letting the parser drop the key with a diagnostic.
• manager_loop nodes with nil ir.ManagerLoopConfig fail at graph-build time: convertNode previously let a nil Config flow through as a no-op, producing a graph node without subgraph_ref that failed vaguely at Execute-time. Returns ErrMissingManagerLoopCfg instead.

Added

• ACP backend surfaces approximate per-prompt token usage: the Agent Client Protocol spec has no native usage surface, so estimateACPUsage synthesizes llm.Usage from rune counts across six billable channels — cfg.Prompt, cfg.SystemPrompt, assistant text, reasoning chunks, tool-call argument payloads, and tool-call result payloads (full Content + RawOutput, not display summaries). UTF-8 aware via unicode/utf8, ceil(runes/4) applied per side. Usage.ReasoningTokens populated from reasoning runes for future catalog-level per-reasoning pricing. ACPUsageMarker{Estimated: true,...} on Usage.Raw for consumers reading SessionResult.Usage directly; a one-time log per ACPBackend instance announces that ACP numbers are estimates. --max-tokens and --max-cost now enforce against ACP sessions. Remaining intrinsic undercount: the bridge's own injected system prompt + tool schemas are invisible to the heuristic (requires a bridge-specific Meta extension we don't have).
• Example manager_loop pipelines: examples/manager_loop_demo.dip + examples/subgraphs/manager_loop_child.dip exercise subgraph_ref + poll interval + steering against a real child. Both grade A via dippin doctor; the Makefile doctor target runs them in CI.
• Diagnostic warnings for manager_loop authoring mistakes: warn when both unprefixed and legacy manager.* attrs are set on the same node (accidental shadowing); warn on stack.child.<word> references in stop_condition/steer_condition that aren't among the three keys tracker actually publishes (status, cycles, exit_status).

Changed

• dippin-lang dependency bumped v0.22.0 → v0.23.0: upstream ships DIP28 tool-safety defaults. extractWorkflowDefaults wires WorkflowDefaults.ToolCommandsAllow → graph.Attrs["tool_commands_allow"]; the ToolDenylistAdd field is deferred until the matching --tool-denylist-add CLI flag lands.
• Docs relocated under docs/architecture/: docs/pipeline-context-flow.md → docs/architecture/context-flow.md; docs/manager-loop.md → docs/architecture/handlers/manager-loop.md. All inbound links updated.

Added

• ir.NodeManagerLoop adapter support + dippin-lang v0.22.0 bump: .dip authors can now declare stack.manager_loop supervisors directly via the new IR kind instead of reaching for DOT. The adapter maps ir.NodeManagerLoop → shape=house → handler=stack.manager_loop and flattens ir.ManagerLoopConfig into six unprefixed attrs: subgraph_ref, poll_interval, max_cycles, stop_condition, steer_condition, steer_context. steer_context uses canonical sorted k=v,k=v pairs with percent-encoding for ,/=/%, matching dippin-lang's export.flattenSteerContext for lossless round-trips. When a manager_loop is the workflow's Start or Exit, shape is overridden to Mdiamond/Msquare but the handler and flat attrs are preserved so the supervisor still executes.
• ManagerLoopHandler accepts both v0.22.0 unprefixed contract names and legacy manager.* prefixed variants: backward-compatible; unprefixed wins when both are set. parseSteerContext percent-decodes reserved chars so round-trips complete through the handler. Partial steering configs (steer_condition without steer_context, or vice versa) are now rejected at parse time instead of silently rendering the supervisor inert.
• Three new tool-safety CLI flags: --bypass-denylist (bool, default false) disables the built-in denylist with a loud stderr warning on startup — use only in sandboxed environments. --tool-allowlist <pattern> is repeatable and accepts comma-separated glob patterns; every tool command must match at least one allowlist entry when the flag is set. --max-output-limit <bytes> sets the hard ceiling (default 10 MB) applied to per-node output_limit: attrs. Allowlists union with the tool_commands_allow graph attr; the denylist always wins.

Fixed

• formatManagerLoopConditionExpr emits Go-style && / || instead of English and / or. Parsed-only IR conditions (Raw empty) now evaluate correctly through pipeline.EvaluateCondition. CondNot continues to emit not , matching the evaluator's native negation.
• managerAttr uses comma-ok lookup so an explicit empty string on the unprefixed key wins over a non-empty legacy manager.* value. Previously the zero-value check let authors accidentally resurrect values they thought they had cleared.
• parseManagerLoopConfig distinguishes empty vs. malformed steer_context: error now reports "steer_context %q is invalid" with the raw value if it was non-empty, and "steer_context is empty — nothing to inject" only when truly unset.
• tool_commands_allow graph attribute wired so the allowlist is enforceable from a pipeline file as well as the CLI.

Added

• tracker-swebench analyze <results-dir>: Bulk-triage tool for completed SWE-bench runs. Reads predictions.jsonl, run logs, and empty-patch diagnostics, then emits resolved/unresolved/empty/error counts, per-repo breakdown, top-10 empty-patch and longest-unresolved instances, and error class distribution. Auto-detects SWE-bench evaluator reports; --json emits the structured AnalyzeReport.
• Typed NodeConfig accessors on *pipeline.Node: AgentConfig(), ToolConfig(), HumanConfig(), ParallelConfig(), and RetryConfig() return typed structs parsed from Node.Attrs. Graph-default-then-node-override merge is centralized; three-state booleans expose companion *Set flags so callers can distinguish "explicitly configured" from "absent".

Changed

• Codergen handler now consumes AgentNodeConfig instead of eight separate apply* methods re-parsing Node.Attrs. No behavior change.
• Human, tool, and parallel handlers consume typed configs via HumanConfig(), ToolConfig(), and ParallelConfig() accessors. Direct Attrs reads reduced substantially across handlers.
• Tool node timeout errors on zero or negative durations: previously fell through to context.WithTimeout causing immediate cancellation with a confusing error. Validated at handler entry with a clear non-positive timeout message.

Added

• Declarative writes: / reads: unified structured output: Agent, human, and tool nodes can declare the keys they produce and consume. Declared writes are extracted from handler output into the pipeline context and validated; missing required fields fail the node. reads: pins fidelity for the keys a node consumes. Replaces node-type-specific workarounds for threading typed outputs between nodes.
• tracker.SimulateGraph(ctx, graph): Graph-in variant of Simulate for callers that already parsed the pipeline. Simulate() is now a thin wrapper.
• Repository localization pre-processing: Optional pre-scan of the working directory for files relevant to the task prompt, injected as a structured context block before the first LLM turn. Pure text analysis, zero LLM calls. Reduces wasted turns on glob/grep for repository-level tasks.
• Agent episodic memory across retries/resumes: Native codergen sessions record a structured per-tool episode log and inject prior summaries into subsequent retry/resume attempts so the model can avoid repeating failed approaches.
• Plan-before-execute phase: Optional single planning LLM call before the main execution loop. Opt-in via SessionConfig.PlanBeforeExecute or the plan_before_execute node attr.
• Library API godoc, stability policy, and runnable examples: Pre-1.0 stability callout in doc.go; runnable ExampleDiagnose/ExampleAudit/ExampleDoctor.

Changed

• tracker simulate output is now deterministic: Graph attrs sorted alphabetically; orphan nodes appended in sorted order. No more random-map-iteration diffs between runs.

Fixed

• tracker simulate now parses the pipeline source exactly once: Previously double-parsed. No more duplicated dippin-lang lint warnings.
• Cost accounting consistent across runtime and CLI summaries: CLI uses EngineResult.Usage (trace aggregate) instead of TokenTracker; repair turns apply EstimateCost compensation; OpenAI response.completed preserves reasoning tokens; Gemini adapter falls back to requested model when modelVersion missing.

Added

• stack.manager_loop handler: A supervisor node that launches a child pipeline in a goroutine, polls at a configurable interval, and optionally steers the running child by injecting context mid-execution. Config via subgraph_ref, manager.poll_interval, manager.max_cycles, manager.stop_condition, manager.steer_condition, manager.steer_context. Emits stage_started, manager_cycle_tick, and terminal stage events. See docs/manager-loop.md.
• Engine steering channel: New pipeline.WithSteeringChan engine option. Between node executions, the engine drains the channel and merges updates into the run's PipelineContext. Used by manager_loop and available to any supervisor.
• PipelineContext.MergeWithoutDirty: Writes updates without marking keys as dirty so externally-injected values never leak into a node's per-node scope.
• Accurate cost estimation via catalog + cache token pricing: EstimateCost resolves prices through the model catalog instead of a duplicate hardcoded map. Cache reads at 10% of input rate, cache writes at 25%. TokenTracker records observed model per provider.
• Model catalog April 2026 refresh: Adds claude-opus-4-7, gpt-5.4-mini/gpt-5.4-nano, the gpt-4.1 family, o3, o4-mini, GA Gemini 2.5 models, and gemini-3.1-pro-preview. Fixes claude-opus-4-6 pricing and bumps Sonnet/Opus 4.6 context windows to 1M.

Fixed

• ACP path validation rejects .. segments before symlink resolution: Security hardening against a symlink + .. sandbox-escape vector. Splits on both / and \ so Windows paths are protected.
• Manager loop hardening: Poll-timer vs. child-completion race, crash path always returns non-nil error, config validation hard-fails on malformed values, EvaluateCondition errors surface for both stop and steer conditions, EventStageFailed emitted on context cancellation and condition-parse errors.

Added

• Workflow params via ${params.*} with CLI/library overrides: Top-level Dippin vars become params.* graph attrs available in prompts, tool commands, and edge conditions. Repeatable --param key=value on the CLI plus tracker.Config.Params for library callers. Overrides hard-fail on unknown keys. New lint rules DIP120 (undeclared reference) and DIP121 (unused var).
• Per-human-gate timeout / timeout_action in .dip: Exposed by dippin-lang v0.21.0's HumanConfig IR and copied into node attrs consumed by the human handler.
• Workflow-level budget ceilings from .dip: max_total_tokens, max_cost_cents, and max_wall_time in a workflow's defaults: block feed ResolveBudgetLimits. Explicit config/CLI flags still win.
• Library API hardening for v1.0: Typed CheckStatus and SuggestionKind enums; tracker.WithVersionInfo(version, commit) functional option; DiagnoseConfig.LogWriter / AuditConfig.LogWriter; Doctor, Diagnose, Audit, Simulate all take context.Context; provider probe error bodies sanitized; NDJSON writer closures recover from sink panics; Diagnose streams activity.jsonl via bufio.Scanner.
• TUI pre-populates subgraph children in the sidebar: Subgraph reference nodes no longer appear as opaque single rows until child events arrive.
• Agent QoL from SWE-bench: Turn-budget checkpoints at 50%/75%, two-phase verify-after-edit, tool polish (grep context lines, read offset/limit, edit miss context), subprocess group kill for orphan safety. Defaults promoted: MaxTokens: 16384, auto-continue on truncation, LoopDetectionThreshold: 4 — SWE-bench Lite 59% → 70% baseline shift.
• --artifact-dir CLI flag overrides the node state directory.

Changed

• dippin-lang dependency v0.20.0 → v0.21.0. Picks up ${ctx.node.<id>.*} scoped-read lint support.
• BREAKING (library): Doctor, Diagnose, DiagnoseMostRecent, Audit, Simulate all now take context.Context as the first argument. tracker.NDJSONEvent renamed to StreamEvent. NDJSONWriter.Write returns error. DoctorConfig.TrackerVersion/TrackerCommit removed — use WithVersionInfo.

Fixed

• OpenAI Responses API function_call_output / function_call serialization: omitempty on required fields caused OpenRouter's strict Zod validator to reject requests (GLM, Qwen, Kimi). Replaced with MarshalJSON that always emits required fields.

Added

• CLI↔library feature parity — Phase 1 (NDJSON) + Phase 2: Four CLI commands (diagnose, audit, doctor, simulate) and the NDJSON event writer are now public library APIs. Consumers can reuse CLI behavior without shelling out.
• tracker.NewNDJSONWriter: Public writer producing the same wire format as tracker --json. Factory methods for PipelineHandler, AgentHandler, TraceObserver.
• tracker.Diagnose / DiagnoseMostRecent / Audit / Doctor / Simulate: Structured reports with typed suggestions, timelines, check statuses, execution plans, and unreachable-node lists.
• tracker.ListRuns: Sorted []RunSummary for enumerating past runs.
• tracker.ResolveRunDir / MostRecentRunID / LoadActivityLog / ParseActivityLine: Shared run-directory and activity-log helpers.
• tracker.PinnedDippinVersion: Constant exposing the dippin-lang version pinned in go.mod.
• SWE-bench harness (cmd/tracker-swebench): New orchestrator binary evaluating tracker against SWE-bench. Includes Dockerfile, container lifecycle, dataset JSONL parsing, resumable results writer, resource limits, secure --env-file, and an in-container agent-runner that captures changes via git diff.
• WithExtraHeaders option for Anthropic and OpenAI adapters: Injects gateway auth headers (e.g. cf-aig-token).
• Structured reflection prompt on tool failure: When a tool call fails, the session injects a user-role reflection message before the next turn. Default on (ReflectOnError: true), capped at 3 consecutive reflection turns.
• Verify-after-edit loop with auto-test: Session optionally runs tests after any turn with file-edit tool calls. Auto-detection for Go, Rust, npm, Make, and pytest projects. Repair turns don't count toward MaxTurns.

Changed

• CLI diagnose.go / audit.go / doctor.go / simulate.go are now thin printers over the library APIs. Stdout and --json wire format are byte-identical.
• dippin-lang dependency v0.19.1 → v0.20.0.

Added

• Webhook-based human gates for headless execution: New tracker.Config.WebhookGate field and matching CLI flags wire a WebhookInterviewer that POSTs gate prompts to a user-configured webhook URL and blocks on a callback. Per-gate shared-secret tokens (X-Tracker-Gate-Token), per-gate timeout with configurable action, optional outbound Authorization header, HTTP timeouts and 64 KB body cap. Flags: --webhook-url, --gate-callback-addr, --gate-timeout, --gate-timeout-action, --webhook-auth. Mutually exclusive with --autopilot and --auto-approve.
• Cloudflare AI Gateway support: TRACKER_GATEWAY_URL env var and --gateway-url flag route every provider through Cloudflare's AI Gateway. New ResolveProviderBaseURL(provider) helper with priority <PROVIDER>_BASE_URL > gateway URL + provider suffix > empty.
• Library API for workflow catalog and resolution: tracker.Workflows, LookupWorkflow, OpenWorkflow, ResolveSource, ResolveCheckpoint. Config.ResumeRunID equivalent of the CLI's -r/--resume.
• ExportBundle library API + --export-bundle CLI flag: After a run completes, git bundle create --all packages the artifact directory into a single portable file. Clone with git clone <bundle> anywhere.
• WithGitArtifacts engine option: Initializes the artifact run directory as a git repo and commits after every terminal-outcome node. Checkpoint tags (checkpoint/<runID>/<nodeID>) mark each save point.
• tracker doctor comprehensive preflight: Per-provider API key validation with format hints, --probe flag for live auth validation, dippin version compatibility, .ai/ writability, disk space warning (< 10 GB), .gitignore line-by-line check, dangerous env var warnings, --backend claude-code awareness. Exit code 2 for warnings-only.
• Per-node context scoping (ScopeToNode): After each node, every key written during that node's execution is copied into node.<nodeID>.<key>. Downstream nodes read node.MyAgent.last_response for specific upstream output. Bare keys retain last-writer-wins for backward compatibility.
• Cost governance: Result.Cost with per-provider rollup; pipeline.BudgetGuard enforcing MaxTotalTokens / MaxCostCents / MaxWallTime. Halts with pipeline.OutcomeBudgetExceeded and fires EventBudgetExceeded. CLI flags --max-tokens, --max-cost (cents), --max-wall-time.
• Per-node backend selection overrides global --backend: A node with backend: native always uses native even when --backend claude-code is set globally. Enables mixed-backend pipelines.

Fixed

• Start/exit node handler overwrite broadened fix: ensureStartExitNodes now bases the decision on Handler, not prompt. Any non-codergen handler is preserved; previously tool, human, parallel, conditional, subgraph, and wait.human handlers on start/exit nodes were silently overwritten.

Added

• ACP (Agent Client Protocol) backend (v0.16.0): Third execution backend alongside native and claude-code. Spawns ACP-compatible coding agents as subprocesses via JSON-RPC 2.0 over stdio. Per-node via backend: acp + acp_agent params, global via --backend acp.
• ACP provider-based agent routing (v0.16.0): anthropic → claude-agent-acp, openai → codex-acp, gemini → gemini --acp. Override per-node via acp_agent.
• ACP environment scoping, model bridging, terminal management, and file ops (v0.16.0): API keys stripped from subprocess env; mapModelToBridge maps tracker model names to bridge model IDs; full CreateTerminal / TerminalOutput / KillTerminalCommand with process group isolation; ReadTextFile/WriteTextFile scoped to the node's working directory.
• Dedicated executeYesNo handler (v0.16.1): mode: yes_no human gates now present fixed Yes/No choices and correctly map to OutcomeSuccess/OutcomeFail.
• Comprehensive human gate test suite (v0.16.2): examples/human_gate_test_suite.dip exercises all 4 gate modes plus timeout, default_choice, ctx.outcome routing, and interview cancel.
• ContextKeyTurnLimitMsg constant (v0.16.4): New context key for turn-limit and loop-detection diagnostics.

Fixed

• ACP data races and safety (v0.16.0): handler mutex on empty-response check, syncBuffer for subprocess output, protocol version validation, empty Cwd fallback, Pid > 0 guard before syscall.Kill.
• mode: yes_no outcome mapping (v0.16.1): No longer falls through to choice mode (which always returned OutcomeSuccess). Pipelines using ctx.outcome = fail with yes_no now route correctly.
• Thinking signature dropped in streaming (v0.16.3): Anthropic SSE handler now captures signature_delta events and redacted_thinking blocks. Previously caused multi-turn Opus sessions with extended thinking to crash.
• Turn-limit exhaustion treated as success (v0.16.4): Agents that exhausted their turn limit (or entered a tool call loop) were silently treated as OutcomeSuccess, allowing pipelines to advance past nodes that wrote zero files. Now returns OutcomeFail.

Changed

• dippin-lang v0.18.0 (v0.16.2): Adds flatten package for inlining subgraph refs into a single flat workflow.

Added

• Per-node response context keys: Codergen and human handlers write response.<nodeID> alongside last_response/human_response, so downstream nodes can reference specific upstream outputs.
• Parallel concurrency limits: max_concurrency attr on parallel nodes bounds concurrent branch goroutines via semaphore, context-aware.
• Parallel branch timeout: branch_timeout attr sets a per-branch context deadline so slow branches fail without blocking fan-in.
• Human gate timeout: timeout attr on human nodes with timeout_action (default/fail) and default_choice fallback — applied to freeform, choice, and interview modes.
• Edge adjacency indexes: OutgoingEdges/IncomingEdges use O(1) map lookup via adjacency indexes built by AddEdge.
• Format constants: FormatDip and FormatDOT typed constants for pipeline format identification.

Fixed

• P0: Goal-gate infinite fallback loop: FallbackTaken guard persisted in checkpoint prevents one-shot fallback/escalation from looping.
• P0: Parallel branch context loss on fan-in: PipelineContext.DiffFrom captures side effects from parallel branches.
• Adapter nil pointer guards, sentinel errors (ErrNilWorkflow, etc.), deterministic map iteration, variable expansion single-pass, case-insensitive auto_status, word-boundary fidelity truncation, and condition parser hardening (== operator, quote stripping).
• Empty API response retry: Empty API responses (0 output tokens, 0 tool calls) now trigger OutcomeRetry instead of hard-failing.

Changed

• Retry backoff jitter: ExponentialBackoff and LinearBackoff now apply ±25% random jitter to prevent thundering herd.

Deprecated

• DOT format support: ParseDOT is deprecated. Use .dip format instead. DOT support will be removed in v1.0.

Added

• Interview mode for human gates: mode: interview enables structured multi-field form collection driven by upstream agent output. One question at a time with progress bar, selection feedback, and pre-fill on retry.
• Structured JSON question format: Agents output {"questions": [...]} with text, context, and options. Validated before presenting. Falls back to markdown heuristic parsing.
• response_format support: Agent nodes can force structured JSON output at the API level via response_format: json_object. All three providers supported (Anthropic, OpenAI, Gemini).
• Agent params map: Generic key-value pass-through from .dip files (dippin-lang v0.16.0). Enables backend: claude-code and other runtime features without IR schema changes.
• deep_review built-in workflow: Interview-driven codebase review with 3 structured interview gates, parallel analysis (correctness/security/design), and remediation plan. Run with tracker deep_review.
• interview-loop.dip subgraph: Reusable interview loop pattern (ask → answer → assess → loop) in examples/subgraphs/.
• Empty API response diagnostics: Session-level retry with diagnostic logging for 0-token API responses. Hard-fails after 2 retries.

Fixed

• Cancel returns OutcomeFail: Canceled interviews return fail instead of success. Partial answers preserved.
• Autopilot hard-fails on parse error: Both AutopilotInterviewer and ClaudeCodeAutopilotInterviewer retry once, then hard-fail. No more silent auto-approve.
• Goroutine leak in flashDecision: Fixed with done channel and defer/recover.
• Mode 1 tea.Cmd propagation: All three TUI runners now propagate commands from content updates.
• Context leak in retry loop: Explicit cancel() instead of defer inside for loop.
• Empty response guard: Agent sessions with 0 output tokens and 0 tool calls now fail instead of silently succeeding.

Added

• TUI: Progress bar with ETA: Amber ASCII bar in status bar shows completed/total nodes.
• TUI: Log verbosity cycling (v): All → Tools → Errors → Reasoning.
• TUI: Zen mode (z): Hide sidebar, full-width agent log.
• TUI: Help overlay (?): All keyboard shortcuts in styled table.
• TUI: Agent log search (/): Inline search with n/N navigation.
• TUI: Per-node cost tracking: Cost badges on completed nodes in sidebar.
• TUI: Node drill-down (Enter): Focus log on selected node.
• TUI: Copy to clipboard (y): Copies visible filtered log text.
• Claude-code autopilot: Routes gate decisions through claude CLI subprocess.
• Strict failure edges: Pipeline stops on uncaught failures instead of silently continuing.

Fixed

• Claude Code subprocess killed after 10s: Go's exec.CommandContext + WaitDelay sent SIGKILL. Switched to plain exec.Command.
• Claude Code auth failure: Stripped env prevented OAuth token discovery. Now passes full parent environment.
• NDJSON subagent content: Handles both string and array content formats from Claude Code's subagent tool results.

Added

• Autopilot inside the TUI: --autopilot no longer forces --no-tui. Decisions flash in a modal for 2s.
• Header tags: Orange claude-code and purple autopilot:lax tags in the TUI header bar.

Added

• tracker update: Self-update command downloads the latest GitHub release, verifies SHA256 checksum, extracts the binary, smoke-tests it, and atomically replaces the current binary with .bak rollback. Detects Homebrew, go install, and direct binary installs.
• Non-blocking update check: On every tracker run, a background goroutine checks for new releases (24h cache). Prints a one-line hint if an update is available. Disabled with CI or TRACKER_NO_UPDATE_CHECK env vars.
• Claude Code backend: Pluggable agent backend abstraction. --backend claude-code spawns the claude CLI as a subprocess and parses NDJSON output, giving agents file editing, terminal access, and MCP tool servers. Per-node via backend: claude-code in .dip files, or global via the CLI flag.
• AgentBackend interface: Minimal contract in pipeline/backend.go — one method to execute a node and return an event stream. NativeBackend wraps agent.Session (existing behavior), ClaudeCodeBackend wraps the subprocess.
• dippin-lang v0.12.0: Upgraded from v0.10.0 — picks up preferred_label on freeform gates, immediately_after assertions, tool command lint rules, subgraph validation, and dippin test --coverage.

Fixed

• PickNextMilestone silent skip: Flexible milestone header matching, fails loudly if no milestones found or extraction empty
• Removed eval of LLM-generated verify commands: Was arbitrary code execution from free-form text
• TestMilestone known_failures: Strips comments, uses go test -skip instead of unsupported negative lookahead
• PickBest winner parsing: Uses grep -ioE regardless of markdown formatting

Fixed

• Provider errors now hard-fail per CLAUDE.md (only parse failures retry)
• AskFreeform logs warning instead of silently swallowing errors
• Default model picks cheapest from configured provider (not hardcoded to Anthropic)
• Autopilot forces --no-tui
• matchChoice uses longest-match to prevent "a" matching before "abandon"
• decide() returns errors instead of silently falling back

Added

• --autopilot <persona>: Replace human gates with LLM-backed decisions (lax / mid / hard / mentor)
• --auto-approve: Deterministic auto-approval for CI and testing
• dippin-lang upgraded to v0.10.0

Added

• Embedded built-in workflows: 3 flagship pipelines in the binary (tracker build_product)
• tracker workflows and tracker init commands
• Bare name resolution: filesystem → embedded → error
• Deterministic failure detection in tracker diagnose
• 23 dippin simulation tests for build_product.dip

Changed

• Split EscalateToHuman into EscalateMilestone + EscalateReview
• Escalation gates have prompt: blocks with rich context

Fixed

• TestMilestone early-exit bug (attempt counter fired before tests)
• ContextKeySuggestedNextNodes constant (6 string literals eliminated)
• Complexity violations in diagnose.go

Added

• tracker diagnose: Deep failure analysis with tool output, timing, suggestions
• tracker doctor: Preflight health check
• Provider status in tracker version
• Freeform "other" option in review hybrid gates
• Runtime error surfacing in TUI activity log
• Subgraph loading with cycle detection
• Hybrid radio+freeform gates
• Decision audit trail in activity.jsonl

Added

• Decision audit trail (edge selection, condition evaluation, node outcomes)
• Checkpoint resume with edge replay
• Per-node working directory for git worktree isolation
• Conditional edge evaluation with ctx. namespace