Changelog

v3.400.5 — 2026-11-12

• patch: The runbook-6894 destroy read-back now sends the read-only Hetzner token to curl on stdin instead of argv. It and the section-5c read-back (already on stdin; with its postmerge Phase 5.7 copy) now confine curl (--disable --noproxy "*" first, --max-time 30). The drift suite now pins every Hetzner-bearer line in runbook 6894 and the postmerge skill to two exact texts (N3b, self-tested by H18).

v3.400.4 — 2026-11-12

Web Platform

• Legacy agent runner: when the approval flow gives no verdict, the Approve/Reject card for every approval-required tool (email send, reply and suppress; push; pull request; workflow run; KB share; autonomy change) is shown only to the workspace Owner. It fails closed for members and on a failed or slow role check.
• An Approve is honoured only if the approver is still the Owner when they answer.
• GitHub, share and autonomy actions run in the workspace whose Owner was checked.
• Tool descriptions and the agent prompt name the Owner as the approver.

Plugin

• security-sentinel: new check that an authorization check's scope equals the scope its action runs in.

CI

• test-webplat job timeout raised from 35 to 45 minutes. The approval mutation battery now has 371 rows and needs more than 35 minutes on a slow runner. 45 still bounds a hang. The dedicated-leg fix is #12654 (tracker #12626).

v3.400.3 — 2026-11-12

• test(web-platform): fix the F21 real-git flake at its cause (fake transport race), and add real-git url/remote rewrite rows at both git-data entry points.

🤖 Generated with Claude Code

https://claude.ai/code/session_018yoBtYirHdpbaNjpQ18HbY

web-v0.409.4 — 2026-11-12

Web Platform

• Legacy agent runner: when the approval flow gives no verdict, the Approve/Reject card for every approval-required tool (email send, reply and suppress; push; pull request; workflow run; KB share; autonomy change) is shown only to the workspace Owner. It fails closed for members and on a failed or slow role check.
• An Approve is honoured only if the approver is still the Owner when they answer.
• GitHub, share and autonomy actions run in the workspace whose Owner was checked.
• Tool descriptions and the agent prompt name the Owner as the approver.

Plugin

• security-sentinel: new check that an authorization check's scope equals the scope its action runs in.

CI

• test-webplat job timeout raised from 35 to 45 minutes. The approval mutation battery now has 371 rows and needs more than 35 minutes on a slow runner. 45 still bounds a hang. The dedicated-leg fix is #12654 (tracker #12626).

web-v0.409.3 — 2026-11-12

• test(web-platform): fix the F21 real-git flake at its cause (fake transport race), and add real-git url/remote rewrite rows at both git-data entry points.

🤖 Generated with Claude Code

https://claude.ai/code/session_018yoBtYirHdpbaNjpQ18HbY

v3.400.2 — 2026-11-11

Plugin

• README: component counts synced for the session-forensics-analyst agent.

• ship / merge-pr: auto-merge arms only through the new Review-Evidence arm check, which reads the latest evidence comment, refuses unreviewed commits after its head, and pins the arm to the checked head.

• ship and review references: repo-wide guards before ready, and bounded fix-round seats.

Tests

• Two comments in test code corrected (fixture-env-adoption DEFERRED entry, spike iron-audit helper).

🤖 Generated with Claude Code

v3.400.1 — 2026-11-11

• scripts/suite-durations.tsv + scripts/suite-shard-legs.tsv regenerated to cover run-health-emit.test.sh; test-all-corpus-weight-budget green again.
• README.md + plugins/soleur/README.md component counts re-synced (68 agents, 32 engineering) after #12649.
• model.c4/model.likec4.json agent count re-synced after #12649.

v3.400.0 — 2026-11-11

• feat: add fresh-context forensic analysis agent (session-forensics-analyst) for session-retrospective-compound

Closes #12574

v3.399.4 — 2026-11-11

• WIP: feat-12532-degraded-run-forensics

v3.399.3 — 2026-11-11

• New CI guard: durable knowledge-base text may no longer pair an advisory identifier with a safe-status claim; the check runs in the required guards job and on bot PRs.
• Existing occurrences in the knowledge base are reworded to state the action taken instead of a verdict.
• The review and work skill references gain two lessons: rule on a pin test's contract when fix rounds keep finding sibling shapes, and re-run touched suites after the last edit of a commit.

v3.399.2 — 2026-11-11

Infrastructure checks

• The scheduled sole-copy protection check now also watches web-1's workspaces volume, which holds every user's checked-out repositories. Removing its delete protection outside a reviewed change files a p1 issue and sends an email.
• Inngest alerts are unchanged (same titles and verdicts).
• Runbook 6604 has a read-only command to read the web-1 volume's delete-protection flag; ADR-119 records the volume's id and what the check does not cover.

Plugin

• soleur:review fix-round guidance: pin exact values one level below the key names, compare the test harness to the real runner, and run the skill body-budget lint.
• CTO agent: read a named enforcement mechanism's source before ruling on it.
• soleur:postmerge: the sole-copy section names the volume-gone outcome.

v3.399.1 — 2026-11-11

• Bump the hosted Claude Code CLI and Agent SDK to 2.1.321 / 0.3.321, so the fable alias resolves to Fable 5.2.
• Add standing guards that every current model id, the reviewed default effort, and the fable alias target exist in both pinned binaries.
• Add a test that the trusted plugin declares no hooks module, because 2.1.321 lets a mod's tool calls skip the permission callback.

v3.399.0 — 2026-11-11

• Inngest step calls now route by execution placement: pinned (host-affine/volume-bound) functions forward to the exec host over TLS; portable functions execute in place.
• New placement_decision structured log rows (fnId, class, decision, host_ip) plus placement.* Sentry ops for refuse paths.
• Infra: SOLEUR_HOST_PRIVATE_IP env wiring (ci-deploy.sh, cloud-init.yml, docker-run-tuple.py), egress allow + post-apply assert for :8445, exec receiver boot wiring.
• Phase-4 unpin: current-workspace-id leaf extract + byok-resolver re-point; cfo-on-payment-failed and github-on-event re-classed portable.

web-v0.409.2 — 2026-11-11

Plugin

• README: component counts synced for the session-forensics-analyst agent.

• ship / merge-pr: auto-merge arms only through the new Review-Evidence arm check, which reads the latest evidence comment, refuses unreviewed commits after its head, and pins the arm to the checked head.

• ship and review references: repo-wide guards before ready, and bounded fix-round seats.

Tests

• Two comments in test code corrected (fixture-env-adoption DEFERRED entry, spike iron-audit helper).

🤖 Generated with Claude Code

web-v0.409.1 — 2026-11-11

• scripts/suite-durations.tsv + scripts/suite-shard-legs.tsv regenerated to cover run-health-emit.test.sh; test-all-corpus-weight-budget green again.
• README.md + plugins/soleur/README.md component counts re-synced (68 agents, 32 engineering) after #12649.
• model.c4/model.likec4.json agent count re-synced after #12649.

web-v0.409.0 — 2026-11-11

• feat: add fresh-context forensic analysis agent (session-forensics-analyst) for session-retrospective-compound

Closes #12574

web-v0.408.5 — 2026-11-11

• WIP: feat-12532-degraded-run-forensics

web-v0.408.4 — 2026-11-11

• New CI guard: durable knowledge-base text may no longer pair an advisory identifier with a safe-status claim; the check runs in the required guards job and on bot PRs.
• Existing occurrences in the knowledge base are reworded to state the action taken instead of a verdict.
• The review and work skill references gain two lessons: rule on a pin test's contract when fix rounds keep finding sibling shapes, and re-run touched suites after the last edit of a commit.

web-v0.408.3 — 2026-11-11

• chore(infra): refresh GitHub /meta egress CIDR allowlist (#5284) 2026-11-11

web-v0.408.2 — 2026-11-11

Infrastructure checks

• The scheduled sole-copy protection check now also watches web-1's workspaces volume, which holds every user's checked-out repositories. Removing its delete protection outside a reviewed change files a p1 issue and sends an email.
• Inngest alerts are unchanged (same titles and verdicts).
• Runbook 6604 has a read-only command to read the web-1 volume's delete-protection flag; ADR-119 records the volume's id and what the check does not cover.

Plugin

• soleur:review fix-round guidance: pin exact values one level below the key names, compare the test harness to the real runner, and run the skill body-budget lint.
• CTO agent: read a named enforcement mechanism's source before ruling on it.
• soleur:postmerge: the sole-copy section names the volume-gone outcome.

web-v0.408.1 — 2026-11-11

• Bump the hosted Claude Code CLI and Agent SDK to 2.1.321 / 0.3.321, so the fable alias resolves to Fable 5.2.
• Add standing guards that every current model id, the reviewed default effort, and the fable alias target exist in both pinned binaries.
• Add a test that the trusted plugin declares no hooks module, because 2.1.321 lets a mod's tool calls skip the permission callback.

web-v0.408.0 — 2026-11-11

• Inngest step calls now route by execution placement: pinned (host-affine/volume-bound) functions forward to the exec host over TLS; portable functions execute in place.
• New placement_decision structured log rows (fnId, class, decision, host_ip) plus placement.* Sentry ops for refuse paths.
• Infra: SOLEUR_HOST_PRIVATE_IP env wiring (ci-deploy.sh, cloud-init.yml, docker-run-tuple.py), egress allow + post-apply assert for :8445, exec receiver boot wiring.
• Phase-4 unpin: current-workspace-id leaf extract + byok-resolver re-point; cfo-on-payment-failed and github-on-event re-classed portable.

v3.398.0 — 2026-11-11

Web Platform (test path)

• An egress-injector measurement suite (apps/web-platform/test/infra/egress-injector-spike/) with an approval hook, a classifier policy, a CONNECT router, stubs and probes. A dedicated egress-injector-spike.yml workflow runs it on pull requests and on dispatch.
• Hermetic tests for the hook, policy and router (egress-injector-policy.test.ts, egress-injector-router.test.ts, 117 tests).
• Exactly pinned devDependencies: graphql, @grpc/grpc-js, @grpc/proto-loader.

Plugin

• brainstorm: prior-framings checks moved to a reference file, read as a mandatory step (keeps SKILL.md within its byte ceiling).
• Ruling delegation: dependency facts in a CTO brief must cite where they were read.

Scripts

• lint-orphan-test-suites.sh: an exec-prefixed workflow registration (run: exec bash <suite>) counts as registered, so the spike suite is no longer reported as an orphan.

Knowledge base

• ADR-325 (new), plus addenda to ADR-311 and ADR-278.
• A learning on judging the bytes the transport sends.

v3.397.0 — 2026-11-11

• A review stops when the security scan did not print a receipt the orchestrator can read.
• A clean static-analysis claim has to name the files that were actually scanned.
• The semgrep review seat reports that receipt instead of running a second scan.

v3.396.2 — 2026-11-11

Cloudflare read-only wrapper gains two fixed analytics reads; docs and runbook updated; Playwright/Node 26 guidance added. Patch-level plugin change.

🤖 Generated with Claude Code

v3.396.1 — 2026-11-11

• Host-side git in the web platform now runs through one shared helper: hardening arguments, a scrubbed environment, a required protocol pin, and a refusal of a workspace .git that redirects to another repository.
• The git-data push targets the explicit server-derived URL behind a url/remote rewrite guard.
• Workspace provisioning, the worktree-config heal and the context-queries hook use the helper; refusals are reported to Sentry.

v3.396.0 — 2026-11-10

• feat(harness): per-phase model saturation fallback and backoff retry (#12529)

v3.395.0 — 2026-11-10

Web Platform

• The founder's legal-acceptance screen no longer depends on the approval-queue setting; only the configured founder can open it.
• With the approval queue off, only the workspace Owner can approve a branch push an agent asks for on the older runner.
• The Agent web access settings now say accurately what agents can and cannot do while web access is running, including that a push through Soleur needs the workspace Owner's approval.

Knowledge base

• ADR-319, ADR-309 and ADR-032 amendments; CLO audit record; dated markers in the internal legal records; counsel questionnaire draft.

v3.394.3 — 2026-11-10

Bug fixes: ratchet baseline regens, required-check literal update, markdown-lint fix, apt retry dpkg repair (semver:patch).

Closes #12593

v3.394.2 — 2026-11-10

• Fixed: parked S4 machinery stopped billing ~2.8% of weekly CI; oracle-review-required now reads a committed surface list instead of exec-ing a retired module.

Generated with Devin