Changelog

All notable changes to the OACP CLI. The format follows Keep a Changelog and Semantic Versioning.

0.5.2 — 2026-09-15

Added

Every cleared checkpoint pause is excluded from recorded work time. See the threshold-exceeded checkpoint.
oacp doctor advises on records born done but never finalized. See oacp doctor.

Changed

Protocol contract stamp spec_version moves to 0.5.2.
Handoff-body schema failures become advisories, not rejections.
Task and review continuations share one bounded generic thread grant. See continuation grants.
Legacy review-continuation grant scopes need fresh human approval. See continuation grants.
A terminal-time checkpoint pins completion at the breach. See Receiver Autonomy.
Auto-accepted records are born pending; finalize writes done. See Receiver Autonomy.
A done record sanctions oacp envelope clear only with a completion stamp. See oacp envelope.
Dependency, credential, and auth/config wording demotes to the declared flag’s own pause. See the four-gate evaluator.
The oacp memory/org-memory shims and the write-event fallback stay through 0.5.2; removal moves to 0.5.3. See oacp memory.

Fixed

Resuming an unanswered checkpoint keeps its original pause time. See the threshold-exceeded checkpoint.

0.5.1 — 2026-09-11

Added

Attributed work-clock deductions for multiple excluded intervals, including human-directed time away. See the threshold-exceeded checkpoint.
Cancellation receipts that close admitted tasks while preserving partial delivery and pause history. See Receiver Autonomy.
Envelope compilation stamps the enforcement it resolved: hooks only when the receiver’s adapter is present, none with a reason otherwise. See envelope compilation.

Changed

The protocol contract stamp spec_version moves to 0.5.1.
oacp retention no longer prunes: the engine is parked outside the kernel and the subcommand prints where it went until its removal in 0.5.3. See oacp retention.
oacp write-event execs agent-memory event write when the installed tool serves it, falling back to the bundled script until its removal in 0.5.2. See oacp write-event.
The exec path prints published:/idempotent: where the bundled script prints OK:.
oacp session-init --pull-memory is a no-op that names the memory tool’s own SessionStart hook, until its removal in 0.5.3.

Fixed

The sync allowlist anchors .gitignore and .oacp-memory-repo to the home root, matching the memory tool’s golden byte for byte.
Preflight’s conflict-marker check flags the diff3 ||||||| base marker.

0.5.0 — 2026-09-09

Added

Memory-layout conformance fixture pinning the layout grammar and sync allowlist.
oacp doctor reports the installed agent-memory version and defers memory-home checks to it. See oacp doctor.
Preflight and wheel guards fail when a kernel module or the wheel ships the memory engine.

Changed

The org-memory doc becomes the three-tier memory layout spec the kernel scaffolds against.
oacp memory and oacp org-memory delegate to the agent-memory CLI until their removal in 0.5.2. See oacp memory.
oacp setup no longer installs memory hooks and retires the ones it generated; agent-memory setup replaces them. See oacp setup.
oacp session-init --pull-memory delegates to agent-memory, reporting disabled when absent.

Removed

docs/protocol/cross_runtime_sync.md; its durable-memory half moved to the layout spec.
The bundled memory engine and org-memory doctor category, shipped as agent-memory-cli.
oacp doctor --memory; the memory home is checked by agent-memory doctor. See oacp doctor.

Fixed

oacp setup codex regenerates its managed SessionStart hook but never creates one.

0.4.6 — 2026-09-05

Added

Autonomy audits distinguish expected pauses from unplanned ones, so a designed pause no longer reads as a surprise. See Receiver Autonomy.
A modified human outcome can retain what was actually changed, instead of recording only the verdict. See human approval and decline outcomes.

Fixed

Startup safety and dispatch guidance follow the current exact-file archive lifecycle. See message lifecycle.
Startup guidance preserves project-memory reads and retrieves org memory on demand.

0.4.5 — 2026-09-02

Changed

task_profile.estimated_minutes is the declared admission cap, not an expected duration. See message fields.
The protocol contract stamp spec_version moves to 0.4.5 under a pinned bump rule.

Removed

The unsupported MCP coordinator prototype and the packaged session-telemetry script; session telemetry is runtime-owned.

Fixed

oacp doctor --fix creates status.yaml from the packaged template on wheel installs. See oacp doctor.
Autonomy admission prefers an unfenced task_profile declaration over a fenced example. See message fields.
Claude envelope accounting recognizes dashed and undashed runtime scratchpad roots without exempting sibling paths. See envelope compilation.
Autonomy finalization requires the receiver’s work-start stamp and flags legacy terminal receipts that omit it. See the threshold-exceeded checkpoint.
oacp autonomy-finalize resolves the receiver policy from the record, so a sender re-authorization arbitrates under the receiver’s verified caps instead of failing closed.
oacp autonomy-outcome records a checkpoint clear without overwriting the admission outcome, and refuses writes to records already closed by completion evidence.
Codex and Claude agent setup publish every message type their inbox workflows handle, and record an explicit unknown model rather than echoing the runtime name into status.yaml. See oacp setup.

0.4.4 — 2026-08-28

Added

A central session-debrief store — every agent’s end-of-session debrief now lands in a kernel-owned, append-only org-memory/debriefs/<project>/<YYYY>/<MM>/ layout, one immutable file per session, instead of per-project trees. oacp org-memory init creates the store and oacp doctor checks its setup.
oacp autonomy-finalize — writes and validates checkpoint and terminal autonomy audit updates under lock, with oacp doctor sweeping audit directories under the same checks. Every persisted evaluation now carries an evaluation_id, and a re-evaluation supersedes the prior record through a locked transaction. See Receiver Autonomy.
An instance agent registry — oacp add-agent and oacp init --agents populate it; oacp agent sync backfills existing workspaces.
The wheel now ships the four kernel protocol docs, the wire message template, and five previously unpackaged scripts under oacp/_protocol/, oacp/_templates/, and oacp/_scripts/. Preflight and CI fail when scripts/ and the wheel’s force-include table drift apart.
A waiting_on_peer checkpoint sub-basis separates peer-reply latency from working time in a realized time breach, plus a conformance fixture pinning the default scope envelope stamped on profileless admits.

Changed

Realized-usage measurement is now precise about what it counts — actual_minutes is active wall-clock from the receiver-stamped work_started_at_utc, excluding admission idle and re-authorization pauses, and expected_files_touched counts distinct deliverable files only, not receiver bookkeeping, memory, cache, or scratch writes.
Parent-less oacp send messages get an automatic thread identifier.
Pricing and commercial content sensitivity is an advisory rather than a hard stop for reply-only task profiles.
Enveloped sessions can no longer write the receiver’s audit/autonomy_decisions/ directly; only the canonical oacp audit writers can.
The runtime capability matrix and the prompt-caching guide moved to the public Kiloloop research repository, leaving a redirect at the caching guide’s former path. SPEC.md folds into a thin index over the protocol docs, and the README command table is generated from oacp --help with a drift test.
Raised the optional cryptography floor to 50.0.0 and the Python floor to 3.9.2 to exclude known-vulnerable crypto releases, and pinned the development and release toolchain through a shared dependency group with workflow actions on immutable commits.

Removed

The zero-consumer scripts normalize_findings.py, create_handoff_packet.py, and init_project_workspace.sh, with their Makefile targets — oacp init replaces make init.

Fixed

A complete admission ledger — autonomy audit records now carry admission_axes, so a hard stop no longer masks the threshold, side-effect, or declaration axes, and a declaration_error pause records which profile field failed and why.
Lexical classification records its own provenance — every match carries its source span and demotion basis. Negated or descriptive public-repository, dependency-install, and merge-method language no longer trips a hard stop, while stacked negations and later unaccounted occurrences still cannot demote an affirmative match.
The envelope hook no longer counts phantom files_touched from heredoc bodies or unexpanded shell variables; variable-spelled write targets escalate to ask. A granted checkpoint re-authorization now widens the live file budget, so extra files no longer stay blocked after a valid grant.
SPEC.md describes the archive-never-delete inbox lifecycle instead of saying recipients delete processed messages.

0.4.3 — 2026-08-12

Added

Review-loop continuation grants — a human-approved approved_thread_continuation grant may now carry a review_loop scope: one repository, PR, and sender thread; the allowed lifecycle types; a round ceiling; a wall-clock expiry; and the permitted review side effects. In-scope same-thread follow-up review rounds then auto-invoke the reviewer without a fresh per-round confirmation. A grant authorizes running a round, never its verdict — the live PR head stays authoritative, with declared heads compared by exact full-SHA equality. Expiry and revocation bind at evaluation time, approvals never authorize retroactively, only rounds that actually ran consume the round budget, and out-of-scope requests pause. Receiver config enables recognition only; authority exists solely in prior human-approved grant audits. Adds the review_continuation audit block, pinned review_continuation_* and review_loop_invalid reason codes, and a conformance fixture set. See Receiver Autonomy → Continuation grants.
Checkpoint re-authorization, specified end to end — three pinned answer channels for a paused threshold checkpoint: a receiver-side human (authoritative), a signature-verified sender reply bounded by the receiver’s own admission policy, and GitHub comments as advisory-only — with rank, never arrival order, deciding conflicts. A consumption rule binds each answer to the pause it clears: scope-less approvals clear one checkpoint, scoped numeric budgets stand for the rest of the task up to the granted value, and boundary-action grants durably authorize one granular capability until task completion. The audit surface separates the requested scope from the effective policy-capped grant, with pinned reason codes checkpoint_reauthorized and checkpoint_reauthorization_stale and a conformance fixture set.
Codex session startup — oacp session-init accepts Codex SessionStart JSON, emits a bounded and truthful ordered-read manifest, optionally pulls memory before verifying it, and reads the active model and cwd from the hook payload. oacp setup codex safely merges one startup-only handler into .codex/hooks.json; users review and trust the definition with /hooks.
Message-history retention — oacp retention prunes outbox, dead-letter, and processed inbox-archive files when they exceed an age or count bound (defaults: 30 days, 1,000 files per target), with validated partial overrides in workspace.json, deterministic dry-run JSON, and file-identity rechecks before deletion.
One archive destination for processed messages — processed inbound messages now have a single cross-runtime destination, inbox/archive/, preserving the original filename and bytes. Quarantine evidence is excluded from automatic pruning by its durable filename format; manually managed fixtures can use adjacent .retain markers. Protocol spec version advances to 0.4.3.

Changed

Codex startup file states now say verified instead of loaded: the command confirms readability and updates status.yaml, while its hook context tells Codex which files still require ordered reads. Legacy .agent-hub project detection has been removed from this Codex path.
oacp setup claude keeps automatic startup memory pull but no longer creates or registers an automatic SessionEnd push. Rerunning setup removes only the exact historical generated registration and leaves any existing script or custom hooks untouched; explicit wrap-up remains the single push path.
Session lifecycle documentation now distinguishes coordinator telemetry in session_lifecycle_state.json from runtime startup and status.yaml.

0.4.2 — 2026-08-07

Added

Enforce-mode signing is live — signing.verify_mode: enforce now has a real caller: the autonomy gate verifies every message at intake, before any evaluation. Only a signed-verified message proceeds; every other outcome (unsigned, INVALID, unknown-kid, revoked, unverifiable) quarantines a mode-600 evidence copy into the receiver’s dead_letter/, evaluates nothing, and exits 3 with an intake_rejected decision object. Rejection is mechanism, not per-receiver diligence. Warn and off behavior are unchanged, and the receive-path contract is pinned by an executable conformance corpus at tests/conformance/intake/. See Message Signing.
Policy-file signing — oacp trust sign-policy signs a receiver’s config.yaml and trust/allowed_signers.yaml with the receiver’s own local key, under a distinct JOSE profile so message and policy signatures can never be exchanged. Loaders verify at load time: audit records carry a policy_auth block binding policy_sha256 to an authorized signer, and a tampered config.yaml fails closed with the new pinned reason code policy_auth_invalid before anything — including its own verify_mode — reads it. Signatures bind their {project, receiver, kind} context, so a signed policy can never be replayed across projects, receivers, or between files; once a target is enrolled in the machine-local registry, an unsigned policy file is invalid, never unsigned — stripping a trailer stops being a downgrade path. Trust mutations atomically re-sign an enrolled trust root or refuse the write.
Default scope envelope for profileless admissions — requests admitted through allow_without_task_profile now receive a documented default envelope (25 minutes / 2 files / reply-only, every capability and risk flag false) instead of running unbounded, so the post-accept threshold checkpoint is always evaluable. A sender-attached voluntary profile on an exempt type replaces the default entirely, and every decision names its envelope origin in the new scope_envelope_source field. Protocol spec version bumps to 0.4.2.
Recorded enforcement branch for approved public-visibility tasks — oacp envelope compile --audit <admission-record> on a human-approved public_visibility: true task deliberately does not compile (a compiled public envelope would deny the entire approved chain) and instead stamps envelope_enforcement: none with the named reason public_visibility_admission_approved into the audit record — degradation as a documented mode with the human as the bound, not a silent absence.
One shared receive boundary — the gate, the oacp inbox lister, the oacp watch emitter, the send helper’s parent-message lookup, and every policy consumer verify and parse a single bounded snapshot of each security-sensitive file, closing swap windows between verification and use. Under enforce, an unverified message surfaces as a held row or event built from filesystem metadata only, never donates thread identity to replies, and never counts as sender liveness; the envelope compiler refuses to compile from a message that is not signed-verified.

Fixed

Negation demotion recognizes scope headings — an unambiguous negation heading now carries over its immediately following, bounded block (blank lines and subsequent headings end the scope); non-demotable side-effect and content-sensitivity hard stops remain hard.
Own-version bumps under touches_dependencies: false — envelope enforcement allows an Edit/Write confined to the project’s own [project] version string in pyproject.toml, while still counting the file and denying real dependency, mixed, ambiguous, and Bash-side manifest edits.
Audit records resolve runtime.model at the writer — caller-first, then the OACP_RUNTIME_MODEL environment variable, normalized at write time with provenance in model_source; records with no signal carry an explicit model_unknown_reason, never a silent null. The writer also validates result.completion_kind against the pinned enum, refusing caller-composed off-enum kinds.
Hidden directories under agents/ are ignored consistently, so runtime scaffolding no longer appears as phantom agents in doctor, inbox, profile, and trust workflows.
Intake conformance degrades gracefully without the crypto extra — goldens that pin a signature-evaluation outcome skip when the optional cryptography dependency is absent; the release quality gate installs the extra so the full signing matrix runs before publishing.
Foreign-session oacp envelope show exemption recognizes --option=value spellings, unambiguous long-option abbreviations, and help flags without weakening its fail-closed handling of unknown options.

0.4.1 — 2026-08-04

Fixed

Envelope enforcement is session-scoped — the compiled envelope records the harness session that compiled it, and the Claude adapter no-ops for tool calls from any other session. A concurrent interactive session in the same repository no longer inherits a dispatched task’s constraints or consumes its files_touched budget.
Signing-only receiver configs stay conservative — a config that omits the autonomy block (for example a signing:-only config) now behaves like an absent config file (always_pause) instead of being treated as malformed; oacp doctor reports it valid.
Envelope hook compound-command parsing — the Claude hook splits compound Bash commands only at shell operators outside quoted arguments and command substitutions, so read-only patterns containing literal pipes no longer false-escalate. Every ask/deny reason now carries the stable [oacp-envelope] source tag and the active task message id.
Autonomy audit persistence — the gate evaluator now persists complete, lock-serialized audit records to its --audit-dir destination; previously an evaluation could finish without writing the durable record.
oacp doctor gates enforce-mode signing readiness on trust-pin completeness — every catalog identity must carry an active pin before a receiver flips to enforce, with gaps reported per receiver.

0.4.0 — 2026-07-17

Added

Ed25519 message signing (opt-in) — oacp send appends a single final-line detached-JWS auth trailer signed over the exact raw message bytes (EdDSA-only locked JOSE profile, RFC 7638 kid). oacp verify implements verify-before-parse against receiver-local pins only — no network at verify time. Warn mode annotates each message as unsigned / signed-unknown-kid / signed-verified / signed-INVALID without rejecting, and byte-tampered messages can be set aside with a no-clobber evidence copy in dead_letter/ via oacp verify --quarantine — the original stays untouched. Signing requires the optional crypto extra: pip install 'oacp-cli[crypto]'. See Message Signing and oacp verify.
Key management and trust root — oacp key gen|list manage dedicated Ed25519 signing keys under $OACP_HOME/keys/ (0700/0600, never synced); oacp trust import|list|revoke maintain a zero-authority project catalog plus per-receiver allowed_signers.yaml pins, integrity-checked end to end (thumbprint recomputation, public-only JWK profile, no silent reactivation of revoked pins). oacp doctor gains a Trust Root category. See oacp key and oacp trust.
Task-profile granulars merges_pr and files_issues — PR-landing authority and issue-filing are now first-class declarable capabilities, embedded in the compiled envelope and consulted by the hook’s gh classifier. A declared merges_pr always pauses at admission (merges_pr_pause) so merge authority passes a human at least once; under allow_pr_artifacts, a declared files_issues joins the private-repository artifact class. See Receiver Autonomy.
Checkpoint and audit instrumentation — breached threshold checkpoints stamp paused_at_utc and breach_basis: declared_intent | realized, distinguishing prospective declaration-correction pauses from realized drift; audit records gain co_occurring_reason_codes so a hard-stopped dispatch still records threshold breaches; the gate evaluator self-stamps its provenance (source, content hash, git SHA) into every decision.
oacp trust revoke — fleet compromise response without hand-editing trust files: validates the canonical kid spelling, flips the pin to status: revoked under the project trust lock, and is safely re-runnable.
Signing conformance corpus — byte-exact golden fixtures pin the auth-trailer boundary and RFC 7515 signing inputs, with a tamper-detection suite covering payload flips, trailer transplants, kid substitution, and encoding aliases; non-canonical encodings fail as signed-INVALID.

Changed

result.completion_kind is a pinned four-value enum — auto_accepted, admission_paused, checkpoint_paused, config_malformed — naming the terminal shape of the evaluation only; receivers copy the evaluator’s value verbatim.
oacp autonomy-outcome pins the actor convention — one canonical, whitespace-free handle per human, fleet-wide; the anonymous default human warns.

Fixed

oacp autonomy-outcome accepts checkpoint-paused records — measuring decision latency from the checkpoint’s paused_at_utc rather than refusing outright or counting the whole execution window as human latency.
oacp envelope clear executes from inside the enforced session — validated against the task’s newest audit record (matched by content, sanctioned only on a terminal final_state), so completed envelopes no longer strand until a human clears them. Protocol-mandated bookkeeping (audit records, inbox/outbox writes, the runtime scratchpad) no longer consumes the declared expected_files_touched budget.
Alias-spelled kids fail pin loads loudly — closing the gap where a revoked, alias-spelled pin entry could silently miss its revocation at lookup.

0.3.5 — 2026-07-11

Added

Runtime envelope enforcement — oacp envelope compile|show|clear turns an admitted message’s task_profile plus receiver config into a runtime envelope enforced at the tool-call layer by a static Claude PreToolUse hook (registered once by oacp setup claude). Compilation is fail-closed, envelope drift denies with the canonical threshold-checkpoint opener, and the audit outcome block records envelope_enforcement: hooks | none. See Receiver Autonomy.
Gate 3 demotion mechanisms — sender-marked oacp-guardrails fences, a negation fallback, and declaration-aware lexical advisories reduce hard-stop false positives, backed by a pinned reason-code taxonomy with executable conformance fixtures.
external_side_effects: allow_pr_artifacts — declared PR, review, and issue-comment artifacts auto-proceed only for receiver-allowlisted private repositories; public or unlisted artifacts, direct main pushes, merges, deploys, and publishes still pause.
Schema-v2 autonomy audits + oacp autonomy-outcome — audits record the full declared task profile, an explicit breach list, a semantic policy hash, and a shared outcome block with completion time and materialized-risk telemetry; the new subcommand atomically records human approval, modification, decline, latency, and grant decisions.
Standing continuation grants (default-off) — resolve only from an explicit prior human approval in the same conversation thread; sender-declared grant data alone cannot authorize follow-up scope.
Security policy: Tier-1.5 trust ceiling — documents that from fields are unauthenticated traceability on single-OS-user hosts; hard isolation requires separate OS users, containers, or hosts.

Changed

The standard auto_review estimate cap is 45 minutes; estimates above 45 still pause and the five-file cap is unchanged.
Pricing and commercial matches remain hard pauses under the separate hard_stop_content_sensitivity category.
The versioning guide documents the staged release pipeline end to end.

Fixed

Undeclared runtime side effects now produce declaration_error at the threshold checkpoint instead of silently completing outside the profile.
doctor --memory forwards bounded network timeouts to remote Git fetches; the MCP stdio coordinator converts unexpected request exceptions into structured -32603 responses; message validation accepts the six documented review-loop telemetry fields.

0.3.4 — 2026-06-11

Fixed

Receiver-autonomy Gate 1 now enforces message integrity for real — schema validation, expiry comparison, raw-YAML SHA-256 recording, and same-receiver replay detection all run before a message can auto-accept, closing the gap where the gate reported these checks without performing them. See Receiver Autonomy.
Gate 3 sensitive-scope hardening — the hard-stop classifier now pauses on credentials, pricing, commercial content, and anchored config-sensitive scope, and evaluates external side-effect hard stops before sensitive-scope hard stops to match the protocol ordering.

0.3.3 — 2026-06-11

Added

oacp watch --state-id <id> — per-subscriber cursor files let concurrent watchers of the same agent inbox each receive every NEW_MESSAGE event without sharing (and swallowing) a single cursor. See oacp watch.

Changed

Docs — refreshed the runtime capability matrix and prompt-caching guidance for current runtime releases.

Fixed

--oacp-dir tilde expansion — oacp send --oacp-dir and oacp inbox --oacp-dir now expand ~ through the shared OACP home resolver instead of treating it as a literal path component.
Atomic inbox/outbox writes — delivery now uses same-directory temp files plus atomic replace, so readers never observe a partial .yaml message.
Memory archive tests isolate git config while preserving test identities, so local commit-signing settings no longer break the suite.

0.3.2 — 2026-05-26

Added

Receiver-autonomy scope envelope — the auto_review evaluator now normalizes each task_profile into a scope envelope with first-class side-effect booleans (creates_or_updates_pr, comments_on_github, commits_changes, sends_oacp_reply_only), a post-acceptance threshold checkpoint that records actuals and self-pauses on drift, and a pinned terminal-state taxonomy. See Receiver Autonomy.
Default-off continuation grants — a receiver may honor an explicit same-thread approved_thread_continuation grant that stays inside its declared scope, but only when autonomy.continuation_grants.enabled: true. Disabled by default; grants never override destructive, auth/secrets, dependency, public-scope, pricing, or memory-SSOT hard stops.
First-class cursor runtime — agent profiles, agent cards, status validation, sender inference via OACP_RUNTIME=cursor, oacp add-agent --runtime cursor, and oacp setup cursor. oacp setup cursor --project <project> provisions the project-side Cursor agent directory and writes a repo-local .cursor/rules/oacp.todo.mdc placeholder; Cursor-owned rules and memory hooks remain deferred.

Changed

oacp init now defaults to claude,codex,cursor — Gemini remains fully supported through oacp init --agents … and oacp setup gemini.
Autonomy docs and templates now ship the current agents/<receiver>/config.yaml schema, including the continuation_grants block.
Docs — added an asynchronous claude -p on-ramp guide and refreshed the quickstart for the current CLI surface.

0.3.1 — 2026-05-12

Added

auto_review autonomy mode — an opt-in receiver-side autonomy profile that lets an agent auto-accept inbound messages only when they clear a deterministic four-gate evaluator, pausing on anything uncertain and hard-stopping on destructive or sensitive scope. Enable it per receiver with autonomy.default_mode: auto_review in agents/<receiver>/config.yaml, bounded by auto_review_thresholds (estimated time, files touched, risk flags). Off by default — existing receivers keep always_pause behavior unless they opt in. Ships with a conformance fixture suite under tests/conformance/autonomy/ covering clean tasks, ambiguous scope, hard-stop triggers, and malformed config. See Receiver Autonomy.

Changed

Docs — the README and onboarding pages now link the companion oacp-skills library so readers can find the skill set that pairs with the protocol.

0.3.0 — 2026-04-29

Added

oacp memory init|clone|pull|push|disable — opt-in cross-machine sync for OACP memory via a plain git repository rooted at $OACP_HOME. Tracks $OACP_HOME/org-memory/** and $OACP_HOME/projects/*/memory/**; ignores everything else by default. Three-state activation model — Disabled (no marker), Local-only (init without --remote), Synced (init --remote <URL> or clone <URL>). See Shared Memory protocol for the full design and CLI Reference for flags.
oacp doctor --memory — advisory checks for the memory git repo: marker presence, allowlist coverage, tracked/untracked leakage, clean/ahead/behind/diverged state, remote reachability, commit staleness, agents/ leakage, and per-project memory overlay safety. See CLI Reference.
Claude memory lifecycle hooks — oacp setup claude now installs oacp-memory-pull.sh and oacp-memory-push.sh and registers them under SessionStart and SessionEnd in .claude/settings.json. Hooks are marker-gated and no-op silently when memory sync is not enabled, so existing workflows are unaffected on machines that have not opted in. See CLI Reference.

0.2.3 — 2026-04-26

Changed

oacp watch defaults are now notification-friendly — existing inbox messages are no longer replayed on first run for a target, and message_archived events are suppressed by default. Pass --since=epoch to restore replay and --show-archived to re-enable archive events. Reduces noise for Monitor and oacp watch consumers.

Added

oacp watch --since=<spec> — controls the first-run baseline cutoff. Accepts now (default), epoch, relative durations (30s, 5m, 2h, 7d), or ISO 8601 timestamps. Only applies on first run for a target (no state file yet).
oacp watch --show-archived — opt-in flag to emit message_archived events. Useful for observer agents tracking another agent’s inbox; disabled by default because the watching agent’s own deletes are self-loops.

0.2.2 — 2026-04-17

Added

oacp watch — monitor-friendly inbox/outbox watcher with structured stdout (NEW_MESSAGE / message_archived lines or --json) and partial-progress preservation on errors. Designed for Claude Monitor, shell loops, or any process that re-runs the command. See CLI Reference.

Changed

Docs: refreshed cross-runtime capability matrix and public-skill parity framing.

0.2.1 — 2026-03-22

Fixed

oacp doctor no longer fails when gh CLI is not installed — gh is now optional.
oacp send relaxed handoff body schema validation to accept freeform content.
oacp write-event --related now handles JSON arrays correctly.

Changed

README: refreshed command table with all v0.2.0 CLI commands; updated workspace layout diagram.
SPEC.md: synced with v0.2.0 — version header, org-memory section, kernel inventory with exposure column.
Onboarding docs: setup uses pip install as primary install; quickstart adds --agents / --repo flags; memory archive command name fixed.

0.2.0 — 2026-03-20

Added

oacp inbox command — list pending inbox messages for one agent (--agent) or all agents (--all) with table or --json output. See CLI Reference.
Sender inference for oacp send — --from is now optional. When omitted, the sender is resolved from OACP_AGENT, AGENT_NAME, or agent card runtime match. See CLI Reference.

Changed

Consolidated shared script constants into _oacp_constants.py — canonical AGENT_RE, runtime tuples, timestamp and template helpers.
Agent name validation now requires an alphanumeric first character. Names starting with _, ., or - are rejected.
Message ID and filename suffixes use secrets.token_hex instead of random.choices for better randomness.

0.1.9 — 2026-03-20

Added

Memory archive layer — oacp memory archive and oacp memory restore commands for active/archive split. Non-standard memory files can be moved to memory/archive/ and restored later. See CLI Reference.
Declarative agent profiles — oacp agent init|show|list CLI commands with two-tier profile system (global profiles + project-level card overrides). See CLI Reference.
known_debt.md — standard memory file for tracking verified, unresolved project debt. Created automatically by oacp init.

0.1.2 — 2026-03-18

Added

oacp add-agent — add an agent to an existing project workspace without re-initializing. See CLI Reference.
oacp setup — generate runtime-specific config files (CLAUDE.md, AGENTS.md) in a repo. See CLI Reference.
Org-level memory — oacp org-memory init and oacp write-event for cross-project knowledge sharing. See CLI Reference.
oacp doctor --fix — auto-fix missing inbox directories and regenerate missing or stale status files.
ACP (Agent Client Protocol) added to protocol comparison documentation.

0.1.1 — 2026-03-16

Added

Quickstart example and protocol comparison table.
PyPI, runtime, and PRs Welcome badges to README.

Changed

Version bump for post-release maintenance.

0.1.0 — 2026-03-15

Added

Initial public release of oacp-cli on PyPI.
Core CLI commands: oacp init, oacp send, oacp doctor, oacp validate.
File-based inbox/outbox messaging protocol with 12 message types.
Project workspace initialization with agent directories, shared memory, and packet storage.
Message validation against OACP schema.
Doctor command for environment and workspace health checks.
GitHub Actions release pipeline with PyPI Trusted Publishing.
Protocol specs: inbox/outbox, multi-agent shared workspace, credential scoping, cross-runtime sync.
Templates for review packets, agent roles, and guardrails.
Shell and Python kernel scripts for workspace operations.
Apache 2.0 license, CONTRIBUTING guide, community health files.

Changed

Renamed $AGENT_HUB to $OACP_HOME across codebase.
Removed legacy Antigravity workflow/policy system.