Changelog

All notable changes to the OACP CLI. The format follows Keep a Changelog and Semantic Versioning.

0.4.3 — 2026-08-12

Added

Review-loop continuation grants — a human-approved approved_thread_continuation grant may now carry a review_loop scope: one repository, PR, and sender thread; the allowed lifecycle types; a round ceiling; a wall-clock expiry; and the permitted review side effects. In-scope same-thread follow-up review rounds then auto-invoke the reviewer without a fresh per-round confirmation. A grant authorizes running a round, never its verdict — the live PR head stays authoritative, with declared heads compared by exact full-SHA equality. Expiry and revocation bind at evaluation time, approvals never authorize retroactively, only rounds that actually ran consume the round budget, and out-of-scope requests pause. Receiver config enables recognition only; authority exists solely in prior human-approved grant audits. Adds the review_continuation audit block, pinned review_continuation_* and review_loop_invalid reason codes, and a conformance fixture set. See Receiver Autonomy → Continuation grants.
Checkpoint re-authorization, specified end to end — three pinned answer channels for a paused threshold checkpoint: a receiver-side human (authoritative), a signature-verified sender reply bounded by the receiver’s own admission policy, and GitHub comments as advisory-only — with rank, never arrival order, deciding conflicts. A consumption rule binds each answer to the pause it clears: scope-less approvals clear one checkpoint, scoped numeric budgets stand for the rest of the task up to the granted value, and boundary-action grants durably authorize one granular capability until task completion. The audit surface separates the requested scope from the effective policy-capped grant, with pinned reason codes checkpoint_reauthorized and checkpoint_reauthorization_stale and a conformance fixture set.
Codex session startup — oacp session-init accepts Codex SessionStart JSON, emits a bounded and truthful ordered-read manifest, optionally pulls memory before verifying it, and reads the active model and cwd from the hook payload. oacp setup codex safely merges one startup-only handler into .codex/hooks.json; users review and trust the definition with /hooks.
Message-history retention — oacp retention prunes outbox, dead-letter, and processed inbox-archive files when they exceed an age or count bound (defaults: 30 days, 1,000 files per target), with validated partial overrides in workspace.json, deterministic dry-run JSON, and file-identity rechecks before deletion.
One archive destination for processed messages — processed inbound messages now have a single cross-runtime destination, inbox/archive/, preserving the original filename and bytes. Quarantine evidence is excluded from automatic pruning by its durable filename format; manually managed fixtures can use adjacent .retain markers. Protocol spec version advances to 0.4.3.

Changed

Codex startup file states now say verified instead of loaded: the command confirms readability and updates status.yaml, while its hook context tells Codex which files still require ordered reads. Legacy .agent-hub project detection has been removed from this Codex path.
oacp setup claude keeps automatic startup memory pull but no longer creates or registers an automatic SessionEnd push. Rerunning setup removes only the exact historical generated registration and leaves any existing script or custom hooks untouched; explicit wrap-up remains the single push path.
Session lifecycle documentation now distinguishes coordinator telemetry in session_lifecycle_state.json from runtime startup and status.yaml.

0.4.2 — 2026-08-07

Added

Enforce-mode signing is live — signing.verify_mode: enforce now has a real caller: the autonomy gate verifies every message at intake, before any evaluation. Only a signed-verified message proceeds; every other outcome (unsigned, INVALID, unknown-kid, revoked, unverifiable) quarantines a mode-600 evidence copy into the receiver’s dead_letter/, evaluates nothing, and exits 3 with an intake_rejected decision object. Rejection is mechanism, not per-receiver diligence. Warn and off behavior are unchanged, and the receive-path contract is pinned by an executable conformance corpus at tests/conformance/intake/. See Message Signing.
Policy-file signing — oacp trust sign-policy signs a receiver’s config.yaml and trust/allowed_signers.yaml with the receiver’s own local key, under a distinct JOSE profile so message and policy signatures can never be exchanged. Loaders verify at load time: audit records carry a policy_auth block binding policy_sha256 to an authorized signer, and a tampered config.yaml fails closed with the new pinned reason code policy_auth_invalid before anything — including its own verify_mode — reads it. Signatures bind their {project, receiver, kind} context, so a signed policy can never be replayed across projects, receivers, or between files; once a target is enrolled in the machine-local registry, an unsigned policy file is invalid, never unsigned — stripping a trailer stops being a downgrade path. Trust mutations atomically re-sign an enrolled trust root or refuse the write.
Default scope envelope for profileless admissions — requests admitted through allow_without_task_profile now receive a documented default envelope (25 minutes / 2 files / reply-only, every capability and risk flag false) instead of running unbounded, so the post-accept threshold checkpoint is always evaluable. A sender-attached voluntary profile on an exempt type replaces the default entirely, and every decision names its envelope origin in the new scope_envelope_source field. Protocol spec version bumps to 0.4.2.
Recorded enforcement branch for approved public-visibility tasks — oacp envelope compile --audit <admission-record> on a human-approved public_visibility: true task deliberately does not compile (a compiled public envelope would deny the entire approved chain) and instead stamps envelope_enforcement: none with the named reason public_visibility_admission_approved into the audit record — degradation as a documented mode with the human as the bound, not a silent absence.
One shared receive boundary — the gate, the oacp inbox lister, the oacp watch emitter, the send helper’s parent-message lookup, and every policy consumer verify and parse a single bounded snapshot of each security-sensitive file, closing swap windows between verification and use. Under enforce, an unverified message surfaces as a held row or event built from filesystem metadata only, never donates thread identity to replies, and never counts as sender liveness; the envelope compiler refuses to compile from a message that is not signed-verified.

Fixed

Negation demotion recognizes scope headings — an unambiguous negation heading now carries over its immediately following, bounded block (blank lines and subsequent headings end the scope); non-demotable side-effect and content-sensitivity hard stops remain hard.
Own-version bumps under touches_dependencies: false — envelope enforcement allows an Edit/Write confined to the project’s own [project] version string in pyproject.toml, while still counting the file and denying real dependency, mixed, ambiguous, and Bash-side manifest edits.
Audit records resolve runtime.model at the writer — caller-first, then the OACP_RUNTIME_MODEL environment variable, normalized at write time with provenance in model_source; records with no signal carry an explicit model_unknown_reason, never a silent null. The writer also validates result.completion_kind against the pinned enum, refusing caller-composed off-enum kinds.
Hidden directories under agents/ are ignored consistently, so runtime scaffolding no longer appears as phantom agents in doctor, inbox, profile, and trust workflows.
Intake conformance degrades gracefully without the crypto extra — goldens that pin a signature-evaluation outcome skip when the optional cryptography dependency is absent; the release quality gate installs the extra so the full signing matrix runs before publishing.
Foreign-session oacp envelope show exemption recognizes --option=value spellings, unambiguous long-option abbreviations, and help flags without weakening its fail-closed handling of unknown options.

0.4.1 — 2026-08-04

Fixed

Envelope enforcement is session-scoped — the compiled envelope records the harness session that compiled it, and the Claude adapter no-ops for tool calls from any other session. A concurrent interactive session in the same repository no longer inherits a dispatched task’s constraints or consumes its files_touched budget.
Signing-only receiver configs stay conservative — a config that omits the autonomy block (for example a signing:-only config) now behaves like an absent config file (always_pause) instead of being treated as malformed; oacp doctor reports it valid.
Envelope hook compound-command parsing — the Claude hook splits compound Bash commands only at shell operators outside quoted arguments and command substitutions, so read-only patterns containing literal pipes no longer false-escalate. Every ask/deny reason now carries the stable [oacp-envelope] source tag and the active task message id.
Autonomy audit persistence — the gate evaluator now persists complete, lock-serialized audit records to its --audit-dir destination; previously an evaluation could finish without writing the durable record.
oacp doctor gates enforce-mode signing readiness on trust-pin completeness — every catalog identity must carry an active pin before a receiver flips to enforce, with gaps reported per receiver.

0.4.0 — 2026-07-17

Added

Ed25519 message signing (opt-in) — oacp send appends a single final-line detached-JWS auth trailer signed over the exact raw message bytes (EdDSA-only locked JOSE profile, RFC 7638 kid). oacp verify implements verify-before-parse against receiver-local pins only — no network at verify time. Warn mode annotates each message as unsigned / signed-unknown-kid / signed-verified / signed-INVALID without rejecting, and byte-tampered messages can be set aside with a no-clobber evidence copy in dead_letter/ via oacp verify --quarantine — the original stays untouched. Signing requires the optional crypto extra: pip install 'oacp-cli[crypto]'. See Message Signing and oacp verify.
Key management and trust root — oacp key gen|list manage dedicated Ed25519 signing keys under $OACP_HOME/keys/ (0700/0600, never synced); oacp trust import|list|revoke maintain a zero-authority project catalog plus per-receiver allowed_signers.yaml pins, integrity-checked end to end (thumbprint recomputation, public-only JWK profile, no silent reactivation of revoked pins). oacp doctor gains a Trust Root category. See oacp key and oacp trust.
Task-profile granulars merges_pr and files_issues — PR-landing authority and issue-filing are now first-class declarable capabilities, embedded in the compiled envelope and consulted by the hook’s gh classifier. A declared merges_pr always pauses at admission (merges_pr_pause) so merge authority passes a human at least once; under allow_pr_artifacts, a declared files_issues joins the private-repository artifact class. See Receiver Autonomy.
Checkpoint and audit instrumentation — breached threshold checkpoints stamp paused_at_utc and breach_basis: declared_intent | realized, distinguishing prospective declaration-correction pauses from realized drift; audit records gain co_occurring_reason_codes so a hard-stopped dispatch still records threshold breaches; the gate evaluator self-stamps its provenance (source, content hash, git SHA) into every decision.
oacp trust revoke — fleet compromise response without hand-editing trust files: validates the canonical kid spelling, flips the pin to status: revoked under the project trust lock, and is safely re-runnable.
Signing conformance corpus — byte-exact golden fixtures pin the auth-trailer boundary and RFC 7515 signing inputs, with a tamper-detection suite covering payload flips, trailer transplants, kid substitution, and encoding aliases; non-canonical encodings fail as signed-INVALID.

Changed

result.completion_kind is a pinned four-value enum — auto_accepted, admission_paused, checkpoint_paused, config_malformed — naming the terminal shape of the evaluation only; receivers copy the evaluator’s value verbatim.
oacp autonomy-outcome pins the actor convention — one canonical, whitespace-free handle per human, fleet-wide; the anonymous default human warns.

Fixed

oacp autonomy-outcome accepts checkpoint-paused records — measuring decision latency from the checkpoint’s paused_at_utc rather than refusing outright or counting the whole execution window as human latency.
oacp envelope clear executes from inside the enforced session — validated against the task’s newest audit record (matched by content, sanctioned only on a terminal final_state), so completed envelopes no longer strand until a human clears them. Protocol-mandated bookkeeping (audit records, inbox/outbox writes, the runtime scratchpad) no longer consumes the declared expected_files_touched budget.
Alias-spelled kids fail pin loads loudly — closing the gap where a revoked, alias-spelled pin entry could silently miss its revocation at lookup.

0.3.5 — 2026-07-11

Added

Runtime envelope enforcement — oacp envelope compile|show|clear turns an admitted message’s task_profile plus receiver config into a runtime envelope enforced at the tool-call layer by a static Claude PreToolUse hook (registered once by oacp setup claude). Compilation is fail-closed, envelope drift denies with the canonical threshold-checkpoint opener, and the audit outcome block records envelope_enforcement: hooks | none. See Receiver Autonomy.
Gate 3 demotion mechanisms — sender-marked oacp-guardrails fences, a negation fallback, and declaration-aware lexical advisories reduce hard-stop false positives, backed by a pinned reason-code taxonomy with executable conformance fixtures.
external_side_effects: allow_pr_artifacts — declared PR, review, and issue-comment artifacts auto-proceed only for receiver-allowlisted private repositories; public or unlisted artifacts, direct main pushes, merges, deploys, and publishes still pause.
Schema-v2 autonomy audits + oacp autonomy-outcome — audits record the full declared task profile, an explicit breach list, a semantic policy hash, and a shared outcome block with completion time and materialized-risk telemetry; the new subcommand atomically records human approval, modification, decline, latency, and grant decisions.
Standing continuation grants (default-off) — resolve only from an explicit prior human approval in the same conversation thread; sender-declared grant data alone cannot authorize follow-up scope.
Security policy: Tier-1.5 trust ceiling — documents that from fields are unauthenticated traceability on single-OS-user hosts; hard isolation requires separate OS users, containers, or hosts.

Changed

The standard auto_review estimate cap is 45 minutes; estimates above 45 still pause and the five-file cap is unchanged.
Pricing and commercial matches remain hard pauses under the separate hard_stop_content_sensitivity category.
The versioning guide documents the staged release pipeline end to end.

Fixed

Undeclared runtime side effects now produce declaration_error at the threshold checkpoint instead of silently completing outside the profile.
doctor --memory forwards bounded network timeouts to remote Git fetches; the MCP stdio coordinator converts unexpected request exceptions into structured -32603 responses; message validation accepts the six documented review-loop telemetry fields.

0.3.4 — 2026-06-11

Fixed

Receiver-autonomy Gate 1 now enforces message integrity for real — schema validation, expiry comparison, raw-YAML SHA-256 recording, and same-receiver replay detection all run before a message can auto-accept, closing the gap where the gate reported these checks without performing them. See Receiver Autonomy.
Gate 3 sensitive-scope hardening — the hard-stop classifier now pauses on credentials, pricing, commercial content, and anchored config-sensitive scope, and evaluates external side-effect hard stops before sensitive-scope hard stops to match the protocol ordering.

0.3.3 — 2026-06-11

Added

oacp watch --state-id <id> — per-subscriber cursor files let concurrent watchers of the same agent inbox each receive every NEW_MESSAGE event without sharing (and swallowing) a single cursor. See oacp watch.

Changed

Docs — refreshed the runtime capability matrix and prompt-caching guidance for current runtime releases.

Fixed

--oacp-dir tilde expansion — oacp send --oacp-dir and oacp inbox --oacp-dir now expand ~ through the shared OACP home resolver instead of treating it as a literal path component.
Atomic inbox/outbox writes — delivery now uses same-directory temp files plus atomic replace, so readers never observe a partial .yaml message.
Memory archive tests isolate git config while preserving test identities, so local commit-signing settings no longer break the suite.

0.3.2 — 2026-05-26

Added

Receiver-autonomy scope envelope — the auto_review evaluator now normalizes each task_profile into a scope envelope with first-class side-effect booleans (creates_or_updates_pr, comments_on_github, commits_changes, sends_oacp_reply_only), a post-acceptance threshold checkpoint that records actuals and self-pauses on drift, and a pinned terminal-state taxonomy. See Receiver Autonomy.
Default-off continuation grants — a receiver may honor an explicit same-thread approved_thread_continuation grant that stays inside its declared scope, but only when autonomy.continuation_grants.enabled: true. Disabled by default; grants never override destructive, auth/secrets, dependency, public-scope, pricing, or memory-SSOT hard stops.
First-class cursor runtime — agent profiles, agent cards, status validation, sender inference via OACP_RUNTIME=cursor, oacp add-agent --runtime cursor, and oacp setup cursor. oacp setup cursor --project <project> provisions the project-side Cursor agent directory and writes a repo-local .cursor/rules/oacp.todo.mdc placeholder; Cursor-owned rules and memory hooks remain deferred.

Changed

oacp init now defaults to claude,codex,cursor — Gemini remains fully supported through oacp init --agents … and oacp setup gemini.
Autonomy docs and templates now ship the current agents/<receiver>/config.yaml schema, including the continuation_grants block.
Docs — added an asynchronous claude -p on-ramp guide and refreshed the quickstart for the current CLI surface.

0.3.1 — 2026-05-12

Added

auto_review autonomy mode — an opt-in receiver-side autonomy profile that lets an agent auto-accept inbound messages only when they clear a deterministic four-gate evaluator, pausing on anything uncertain and hard-stopping on destructive or sensitive scope. Enable it per receiver with autonomy.default_mode: auto_review in agents/<receiver>/config.yaml, bounded by auto_review_thresholds (estimated time, files touched, risk flags). Off by default — existing receivers keep always_pause behavior unless they opt in. Ships with a conformance fixture suite under tests/conformance/autonomy/ covering clean tasks, ambiguous scope, hard-stop triggers, and malformed config. See Receiver Autonomy.

Changed

Docs — the README and onboarding pages now link the companion oacp-skills library so readers can find the skill set that pairs with the protocol.

0.3.0 — 2026-04-29

Added

oacp memory init|clone|pull|push|disable — opt-in cross-machine sync for OACP memory via a plain git repository rooted at $OACP_HOME. Tracks $OACP_HOME/org-memory/** and $OACP_HOME/projects/*/memory/**; ignores everything else by default. Three-state activation model — Disabled (no marker), Local-only (init without --remote), Synced (init --remote <URL> or clone <URL>). See Shared Memory protocol for the full design and CLI Reference for flags.
oacp doctor --memory — advisory checks for the memory git repo: marker presence, allowlist coverage, tracked/untracked leakage, clean/ahead/behind/diverged state, remote reachability, commit staleness, agents/ leakage, and per-project memory overlay safety. See CLI Reference.
Claude memory lifecycle hooks — oacp setup claude now installs oacp-memory-pull.sh and oacp-memory-push.sh and registers them under SessionStart and SessionEnd in .claude/settings.json. Hooks are marker-gated and no-op silently when memory sync is not enabled, so existing workflows are unaffected on machines that have not opted in. See CLI Reference.

0.2.3 — 2026-04-26

Changed

oacp watch defaults are now notification-friendly — existing inbox messages are no longer replayed on first run for a target, and message_archived events are suppressed by default. Pass --since=epoch to restore replay and --show-archived to re-enable archive events. Reduces noise for Monitor and oacp watch consumers.

Added

oacp watch --since=<spec> — controls the first-run baseline cutoff. Accepts now (default), epoch, relative durations (30s, 5m, 2h, 7d), or ISO 8601 timestamps. Only applies on first run for a target (no state file yet).
oacp watch --show-archived — opt-in flag to emit message_archived events. Useful for observer agents tracking another agent’s inbox; disabled by default because the watching agent’s own deletes are self-loops.

0.2.2 — 2026-04-17

Added

oacp watch — monitor-friendly inbox/outbox watcher with structured stdout (NEW_MESSAGE / message_archived lines or --json) and partial-progress preservation on errors. Designed for Claude Monitor, shell loops, or any process that re-runs the command. See CLI Reference.

Changed

Docs: refreshed cross-runtime capability matrix and public-skill parity framing.

0.2.1 — 2026-03-22

Fixed

oacp doctor no longer fails when gh CLI is not installed — gh is now optional.
oacp send relaxed handoff body schema validation to accept freeform content.
oacp write-event --related now handles JSON arrays correctly.

Changed

README: refreshed command table with all v0.2.0 CLI commands; updated workspace layout diagram.
SPEC.md: synced with v0.2.0 — version header, org-memory section, kernel inventory with exposure column.
Onboarding docs: setup uses pip install as primary install; quickstart adds --agents / --repo flags; memory archive command name fixed.

0.2.0 — 2026-03-20

Added

oacp inbox command — list pending inbox messages for one agent (--agent) or all agents (--all) with table or --json output. See CLI Reference.
Sender inference for oacp send — --from is now optional. When omitted, the sender is resolved from OACP_AGENT, AGENT_NAME, or agent card runtime match. See CLI Reference.

Changed

Consolidated shared script constants into _oacp_constants.py — canonical AGENT_RE, runtime tuples, timestamp and template helpers.
Agent name validation now requires an alphanumeric first character. Names starting with _, ., or - are rejected.
Message ID and filename suffixes use secrets.token_hex instead of random.choices for better randomness.

0.1.9 — 2026-03-20

Added

Memory archive layer — oacp memory archive and oacp memory restore commands for active/archive split. Non-standard memory files can be moved to memory/archive/ and restored later. See CLI Reference.
Declarative agent profiles — oacp agent init|show|list CLI commands with two-tier profile system (global profiles + project-level card overrides). See CLI Reference.
known_debt.md — standard memory file for tracking verified, unresolved project debt. Created automatically by oacp init.

0.1.2 — 2026-03-18

Added

oacp add-agent — add an agent to an existing project workspace without re-initializing. See CLI Reference.
oacp setup — generate runtime-specific config files (CLAUDE.md, AGENTS.md) in a repo. See CLI Reference.
Org-level memory — oacp org-memory init and oacp write-event for cross-project knowledge sharing. See CLI Reference.
oacp doctor --fix — auto-fix missing inbox directories and regenerate missing or stale status files.
ACP (Agent Client Protocol) added to protocol comparison documentation.

0.1.1 — 2026-03-16

Added

Quickstart example and protocol comparison table.
PyPI, runtime, and PRs Welcome badges to README.

Changed

Version bump for post-release maintenance.

0.1.0 — 2026-03-15

Added

Initial public release of oacp-cli on PyPI.
Core CLI commands: oacp init, oacp send, oacp doctor, oacp validate.
File-based inbox/outbox messaging protocol with 12 message types.
Project workspace initialization with agent directories, shared memory, and packet storage.
Message validation against OACP schema.
Doctor command for environment and workspace health checks.
GitHub Actions release pipeline with PyPI Trusted Publishing.
Protocol specs: inbox/outbox, multi-agent shared workspace, credential scoping, cross-runtime sync.
Templates for review packets, agent roles, and guardrails.
Shell and Python kernel scripts for workspace operations.
Apache 2.0 license, CONTRIBUTING guide, community health files.

Changed

Renamed $AGENT_HUB to $OACP_HOME across codebase.
Removed legacy Antigravity workflow/policy system.