GitHub Release: Hmbown/Codewhale v0.9.11 (23.08.2026)

Provider completion is now evidence-based. A Chat Completions stream reaches

MessageStop only after [DONE] or a non-empty finish_reason; raw EOF

without either is a typed failure. Message-start, ping, usage/terminal

deltas, block-stop, and message-stop frames do not count as productive

content or mint time-to-first-token. After tool results, a terminal provider

step with no answer or tool call now emits a durable failed turn and never

fabricates an empty assistant message.

A selected v2 Fleet is the single effective Agent roster across terminal,

Runtime threads, direct Workflow, Fleet execution, doctor, and

setup/readiness; legacy profile layers are consulted only when no Fleet is

selected, and invalid selections fail visibly with bounded, redacted errors.

Member references resolve exact id first and otherwise require a unique

display name, role, pinned model, offline model name, or provider/model route;

agent action=roster exposes that same bounded roster. The Fleet operator

supplies fresh-root and inherited-member routing unless an explicit launch

route or member pin wins, the resolved member is shown separately from the

requested alias, and requires = ["vision"] is admitted only on an exact

route with verified offline image_input support—never by silent rerouting

or custom-proxy inference. Fleet selection remains an explicit user/folder

contract independent of legacy project-profile loading.

Breaking (app-server): /prompt, prompt/request and prompt/run now

execute a real model turn instead of reporting success for work they never

did. Runtime::handle_prompt called no model: it resolved config, ran a

local ModelRegistry lookup, emitted three canned hook events

(ResponseDelta was literally the string model-selected), and returned

HTTP 200 with output set to a stringified JSON echo of the caller's own

routing metadata — the prompt included. Worse, when a thread_id was

supplied it appended a real user row, flipped the thread to Running, and

then wrote that echo into durable history as an assistant message plus a

prompt_response checkpoint. Nothing marked the row synthetic and nothing

ever moved the thread out of Running. All three endpoints now route

through the same RuntimeBridge that stdio thread/message has always

used, so output is the model's streamed text, model is what the runtime

reports for the thread that ran the turn, and events are the real

streaming frames. Runtime::handle_prompt and its synthetic history write

are gone.

Breaking (app-server): a failed prompt is now a typed failure rather

than a success-shaped body. POST /prompt returns

{"error":{"code":...,"message":...}} with 400 (invalid request), 404

(thread not found), 503 (runtime_unavailable) or 500, instead of HTTP

500 carrying a PromptResponse with the error text stuffed into output

where model text belongs. The stdio surface gained JSON-RPC -32005

runtime_unavailable for "the turn engine could not be reached, so nothing

ran" — distinct from -32603, and retryable. There is no configuration in

which a prompt silently echoes instead of running.

Breaking (app-server): POST /thread with a Message body runs the

turn. It previously replied status: "accepted" with a

ResponseDelta("queued") frame while starting no worker and calling no

bridge — the stdio path for the same request has always done real work, so

the two transports disagreed about what accepted meant. HTTP now replies

status: "completed" once the turn reaches a terminal state, with the

streamed frames in events and the turn id in data. Runtime::handle_thread

no longer accepts ThreadRequest::Message at all: it owns thread

bookkeeping, not the turn engine, and returns an error naming

POST /v1/threads/{id}/turns rather than a canned acceptance.

Breaking (app-server): AppRequest::SubmitUserInput now refuses

explicitly (ok: false, error: "user_input_reply_unsupported") instead of

returning resolved: true and filing the answers in a map that had no

reader anywhere in the crate — every answer submitted was silently

discarded. It cannot be made to work on this transport: while a turn

streams, the stdio loop executes only thread/interrupt and queues

everything else, so an answer sent there would wait on the very turn

waiting for it. The refusal names the surface that does accept it,

POST /v1/user-input/{thread_id}/{request_id} on the runtime API. The

client-visible refusal is whitespace-clean, and the /tool path that mints

the UserInputRequest is unchanged and still genuine.

Split the coordination ledger out of tools/subagent/coord.rs into

tools/subagent/coord/ledger.rs. The file held two unrelated things: the

model-facing agents/* tool wrappers, and the durable decision/claim/

contention records those wrappers happen to write — records whose consumers

are mostly not in the tool layer (tui::coordination_detail,

tui::work_surface, tui::ui::tests, core::engine::tests all name these

types). At 3.8k lines, reading either one started by scrolling past the

other. A pure move with a glob re-export from coord, so every

crate::tools::subagent::coord::{…} path still resolves and no consumer file

was edited; the only content change the move required is one constant going

from private to pub(super) because its caller stayed behind. coord.rs is

now 2.3k lines and ledger.rs 1.6k.

agent is now the only sub-agent tool the model can see. AGENTS.md has

said "the model-facing sub-agent surface is agent only" since the lifecycle

tools were removed, but six more were reachable: agents/list,

agents/message, agents/followup, agents/interrupt, agents/coordinate,

and agents/wait all defaulted to model-visible, so they shipped in the

catalog and tool_search could load any of them — and the agent

description told the model they existed. They now declare

model_visible() -> false, the same shape rlm and exec_shell use: still

registered, still executable by name so a persisted transcript replays

against the same implementation, never advertised and never returned by

either tool_search matcher.

Five of the six were already duplicates of an agent action. The sixth was

not: agents/coordinate action=claim was the only way to widen a write

claim, and write enforcement fails closed, so hiding it would have left a

refusal ("expand it first with…") pointing at a tool the model could no

longer call. agent gains one action, claim, taking the write scope

vocabulary action=start already uses (write_roots, plus parse-accepted

exact_files and coordination_contracts). It keeps agents/coordinate's

Auto approval — gating it deadlocks autonomous fan-in — and it can only

widen the caller's own scope; peer contention still fails. A scopeless claim

is refused rather than reported as granted, because expand_write_claim

returns the unchanged claim with Ok when every list is empty.

Collapsing six tools into one action set also collapses the gating: agent

is deliberately exempt from both name-keyed gates (posture_permits_tool

short-circuits it so delegation depth governs spawning, and

execution_envelope classifies it Bounded so a read-only member can fan

out read-only work), so a capability folded into it inherits no gate. claim

is therefore gated per action, reproducing the envelope check that kept

agents/coordinate off a read-only role's catalog — in the catalog and again

at dispatch, since catalog shaping is not an authority boundary. The other

actions keep exactly the visibility they had.

One placement table now decides which wire channel a message role belongs

in, and unrepresentable role/dialect pairs are refused at the outbound seam

(DeepSeekClient::prepare_outbound_request) instead of at the provider.

Chat Completions and OpenAI Responses used to drop an unfamiliar role

silently, Anthropic Messages forwarded message.role verbatim and took an

opaque provider 400 for it, and Google cloud-code was alone in failing

closed. Positioned system and developer history — including compaction

and branch summaries — is carried natively by Chat Completions and Responses

and projected, in place, onto Anthropic's user channel. It is neither

hoisted nor dropped. Genuinely unknown roles keep the previous

dialect-specific fail-closed/omit behavior, now decided in one table. The

dead "tool" arm in the Responses adapter is gone — nothing constructs that

role.

Message roles are a closed Role enum (crates/core/src/role.rs) instead of

a free-form String on Message. Four wire adapters each decided

independently what an unfamiliar role meant, and a typo in a role string was

a silent transcript edit rather than a compile error. Role keeps an

Unrecognized(String) variant and serializes via as_str(), so a saved

session's bytes are unchanged, a transcript written by a newer build still

loads here, and assistant_interrupted stays a distinct session item — no

session schema bump and no migration ladder.

Portable config bundles: codewhale config export --portable writes a

deterministic, secret-free bundle (credential and machine-specific keys

dropped), and codewhale config import <FILE|URL|-> applies one with a

strict versioned envelope, a printed added/changed/skipped/conflicting/

rejected plan, consent gating (--yes required headless), a timestamped

backup with rollback, and idempotent re-import. Credential-shaped entries

are rejected by key name and value shape — rejections name the field,

never the value. Remote imports revalidate the HTTPS-or-loopback-HTTP policy

on every same-scheme redirect hop, and duplicate keys across applicable

section labels fail before any backup or write instead of silently resolving

by section order. Structured TOML values round-trip with their original

types and exact named-provider identity; recursive sanitization covers

arrays/tables and camel-case, dotted, cookie, and access-key spellings while

retaining ordinary token-count metrics. Machine-bound project trust,

credential-source consent, automatic hook/LSP execution, and local-path

authority are non-portable and fail before mutation. A missing target is

created transactionally and removed again on rollback, and project/global

scope validation rejects the wrong document before import or export.

Imported tables deep-merge portable fields into the target, so omitted

machine-local provider credentials, endpoints, and executable definitions

remain intact instead of being erased by a sanitized bundle.

/rc is now a shared-session mirror instead of a terminal takeover.

Attaching the web app no longer locks the local composer or hides

approvals: both surfaces can prompt while idle (one turn runs at a

time), approval cards stay visible in the terminal and are shared with

the web with first-decision-wins semantics (the losing side is told, a

web decision dismisses the local card), and structured questions are

answered locally instead of cancelled. Fail-closed behavior survives —

the post-failure reconnect lockout, integrity-gated /rc stop, and the

fail-closed shared-approval channel on transport loss are unchanged.

The takeover vocabulary ("web owns prompts and approvals") is gone from

every surface.

Auto-mode provider readiness no longer reports "key saved · not checked"

forever. Readiness checks are recorded against the concrete model the

router ran, but auto-mode reads resolved against the literal auto

identity, which never matched any recorded check — so the setup receipt,

model picker, and fleet setup view showed an eternal unchecked badge

even after hundreds of successful turns. The read now falls back to the

most recent check on the same route (provider + endpoint + auth class);

concrete-model reads keep exact per-model scoping.

The focused sub-agent transcript now scrolls like the main transcript.

The frame renderer sampled the ocean column through a ChatWidget whose

constructor consumed pending_scroll_delta — every PageUp/PageDown and

wheel event was swallowed by an invisible widget before the focused pane

could read it. The delta is now parked across the sample; the pane pins

on user scroll-up, follows new child activity at tail, and

jump-to-bottom releases the pin.

Every Codex OAuth Responses request carried max_output_tokens, a parameter

that endpoint rejects outright ("Unsupported parameter: max_output_tokens"),

so every gpt-5.6-sol turn — including every sub-agent on that route — failed

at the first request. Codex Responses bodies now ship without a client-side

output cap; the backend applies its own. Every other Responses route keeps

the central cap on the wire, exactly as before.

The model-facing lsp tool now supports a bounded read_lints operation

for multi-file, workspace-relative LSP diagnostics without adding another

tool catalog entry (); part of the deepseek-tui-era identifier retirement in was reported as three

problems instead of one.

/status was 31 rows. On an 80x24 terminal the transcript viewport is 18, so

typing /status landed you on the tail of the report: the version, route,

directory, mode and sandbox rows had already scrolled past, and what stayed on

screen was five not reported rows and a $0.0000. The report is 18 rows on a

fresh session — Window override: is present unless the value is already

configured. That is the viewport's height, so once /status itself occupies a

history cell the title row still scrolls off; it does not fit that terminal

whole. Provider, model and reasoning effort are one Route: lockup, the way

the header rail already writes them. Mode and its permissions are one statement

of posture. Rate limits: is gone — it was a push_row of a string literal

and could never say anything but "not available from provider telemetry". The

per-turn token ledger is gone too, because /tokens is that ledger's whole

subject and /status was printing six rows of it at the same weight as the

sandbox policy; the two facts that lived nowhere else, the cumulative in/out

split and the cumulative cache totals, survive on one Session tokens: row.

Footer items: no longer prints ten internal config keys across the full

width — /statusline owns them, and the report now points there in the same

row that points at /tokens. Two blank gutters do the grouping; the

=================== rule under the title is gone.

The /status window-override key has its own labelled row. It used to be

parenthesised onto the end of the provenance row, which pushed

context_window in config.toml past the right edge at 80 columns and wrapped

the sentence. Window source: states the provenance and Window override:

names the exact key — and the override row is omitted entirely when the value

is already configured, rather than advising you to set what you have set.

/help no longer truncates anything. Every label and description used to run

through a truncate_to_width that appended …, which in a two-hundred-row

list promises text no keystroke can reveal and lands mid-token:

(aliases: /qin… left the parenthesis hanging open. Descriptions now shed

whole fields — the alias parenthetical first, then trailing clauses at their

own joints, and only where there is no joint at all, the sentence's short form

on a whole word with no mark, keeping the head noun of a simple verb +

modifier + noun phrase rather than the adjectives that qualified it. The

focused row's description is restated under the filter at the panel's full

width, only when the row itself could not hold it, so a wide terminal does

not say the same sentence twice. At 60 columns that restatement is itself

shed — the /advisor detail stops before session — so the detail is longer

than the row, not a copy of the original sentence.

The /help label column is measured instead of assumed. It was a flat 28

columns at every terminal size, so at 60 columns twenty blank cells sat

between /advisor and a description cut down to 21. Each group now sizes its

column to the labels it actually holds, which nearly doubles the description

column on a narrow terminal, and the label — the string you have to type —

reads one step brighter than the description that qualifies it.

/help stopped spending rows on itself. The match count moved onto the filter

row it describes, the blank spacer under it is gone, and the footer no longer

repeats type to filter while the filter box says Type to filter two lines

above — at 60 columns that duplicate was what pushed the footer onto a second

row. A group header also stopped printing ▸ ▾: the selection cursor and the

collapsed chevron are the same glyph, and a focused collapsed group was

showing it twice for two different facts. Help now opens focused on the first

entry rather than the header above it.

The bottom status rail is no longer one run-on sentence. At 120 columns it

read ▌· idle · Ollama · deepseek-v4-flash · max · Anonymous usage counts are on. … ⌥V:output · /context:context · fn+F1:keys — live state, route

identity, a telemetry consent notice, and keyboard hints all strung together

by the same middle dot in the same ink, so nothing was grouped and the eye

had nothing to skim by. At 80 columns it simply stopped mid-notice, and at 60

the row overflowed and was clipped by the terminal mid-word. The rail now

divides its groups with a blank gutter instead of another dot (the dot is

kept for peers inside a group), the model name reads one step brighter than

the qualifiers that narrow it, and Esc to interrupt reads in the same hint

weight as the right-hand chords rather than in the separator weight.

Nothing on the status rail is ever truncated now. A notice sheds whole

sentences to fit, and if one sentence is still too long it sheds at the inner

joints — a colon, a semicolon — with the trailing mark cut so the phrase that

survives does not itself advertise that more was coming. Route identity sheds

the provider, then the reasoning effort, rather than rendering

deepseek-v4-flash-prev…; a clipped model name is worse than no model name

because routes share prefixes. Clauses rejoin without a Latin space after a

full-width stop, so the Japanese receipt reads as Japanese.

A notice now stands the standing facts down instead of queueing behind them.

Route identity and the ledger chips are still there in ten seconds; the

notice is not, so it takes the row and the key hints yield last. This is what

makes the telemetry receipt readable at 80 columns, where it used to be

simultaneously always present and never legible.

The status rail no longer advertises /context:context. It was spending

eighteen columns of a 24-row screen to name a slash command that announces

itself the moment you type /; the rail advertises chords you cannot

discover any other way. The rail now reads the same at 80 columns as at 200.

The idle screen no longer has an absolute path stretched across it. The

workspace caption between the wordmark and "What do you want to accomplish?"

was composed at full length and then truncated to the lane width, which made

the centering inset (width - caption.width()) / 2 evaluate to zero — so a

line that was written to be centered rendered flush-left and full-bleed,

cutting the centered whale/wordmark/prompt composition in half. The clipping

also destroyed the information it was supposed to carry: at 80 columns the

line read /private/tmp/claude-501/-Volumes-.../34267917-11f4-4d15-911a-…,

which tells the reader nothing about where they are. The caption now sheds

detail instead of being cut — MCP count first, then branch, then leading path

components — so it always fits with room to center, and the folder you are

standing in is the last thing to go. Elisions land on a path separator rather

than mid-directory.

Removed the placeholder engine tree in crates/core/src/engine/. Its

Engine::run accepted Op::SendMessage, appended to a journal, and emitted

TurnComplete { status: "completed" } without ever contacting a model, and

TurnExecutor was a struct with a field-copy constructor and a

step < max_steps comparison. Nothing in the workspace referenced any of it —

the only mention of codewhale_core::engine anywhere was a doc comment inside

the tree itself — but its comments ("the real turn loop is wired here in the

next slice") were what docs/ARCHITECTURE.md leaned on to claim that

crates/core owns the agent loop. There is now exactly one turn loop in the

workspace, Engine::run_turn, and a guard test fails if a second one appears.

docs/ARCHITECTURE.md and AGENTS.md now say where it actually lives.

First-run onboarding no longer silently truncates its explanation in

languages that do not put spaces between words. wrap_words split on

whitespace, so a Japanese sentence arrived as a single token, the

line-break check (which only fires once a line is non-empty) never

triggered, and the over-wide line was clipped by the terminal. At 80

columns the provider screen read

"Hosted providers need a key, but loca" and stopped — losing exactly the

half that tells the reader local runtimes need no key, on the screen where

they choose a provider. Space-less scripts now break by display width on

grapheme clusters, and a line may not begin with closing punctuation

(。, 、, 」, ） and friends). Wrapping for languages that do use

spaces is unchanged.

Project instructions are bounded by one budget and no longer treat other

agents' files as law by default. Previously .claude/instructions.md and

CLAUDE.md sat at ranks 2 and 3 of the canonical instruction list — above

Codewhale's own .codewhale/instructions.md — .claude/rules/ was an

auto-discovered rules directory, and .cursorrules, .cursor/rules,

.clinerules, .windsurf/rules, .gemini, .github/copilot-instructions.md

and .github/muse-instructions.md were all imported into the system prompt

with no opt-in. Dropping a CLAUDE.md written for a different tool into a

repository silently made it standing authority here, which is an injection

surface rather than a convenience. Codewhale now reads AGENTS.md, the

cross-agent .agents/AGENTS.md, and its own instruction files by default;

every other agent's format is opt-in by name through

project_instruction_imports (env CODEWHALE_PROJECT_INSTRUCTION_IMPORTS),

imported files rank below Codewhale's own, and a workspace that contains an

un-imported format says so in a warning naming the exact setting.

Separately, a symlinked candidate rules directory — .cursor/rules,

.windsurf/rules, or .gemini pointing outside the workspace — was

traversed and its contents imported as instruction authority, because the

directory check followed the link while only the files inside it were

checked. The two instruction loaders now apply the same no-follow rule that

.codewhale/rules/ already had.

The three separate ceilings on standing instructions (200 KiB for the

root->workspace chain, 500 KiB for the rules block, 40 KiB for imported

fragments, and a global layer that was merged in after the chain budget had

already closed and so counted against nothing) are replaced by a single

48 KiB aggregate budget covering all of them together. Instructions claim it

before rules, and are trimmed from the broadest scope inward so the

nearest-scope file is the last thing dropped rather than the first thing

stranded. Truncation still leaves an explicit marker.