opencode 1.0.45

Stable release from main branch. Blocked workflows now show actionable diagnostics and guide bounded, authorized recovery before escalation to the user.

🐛 Bug Fixes

• Failed workflow validation and blocked starts show their diagnostic reason even when tool details and generic output are hidden. Previously saved validation failures also become visible without rewriting conversation history.
• Missing-model starts return actionable diagnostics to the parent agent without creating a workflow or immediately opening a question.
• Workflow failure responses instruct the parent to attempt only authorized, reversible recovery, stop after two relevant failed attempts, and report the cause, attempted recovery, current task state and choices to the user. This is an agent-facing recovery contract, not a durable retry counter.
• Model and permission constraints remain unchanged. No database migration or automatic model substitution is introduced.

🧪 Test Summary

Bun:                    1.3.14
Workflow/schema tests:  78 passed
TUI regressions:        26 passed, including 8 snapshots
Root typecheck:         29 packages passed
Root lint:              0 errors; 4833 warnings within the unchanged 4850 cap
Fix PR CI:              unit, HttpAPI, typecheck and Linux/Windows E2E passed

🔍 Verification

Real GPT-6 source-runtime replays verified unavailable-model reporting with zero workflows and authorized local configuration recovery through completion and parent wake/report. The actual TUI showed blocked diagnostics with both visibility toggles disabled. Two new Session-route rendering tests cover current and historical blocked results.

Publication additionally requires current-head native checks and installed release artifact acceptance. Platform build success and archive integrity are checked separately from macOS runtime behavior.

Full changelog: graphagent-v1.0.44...graphagent-v1.0.45

opencode 1.0.45-dev.1

Prerelease release from dev branch. Blocked workflows now show actionable diagnostics and guide bounded, authorized recovery before escalation to the user.

🐛 Bug Fixes

• Failed workflow validation and blocked starts show their diagnostic reason even when tool details and generic output are hidden. Previously saved validation failures also become visible without rewriting conversation history.
• Missing-model starts return actionable diagnostics to the parent agent without creating a workflow or immediately opening a question.
• Workflow failure responses instruct the parent to attempt only authorized, reversible recovery, stop after two relevant failed attempts, and report the cause, attempted recovery, current task state and choices to the user. This is an agent-facing recovery contract, not a durable retry counter.
• Model and permission constraints remain unchanged. No database migration or automatic model substitution is introduced.

🧪 Test Summary

Bun:                    1.3.14
Workflow/schema tests:  78 passed
TUI regressions:        26 passed, including 8 snapshots
Root typecheck:         29 packages passed
Root lint:              0 errors; 4833 warnings within the unchanged 4850 cap
Fix PR CI:              unit, HttpAPI, typecheck and Linux/Windows E2E passed

🔍 Verification

Real GPT-6 source-runtime replays verified unavailable-model reporting with zero workflows and authorized local configuration recovery through completion and parent wake/report. The actual TUI showed blocked diagnostics with both visibility toggles disabled. Two new Session-route rendering tests cover current and historical blocked results.

Publication additionally requires current-head native checks and installed release artifact acceptance. Platform build success and archive integrity are checked separately from macOS runtime behavior.

Full changelog: graphagent-v1.0.44...graphagent-v1.0.45-dev.1

opencode 1.0.44

Stable release from main branch. DAG report files now survive removal of their source working tree, and failed nodes can be retried within the same workflow while preserving valid completed work.

🎯 Features

• Report nodes can submit a single absolute file path, including paths with spaces. After applying the producing session's read permissions, the runtime commits a content-addressed copy under application data and records its digest, size, summary and execution provenance with node completion. Consumers receive a short reference and verify managed file integrity before reading or reusing it; explicit read denials remain effective.
• workflow control(recover) takes current node_ids and expected_graph_rev. It creates replacement attempts for the selected nodes and their downstream closure, retains unrelated valid results, and keeps prior attempts available for inspection. Cancellation requires explicit resume intent; running work must be paused first.
• Recovery rejects stale workflow/node snapshots. New attempts receive prior-session references and must inspect existing changes before repeating side effects. A missing or changed managed artifact cannot silently count as valid completed evidence.
• Dependency values already interpolated into a prompt are no longer appended again as full context.

This first file protocol applies to nodes without output_schema; inline text, structured results and legacy file references remain supported. It does not automatically infer changes to code or external systems, roll back side effects, or provide exactly-once execution. See the usage guide.

🐛 Bug Fixes

• Automatic Goal continuation remains visible to the model but no longer counts as human Memory evidence or a human turn.
• Asynchronous Stop, SubagentStop and StopFailure callbacks share a bounded continuation chain. New input, session end and instance disposal invalidate stale callbacks.
• An explicit Task resume failure no longer silently creates another child session.
• Grep preserves an exact file target and reports inaccessible paths instead of expanding the search to sibling files.
• Truncated output points to the saved file with Read/Grep guidance; it no longer requires an additional delegated task.

⚙️ CI / Engineering

The repository moves to SpecGit 2 native Issue/PR observation and GitHub required checks. The v1 generated acceptance workflow and merge guard are retired. Product CI, installer checks and stable release gates remain in place.

🧪 Test Summary

Bun:                 1.3.14
Module regressions:  496 passed, 0 failed
DAG core gate:       passed all behavior and coverage floors
Permission review:   25 passed, 0 failed (independent focused run)
Artifact tests:      116 passed, 0 failed; Windows alias case runs in CI
Root typecheck:      29 packages passed
Root lint:           0 errors; 4831 warnings within the unchanged 4850 cap
Local macOS CLI:     built; version/help and isolated server health passed

🔍 Verification

Validation uses the repository-pinned Bun 1.3.14, module regression tests, real local SessionPrompt/Read boundaries, recovery transaction and replay tests, the DAG core behavior/coverage gate, root typecheck and lint. Windows CI additionally exercises managed artifact storage, downstream reads and permission preservation after aliased source directories are deleted. Publication requires successful current-head native CI and the Linux, macOS and Windows release build.

External provider model quality and real third-party side effects are outside these deterministic regressions.

Full changelog: graphagent-v1.0.43...graphagent-v1.0.44

opencode 1.0.43

Stable release from main branch. Memory can now be enabled on the first request after repairing a missing project initialization stamp.

🐛 Bug Fixes

• Memory activation: when a git project already has a non-empty AGENTS.md but its initialization stamp is missing, /memory on now repairs the stamp and completes activation in the same request. Missing configuration, disabled configuration, and an unavailable configured model follow the normal initialization and model-reselection paths. Projects without initialization evidence remain blocked (#581).

🧪 Test Summary

Memory, search, server wiring: 116 pass, 0 fail
Activation regression:          5 pass, 0 fail (included above)
CI opencode suite:             4574 pass, 0 fail, 23 existing skips, 1 existing todo
CI workspace typechecks:        29/29 passed
CI DAG coverage gate:           820 pass, existing coverage floors met
CI HttpAPI composite:           3 x 230 pass, 0 fail, 0 skip, 0 missing
CI E2E:                        Linux 21 pass; Windows 21 pass
lint:                          4846 warnings, 0 errors; existing 4850 cap unchanged

🔍 Verification

Local verification used Bun 1.3.14. The activation regression failed before the fix and now checks the first command response, persisted enabled state, replacement model, initialization stamp, and subsequent status. An independent review reran the focused regression and inspected the controller, identity fence, locks, and generation-based persistence. The memory suite also covers admission, identity migration, cross-process persistence, search, model wire format, and production server dependency wiring.

The CI counts above come from the accepted integration candidate 3b0d9da982 in PR #582: Typecheck and DAG gates, unit, HttpAPI and E2E gates. Both Standards and Spec reviews found no blocking implementation findings, and SpecGit acceptance passed before dev integration. A compiled debug CLI also returned Memory on on the first request against a fresh isolated database and retained that status after process restart.

Main promotion is separately gated by its current-head CI and SpecGit acceptance. The release workflow validates reference templates and builds Linux, macOS, and Windows archives with SHA256SUMS. Real external model-provider quality and existing user memory content are outside this verification.

Full changelog: graphagent-v1.0.42...graphagent-v1.0.43

opencode 1.0.43-dev.1

Prerelease release from dev branch. Memory can now be enabled on the first request after repairing a missing project initialization stamp.

🐛 Bug Fixes

• Memory activation: when a git project already has a non-empty AGENTS.md but its initialization stamp is missing, /memory on now repairs the stamp and completes activation in the same request. Missing configuration, disabled configuration, and an unavailable configured model follow the normal initialization and model-reselection paths. Projects without initialization evidence remain blocked (#581).

🧪 Test Summary

Memory, search, server wiring: 116 pass, 0 fail
Activation regression:          5 pass, 0 fail (included above)
CI opencode suite:             4574 pass, 0 fail, 23 existing skips, 1 existing todo
CI workspace typechecks:        29/29 passed
CI DAG coverage gate:           820 pass, existing coverage floors met
CI HttpAPI composite:           3 x 230 pass, 0 fail, 0 skip, 0 missing
CI E2E:                        Linux 21 pass; Windows 21 pass
lint:                          4846 warnings, 0 errors; existing 4850 cap unchanged

🔍 Verification

Local verification used Bun 1.3.14. The activation regression failed before the fix and now checks the first command response, persisted enabled state, replacement model, initialization stamp, and subsequent status. An independent review reran the focused regression and inspected the controller, identity fence, locks, and generation-based persistence. The memory suite also covers admission, identity migration, cross-process persistence, search, model wire format, and production server dependency wiring.

The CI counts above come from the accepted integration candidate 3b0d9da982 in PR #582: Typecheck and DAG gates, unit, HttpAPI and E2E gates. Both Standards and Spec reviews found no blocking implementation findings, and SpecGit acceptance passed before dev integration. A compiled debug CLI also returned Memory on on the first request against a fresh isolated database and retained that status after process restart.

Main promotion is separately gated by its current-head CI and SpecGit acceptance. The release workflow validates reference templates and builds Linux, macOS, and Windows archives with SHA256SUMS. Real external model-provider quality and existing user memory content are outside this verification.

Full changelog: graphagent-v1.0.42...graphagent-v1.0.43-dev.1

opencode 1.0.42

Stable release from main branch. Goal execution now preserves user intent across concurrent turns, and Hooks enforce their execution, decision, and cancellation contracts.

🎯 Features

• Goal turn budgets: use /goal --max-turns N <objective> to set a total budget and /goal resume --max-turns N to increase it while preserving turns already used (#572).

🐛 Bug Fixes

• Goal verdict races: serialize judgment commits with user, loop, shell, and control-command admission; recheck the current message boundary, Goal revision, and automation lease before accepting a delayed result (#568).
• Uninterrupted Goal progress: autonomous questions return without waiting for interactive input; ordinary user turns keep normal questions. Repeated status queries and subgoal edits no longer replace work boundaries, consume extra turns, or strand a continuation (#569, #570).
• Production Goal commands and reconnects: explicitly provide Goal to the production prompt runtime. Preserve the last known Goal after a reconnect error, clearing it only on a confirmed 404 (#571, #575).
• Hooks enforcement and feedback: honor prompt stop/block and permission denials, retain valid siblings after malformed configuration, preserve feedback from failed tools and MCP calls, and claim one-shot hooks atomically (PR #567).
• Hooks lifecycle: constrain inspection commands to validated read-only operations, propagate timeout/cancellation to child work, preserve interrupted Bash output, and carry file-change events and asynchronous rewake across runtime boundaries (PR #567).

⚙️ CI / Engineering

• SpecGit record updates: reuse successful verification for identical product content, suite, platform, runner label, and UTC day. Only the root .specgit.yaml record is excluded; source, policy, workflow, dependency, and documentation changes remain inputs. Cache misses and manual runs execute the full checks (#578).

• PTY environment verification: wait for the output assertion before allowing the shell to exit, removing the fixed five-second connection window. A six-second delayed connection passes with the new handshake (#574).

• Branch reconciliation: review all 100 existing local branches and seven origin branches. Restore the 17 main-only commits to dev alongside the Goal delivery. Remaining historical differences are obsolete delivery metadata or an already-integrated HttpAPI fix; see the candidate branch audit (#576).

🧪 Test Summary

opencode suite:      4571 pass, 0 fail, 23 existing skips, 1 existing todo
other workspaces:    1760 pass, 0 fail
Goal TUI reconnect:     6 pass, 0 fail
DAG coverage gate:    820 pass, all existing per-file floors met
typecheck:          29/29 packages green
lint:               4842 warnings, 0 errors, unchanged 4850 cap
HttpAPI composite: 3 x 230 pass, 0 fail, 0 skip, 0 missing

🔍 Verification

Local verification used Bun 1.3.14. Real AppRuntime and SessionPrompt/GoalLoop integration tests cover production dependency wiring, delayed done/blocked/continue verdicts, 25 consecutive status queries, subgoal edits, concurrent user/loop/shell admission, and both autonomous and interactive questions. The final dependency grouping was separately rechecked with 88 passing production/prompt tests and the workspace typechecks. Standards and Spec reviews found no remaining blockers.

The release candidate includes the already-accepted Hooks delivery from PR #567. Each integration and promotion is gated by current-head CI and SpecGit acceptance. The official release workflow validates the reference templates against the releasing runtime, builds Linux/macOS/Windows archives, verifies macOS installation behavior, and publishes SHA256SUMS with the release assets. Live external model providers and MCP services are not claimed as validated.

Full changelog: graphagent-v1.0.41...graphagent-v1.0.42

opencode 1.0.41

Stable release from main branch. DAG replanning, recovery, input mapping, and single-step execution now preserve durable workflow semantics across races and restarts.

🐛 Bug Fixes

• Stale execution isolation, #545: bind admission and settlement to the durable execution identity so delayed workers, deadlines, and recovery observations cannot terminalize a replacement attempt.
• Running definition consistency, #546: reject execution-semantic changes to an admitted node unless a supported explicit restart applies the new definition, while retaining valid timeout updates.
• Atomic replans, #547: commit node mutations, workflow configuration, and graph revision together so a failed replan cannot expose a partial graph or dispatch missing configuration. Forward committed notifications in order even when earlier legacy listeners yield.
• Durable checkpoint veto recovery, #548: reconstruct unresolved reporting-checkpoint decisions after restart before dispatch or workflow completion.
• Input mapping validation, #549: reject unknown, self, and unordered mapping sources before execution and report missing required runtime values without dropping valid nulls.
• Plain-text recovery parity, #550: classify missing, empty, and whitespace-only recovered output the same way as live provider output while preserving valid text exactly.
• Single-step convergence, #551: propagate skipped dependency chains to a terminal state without dispatching more than one child for each user step.

⚙️ CI / Engineering

• SpecGit 1.13.1 delivery compatibility, #552: refresh the generated acceptance harness and local entry points, preserve the required long-running CI budget, and update the repository bootstrap wrapper for current body-file flags and init assets.
• Integrated delivery, PR #553: track the seven DAG fixes and harness maintenance as independently verifiable issues on the shared dev delivery.

🧪 Test Summary

core DAG:             92 pass
OpenCode DAG:        665 pass
output schema:         3 pass
TUI:                  60 pass
local gate total:    820 tests, 0 failures
typecheck:         29/29 packages green
lint:               4845 warnings, budget 4850
SpecGit wrapper:     283 assertions, 0 failures
atomicity repeat:  20/20 passes
macOS install:       6 assertions, 0 failures

🔍 Verification

PR #553 was accepted at e742eec4cef4339e54c6c72aedd5dbe7a7594fdd and merged to dev as 345e5c13e7bdce2c739bace6327a896ebed88075. Typecheck and DAG coverage and unit tests, HttpAPI contracts, and Linux/Windows E2E passed; SpecGit accepted the final head before merge. Independent GPT-5.6-Sol Standards and Spec reviews resolved every mandatory finding.

Regressions exercised real DAG commands, projections, durable stores, delayed execution boundaries, injected transaction rollback, restart recovery, checkpoint vetoes, mapping validation, plain-text settlement, and guarded single-step dispatch. Existing coverage floors and generated SDK freshness checks passed. A native candidate included the Web UI, 16 validated templates, and ripgrep; its real archive passed installer signature, tamper-rejection, and executable checks. The compiled server returned a healthy 1.0.41 response and HTTP 200 for its embedded homepage. The official release workflow validates reference templates and produces the platform archives with SHA256SUMS.

Full changelog: graphagent-v1.0.40...graphagent-v1.0.41

opencode 1.0.40

Stable release from main branch. Native LLM requests now settle local tools before automatic compaction can close the stream. This release also includes the reviewed event-storage, summary-diff, delivery, and macOS installer fixes already integrated into dev.

🐛 Bug Fixes

• Tools survive automatic compaction, #539: a high-usage step-finish could abort a slow local tool before its result reached the session processor. Native LLM now delivers all local tool results before terminal events. Parallel tools settle completely; explicit user cancellation still interrupts execution.
• Summary diffs retain later small entries, #526: skip an oversized diff individually instead of dropping every following entry. Remove the unused legacy session.summary_diffs column through a tested database migration.
• Identical durable events no longer consume storage or sequence numbers, #527: suppress byte-identical fresh appends within the same aggregate/type while preserving explicit-sequence replay. Batch results retain input alignment; legacy rows require no hash backfill.
• Config startup preserves npm lock files, #542: keep an existing lock unchanged when the plugin SDK resolves entirely from local or bundled packages. Mixed registry requests and genuine package changes still regenerate the lock.

🏗️ Architecture / Refactor

• Deleted-session storage reclamation, #537: remove durable event residue for deleted aggregates, wire cleanup into session deletion, and add tested SQLite reclamation support. This release does not run the deferred #531 maintenance operation on the user's existing database.

⚙️ CI / Engineering

• Delivery tracking, #520 and #532 through #535: close linked issues after dev merges, preserve repository-specific SpecGit harness files, restore failed bootstrap state, reject unsupported branch types before remote writes, and verify that delivery PRs target dev.
• macOS installation verification, #536: verify release archive checksums before extraction and validate the installed binary's signature after quarantine clearing and re-signing. Added a negative checksum control and a real macOS installation acceptance test.
• Local npm fixture isolation, #540: keep real package-installation regressions independent of online vulnerability-audit latency while retaining their assertions and deadlines.

🧪 Test Summary

Release integration CI (PR #539, 00695dab86):
core: 1225 pass, 6 skip, 0 fail
opencode: 4429 pass, 23 skip, 1 todo, 0 fail
HttpAPI coverage / auth / effect: 230 pass each, no failures or missing routes
Generated client and SDK freshness: passed
Typecheck, DAG core gate, Linux and Windows E2E: passed

Merged native/session/TUI regressions: 36 pass, 0 fail
Merged npm regressions: 8 pass, 0 fail
Merged opencode package typecheck: passed

🔍 Verification

The slow-tool regression was observed failing before the fix and passing afterward through the real session processor and a local HTTP model endpoint. Additional cases cover parallel local tools and explicit cancellation. Independent Standards, Spec and merge reviews found no code blockers. The integration statistics above come from the accepted PR #539 CI, including generated client/SDK freshness and all three HttpAPI modes. Typecheck, lint and DAG core, both E2E platforms and SpecGit 1.10.1 acceptance also passed before merge to dev. The release branch preserves that accepted runtime tree; release PR #544 carries its own binding and main-targeted gates. Reported model usage in the regression is deterministic test input; no live model context limit is inferred from it.

Full changelog: graphagent-v1.0.39...graphagent-v1.0.40

opencode 1.0.39

Stable release from main branch. A follow-up hardening train closing the v1.0.38 review leftovers: a credential-leak dependency fix, the platform group-kill primitive converged to a single source, and two test-robustness deliveries (a load-tolerant stall bound, real-component cleanup coverage), synced from dev back to main.

🏗️ Architecture / Refactor

• Platform group-kill converged into one primitive, #515: the win32 taskkill /T /F versus negative-pid process.kill branching existed as diverging copies in util/process.stop and the hook execShell kill group, with different error handling. killGroupPid is now the single source (POSIX signals the group; win32 awaits the taskkill exit code and throws, leaving fallback and logging to callers), reused by both call sites with zero behavior change: same signals, ordering, and grace constants, and the #500 process-group regression suite with real grandchildren passes. The published SDK keeps its documented synchronous copy (#503).

⚙️ CI / Engineering

• Memory stall assertion made load-tolerant, #512: the dead-connection test bounded a 40ms connectTimeout with a 200ms wall-clock assertion and flaked at 288ms on a loaded linux runner (raw setTimeout; TestClock cannot apply). The bound is now 2000ms, still separating fail-fast from hang, with the Stalled error-class assertion as the semantic check.
• TUI route cleanup pinned against the real components, #514: the #502 seam test mirrored the production subscription shape, so removing an onCleanup wrapper from the real routes left it green. The real Session and Prompt components now mount inside the production provider stack, and the SDK event bus must return to its baseline listener count after unmount; both wrappers were negative-verified (removal turns the test red).

📦 Dependencies / Tooling

• mysql2 3.14.4 to 3.22.0, #513: closes the open high-severity dependabot advisory (alert 110) where an auth-plugin downgrade to mysql_clear_password leaks plaintext credentials.

🧪 Test Summary

unit tests (linux):    4447 tests, 4423 pass, 0 fail (364 files)
tui suites:            48 pass, 0 fail in test/cli/tui (incl. 4 real-component cleanup tests)
targeted suites:       memory + process + hook 215 pass, 0 fail (linux and macos)
typecheck:             29/29 packages green
lint:                  4839 warnings, 0 errors (ratchet budget 4850)

🔍 Verification

• Negative verification for #514: removing either production onCleanup wrapper turns the new real-component test red (Expected 0, Received 1); restoring turns it green, with an empty diff against production files afterwards.
• Zero-behavior-change argument for #515 walked per branch in the delivery commit: stop's win32 fallback path (taskkill failure to single-process kill) is preserved through the throw/catch reshape.
• The companion review finding on the workflow worker_type catalog's native-primary filter was adjudicated intentional (catalog lists spawn-resolvable worker shapes; native build/plan appear only because block defaults compile to them) and recorded on #507 without code change.
• Issues #512-#515 were closed manually with merge evidence: GitHub fires closing references only on PRs targeting the default branch, and this delivery merged through dev (PR #516) first.
• specgit finish exited 0 (accepted) for the dev delivery; this sync PR carries the same content to main under its own verdict.

Full changelog: graphagent-v1.0.38...graphagent-v1.0.39

opencode 1.0.38

Stable release from main branch. Two quality deliveries land in this train: a five-front resource-leak fix wave (hook process groups, share listeners, TUI subscriptions, process-stop escalation, memory retention) and a DAG workflow-tool consistency pass (builtin:// spec_path round-trip, worker_type catalog, parameter descriptions verified against implementation), both hardened by a two-axis review round.

🐛 Bug Fixes

• Hook command grandchildren can no longer hang triggers, #500: a timed-out hook shell command left pipe-holding grandchildren alive because only the direct child was killed; the timeout path now kills the whole process group (negative-pid SIGKILL, consistent with the detached spawn), with regression tests asserting group death under 15s.
• Share instance event listeners unsubscribe on dispose, #501: five EventBus subscriptions accumulated across share lifecycles; dispose now collects and runs every returned unsubscribe before closing the scope.
• TUI route and prompt event subscriptions clean up on unmount, #502: Session and Prompt routes registered bus listeners without onCleanup, leaking one listener set per navigation; both routes now wrap subscriptions in onCleanup with a regression suite pinning the subscription seam.
• Process stop awaits exit with SIGKILL escalation, #503: Process.stop and the MCP client shutdown sent a single SIGTERM and never waited; both now run SIGTERM, a 3s grace, SIGKILL, and a bounded exit await, and the SDK copy mirrors the escalation. The index.ts exit-path clause was attempted as a bounded drain window and reverted on CI evidence: real session paths keep ref'd handles alive, so every CLI exit degraded to the 5s fallback and three subprocess lifecycle tests failed; the empirical record and a follow-up proposal (eliminate the residual handles first) are posted to the issue.
• Memory generations and heap snapshots are bounded, #504: every memory commit copied the full topic set into a generations directory that was never removed (now keeps the latest 3 plus an orphan-staging sweep, best-effort so cleanup never fails a commit), and RSS-storm heap snapshots (hundreds of MB each) now rotate to the latest 2. Review caught a pid-led lexicographic sort that could delete the newest snapshot across runs; pruning now orders by the embedded timestamp with a cross-pid regression test.
• The workflow tool accepts the spec_path its own list action returns, #506: list returned builtin:// refs that start/extend/read/validate rejected as unknown saved workflows; resolveSpecPath now round-trips the builtin:// scheme through the template registry with the same not-found diagnostics as bare names.
• worker_type catalog lists the native primary agents, #507: build and plan were missing from the workflow tool's dynamic worker_type enum (the task tool surface is unchanged), so graphs could not name them.

⚙️ CI / Engineering

• CI typecheck and test gates now also trigger on ready_for_review (#315 anchor): SpecGit deliveries open as draft, and converting to ready previously never started the required checks, permanently blocking specgit finish.
• SpecGit harness refreshed for the 1.10.1 CLI with every local specialization preserved, and the AGENTS.md replay list corrected (pinned version, 45/40-minute timeout split, node 22, hand-parsed policy.yaml) so the next re-init replays reality instead of a stale 0.5.0 setup.
• DAG parameter descriptions verified line-by-line against implementation, #508: timeout_ms (admission-to-completion budget, expired queued nodes fail without spawning, capped parent-adjudicated extensions), the review field (the full diff-review wiring contract and its standard-warns / deep-errors mode split), plus the workflow guide tables; stale tool-parameter snapshots regenerated.

🧪 Test Summary

unit tests (linux):   4447 tests, 4423 pass, 0 fail (364 files)
e2e app tests:        21 passed on linux, 21 passed on windows
httpapi exerciser:    230 pass x coverage/auth/effect, 0 fail, 0 skip
typecheck:            29/29 packages green
delivery-specific:    workflow tool/schema/parameters/review 194 pass; process/heap/memory 76 pass
lint:                 oxlint 4840 warnings, 0 errors (ratchet budget 4850)

🔍 Verification

• Two-axis four-way code review (Standards and Spec, per delivery branch) over the full train diff; every P1 finding was independently re-verified against implementation code before fixing (heap prune ordering, stale parameter snapshot, the missing #503 clause).
• specgit finish exited 0 (accepted) for both deliveries against real git, PR, and CI evidence.
• The bounded-exit-window attempt for #503 was reverted on linux CI evidence and the empirical record posted to the issue; the revert kept the documented hanging-subprocess backstop intact.
• Known residue tracked outside this train: one dependabot high-severity alert on the default branch (security/dependabot/110).

Full changelog: graphagent-v1.0.37...graphagent-v1.0.38