Skip to content

Documentation for v0.36.0

Changelog

Every release, newest first.

[Unreleased]

[0.36.0] — 2026-10-28

Changed

  • Refresh the shipped catalog to Intelligence Index v5.0 with explicit metric version and exact AA slugs. The 8/20-point band rule remains; values are not comparable with v4.
  • Sonnet routine review uses high effort. Add optional Terra/high and Terra/max builder profiles and a read-only Opus/max judgement profile. Preserve the existing Fable identity and personal router choices.

Fixed

  • Installing the reintroduced Terra builder profiles no longer removes them as legacy files; uninstall also covers all new profile names.
  • Missing scores and unmeasured efforts no longer inherit a model’s best measured band; legacy or incompatible local catalogs cannot override current v5 evidence.
  • Refresh selects the highest measured score rather than the highest effort, preserves official price provenance, and keeps legacy coding/math results separate from v5.

[0.35.1] — 2026-10-27

  • Add GPT-6.1 Terra to the catalog with verified prices and per-effort Artificial Analysis results. Shipped profiles stay unchanged; Terra can be selected in a personal Codex profile.
  • Reject unsupported Terra Codex efforts none and minimal during configuration validation. Verify Terra forwarding with a fake native executable.

[0.35.0] — 2026-10-25

Retired models leave the kit, each for its same-line successor. Owner decision (2026-10-25): a model retired by its provider is retired in every repo that uses it. Generated by controller-models from its registry, with the code paths patched by hand. The terra-* profiles are renamed, so the release is a minor one.

Changed

  • Presets move off retired models:

    • luna-clerk → gpt-6-luna;
    • terra-builder, terra-reviewer → gpt-6.1-sol, renamed sol-builder and sol-reviewer (owner decision);
    • sonnet-clerk, sonnet-scout, sonnet-reviewer → claude-sonnet-5-5;
    • fable-judge, fable-policy-annotator → claude-fable-5-1;
    • grok-build → grok-4.7.

    Efforts are unchanged. The Codex profiles and agents follow, and so does the lead model in codex/config.snippet.toml. The Claude Code agents keep the sonnet alias, which resolves to Sonnet 5.5.

  • Catalog:

    • 13 retired rows are removed and 9 rows are added: deepseek-v4-pro, gemini-4-argon, glm-5.3, gpt-6-luna, mistral-large-4, mistral-medium-3.5, mistral-small-2603, muse-spark-1.3-contributor and qwen3.8-flash.
    • Claude models carry their 1M context.
    • Every price cites its official pricing page, re-checked on 2026-10-25; no figure changed.
    • Mistral Medium 3.5 is placed in small (index 14.2), from its Artificial Analysis row.
    • muse-wonder-full-1.0 loses its price, because Meta publishes no API price for it.

  • delegation-grok runs grok-4.7 by default and reads its usage under grok-4.7-build. doctor.sh checks for the same model.

  • The installer removes the old terra-* Codex profiles it wrote, unless you edited them. uninstall.sh removes both names. A personal configuration keeps its terra-* profiles until you rename them; see docs/user-configuration.md.

  • delegation-kimi refuses K3. A personal configuration that still names kimi-k3 must move to kimi-k3.1-pro; see docs/user-configuration.md.

Fixed

  • openai-compatible sends max_completion_tokens to Meta’s Model API, where max_tokens is a deprecated alias. Other endpoints still get max_tokens.

[0.34.1] — 2026-10-24

The repository moved from matteoscurati/delegation-kit to reasance/delegation-kit. No routing decision changes, so the release is a patch.

Changed

  • The npm wrapper clones https://github.com/reasance/delegation-kit, at the tag of its own version, as before. Earlier versions clone the old URL, which GitHub redirects.
  • package.json, .claude-plugin/plugin.json and .claude-plugin/marketplace.json link the new repository as homepage, repository and issue tracker. The author fields still name the author.
  • Catalog refreshed on 2026-10-24: no model, score or tier changed.

[0.34.0] — 2026-10-24

Meta’s Muse models join the preset, on the Muse Code subscription through a new runner or on the Meta Model API, and openai-compatible learns effort. A new runner, adapter and profiles, so the release is a minor one.

Added

  • delegation-muse and the muse-code-cli adapter: Muse Code on the subscription you signed in to with muse login. Owner decision: the preset gains muse-code-wonder-full (muse-wonder-full-1.0, Power and Maximum plans only), muse-code-wonder (muse-wonder-1.0) and muse-code-spark (muse-spark-1.3), roles clerk, scout, reviewer, policy-annotation (read-only) and builder, frontend-builder (worktree edits), at max effort with contributor_mode off. The runner calls the release binary the muse launcher selected, never the self-updating launcher, from an isolated home with minimal settings, a copy of auth.json and a link to the login keychain that holds the token; no user or project rules, skills, hooks, MCP servers or memory load. The shell is off in every role, as are web tools, reminders, questions and approvals, and writes in the read-only roles. sandbox-exec lets only the Muse binary execute, keeps the ambient home unreadable but for the keychain, and limits writes to scratch, the keychain and, for builders, the worktree. META_API_KEY never reaches the CLI, which would otherwise bill the run per token, and a sign-in made with an API key is refused. A kit lock serializes Muse runs; a refreshed auth.json is synced back unless the ambient one changed. The receipt carries the provider-reported model, billing: subscription, whether the plan’s allowance came back, the contributor mode and the token counts. doctor.sh checks the contract and --ping-muse pings Muse Spark 1.3. A new muse-executor skill gates it like the others.
  • contributor_mode (muse-code-cli only, on or off): whether Meta may train on what the run sends, passed on every run so the setting saved in Muse Code never applies.
  • muse-wonder-1.0 and muse-spark-1.3 on the Meta Model API: openai-compatible profiles on https://api.meta.ai/v1 with the key in META_API_KEY, at max effort, for when you would rather pay per token. Meta’s Contributor-mode API variants are not in the preset.
  • Catalog: Muse Spark 1.3 at 48.1 (mid, $1.25/$4.25; 45.1 at xhigh) and Muse Wonder at 52.4 (frontier, $4/$20, matched by name). Spark scores above Qwen3.8 Max (45.4) for less; Wonder costs what Opus 5.5 costs for a lower score, so a pool that holds Opus or Kimi K3.1 Pro does not pick it. Muse Wonder Full scores 55.8 (frontier, matched by name); the board prices it at $0 because it has no API, so the catalog gives it Muse Wonder’s $4/$20 by hand, kept across refreshes, rather than letting the router treat it as free. Subscription runs are ranked at those API prices too.
  • effort on openai-compatible: minimal … max, sent as reasoning_effort by the runner and by the router only when the profile declares it. A profile without it sends exactly what it sent before, and through the router the caller’s own reasoning_effort still passes. The router’s policy adjusts no effort on this adapter.

Known limits

  • Muse Code’s telemetry follows its own defaults, and its bundled skills load.

Upgrading

  • A configuration made earlier gets none of the Muse profiles: copy the ones you want from config/presets.json (Upgrading in the configuration page).

[0.33.0] — 2026-10-23

MiniMax-M3.1-Flash becomes a shipped profile. A new profile in the preset gives fresh configurations a new choice in every text lane, so the release is a minor one.

Added

  • The minimax-m3.1-flash profile. Owner decision: config/presets.json gains the profile the configuration page already used as its example — adapter openai-compatible, model MiniMax-M3.1-Flash, family minimax, the seven text roles, base_url https://api.minimax.io/v1, credential_env MINIMAX_API_KEY, context 1,000,000. The catalog already places it (mid, 42.7, $0.15/$0.60). Without the key, delegation-router check reports it unreachable (no MINIMAX_API_KEY) and a dispatch is refused; nothing else is affected. .env.example lists the variable beside the other provider keys.

Upgrading

  • A configuration made earlier does not get the profile: copy it from config/presets.json (Upgrading in the configuration page).

[0.32.0] — 2026-10-23

The Kimi profile runs Kimi K3.1 Pro. The model is new to the frontier band, so routing decisions change and the release is a minor one.

Changed

  • The Kimi profile is kimi-k3.1-pro. Owner decision: the kimi-k3 preset in config/presets.json is replaced by kimi-k3.1-pro (model kimi-k3.1-pro, same adapter, roles and max effort), and delegation-kimi runs kimi-code/k3.1-pro when no model is requested. Kimi Code serves K3.1 Pro to the same OAuth login. Artificial Analysis measures it at 55.1 (K3: 43.6), which places it in the frontier band at $2/$10 per million tokens: in a pool it now takes the frontier minimum from Opus 5.5 ($4/$20), and the 2.5 example in the README goes to Kimi as well. doctor.sh checks the new default.
  • delegation-kimi names the models it runs. K3.1 Pro and K3; the provider must attest the requested one (the probe accepted only k3), and any other Kimi Code model fails it with not a supported Kimi Code model. check reports the kit’s name for the requested model instead of a fixed kimi-k3. A personal configuration with a kimi-k3 profile keeps running K3; Upgrading in the configuration page says what to change.
  • Catalog: kimi-k3.1-pro added and placed by the refresh (55.1, frontier); kimi-k3 stays for configurations that name it.

Fixed

  • The router page’s pool example gave GPT-6 Astra 52.7; at the high effort its profiles run, the catalog places it at 50.9.

[0.31.0] — 2026-10-23

The router keeps an agent loop on one model, ends a native dispatch with the request that started it, and reads its deciders more strictly. Routing decisions change (the excerpt, out-of-schema answers), so the release is a minor one.

Added

  • X-Router-Conversation keeps a conversation on its first route. An agent loop sends one request per step, and every step was decided on its own: a step with tools needs the mid band, and past 20,000 estimated tokens long asks for the frontier, so the model changed halfway through the task and the provider’s prompt cache went with it. With the header, the first auto request is decided and pins the conversation to the profile it dispatched; every later one goes there without a decider call, as if the client had named it (mode pinned, X-Router-Pin: held, router.pin). A request the pinned profile cannot take is refused with pinned naming it, never sent elsewhere. Pins live in memory only (1,024 conversations, 12 hours idle); the id is never echoed or written to receipts. Without the header nothing changes. A malformed id is 400 invalid-conversation.
  • eval --output writes decisions.jsonl: one line per prompt and paraphrase with the profile chosen, the signals, the reasons and the decider’s own answer, never the prompt. The report gave only aggregates, so a decision that fell to the default could not be traced to the signal that sent it there.

Changed

  • The excerpt drops the blocks coding harnesses add to a user turn before trimming it to 2,048 characters, and the arithmetic check ignores them: a date in a session block no longer kept a Jev decision at the mid band. The list was checked against each harness’s source: <system-reminder> (OpenCode; Claude Code through translators such as claude-code-router), <environment_context> (Codex), <environment_details> (Roo Code). A user turn that is only such blocks is passed over for the one before it. input: full still sends everything as it is.

  • The GLM runner sets no spending cap unless asked. It passed Claude Code --max-budget-usd 2.00 on every run, but Claude Code counts that amount at its Opus list (GLM runs under the opus alias), many times GLM’s price, so a GLM run stopped far below $2 of GLM. --max-cost-usd still sets one, validated as a positive amount, and its help says the amount is Claude Code’s count, not GLM dollars.

Fixed

  • An out-of-schema answer from a decision service is undecidable, as the router page said. A probability or confidence that is not a finite number in [0, 1], a difficulty outside its scale, or a distribution that does not sum to 1 was read as it came (NaN included, which Python’s JSON parser accepts); it now voids the answer, with a warning naming the value. A classifier’s difficulty or p_needs_strong outside 0..1 is no longer clamped into range: it is undecidable too.

  • A native dispatch outlived the request. A client that gave up, or a serve that stopped, left the dispatcher running: a GLM run went on for more than 30 minutes after both were gone, and the runner ignored SIGTERM while its Claude Code child worked. The dispatcher now runs in its own process group; when the client hangs up or serve stops, the group gets SIGTERM and, 10 s later, SIGKILL.

  • GLM through Claude Code (claude-zai) was priced at Opus rates. The runner reported Claude Code’s own cost as the provider’s, but Claude Code runs GLM under the opus alias and prices it at its Opus list: a one-line question was disclosed at $0.022 where GLM’s price comes to $0.0006. The runner reports no provider cost now, and the router prices GLM’s token counts at the profile’s rate.

Documentation

  • The router page recommends pinning the Jev version an eval measured instead of jev-latest (Jev answered as 1.13.0 on 2026-10-15 and as 1.14.0 a week later), and says what Jev’s confidence measures. Sage’s band mass was tried in its place and kept out: replayed on 20 recorded answers it changed no answer and sent two more requests to the default.

[0.30.4] — 2026-10-21

Housekeeping.

Fixed

  • The installer leaves nothing a release no longer ships. It copied the library and the skills over the previous install and never removed what was gone, so modules from earlier releases (delegation_router.py, delegation_router_catalog.py) and their bytecode stayed beside the current ones. Library files the checkout does not ship are now removed, the library bytecode is cleared, and each kit skill directory is replaced whole. A regression test seeds a retired module, its bytecode and a retired skill file and checks the install removes them.
  • Stale names and concepts. fable-judge paired itself with sol-judge, which became astra-judge; the dual-judgement reference said Sol, and one of its sentences was garbled. The GLM and Grok executor skills listed Kimi’s roles and pointed at evaluation options that no longer exist; each now names its own roles. doctor said reviewers must be cross-family where the review policy is configurable, that a missing executor skill blocks selection “even after evaluation”, and called the orchestrate skill a fan-out loop. The installer called a keyless DeepSeek “provisional”, the Qwen runner pointed at re-pin instructions the docs no longer have, and two errors said a decider kind is “not available in this release” where it is unknown.

Changed

  • The orchestrate skill links its two references, and the empty worker-brief.md is gone. The Sonnet agents no longer say “Sonnet-5”: their model: sonnet follows the current Sonnet.
  • README: the “Current release” section describes this release only; the history is in this file.

[0.30.3] — 2026-10-21

Shorter documentation, corrected against the code.

Changed

  • The router, configuration, executors and compatibility pages were rewritten to be shorter and easier to scan. Each fact now has one page that owns it and the others link there; long paragraphs became tables (the reasons a profile is set aside, the rating-to-minimum map, timeouts per adapter, the patch policy); history moved out of the pages and into this file. The compatibility page keeps the current snapshot and lists earlier releases briefly. The headings other pages link to (Keys and environment, Adding a model, Deciders) are unchanged.
  • Shipped catalog refreshed on 2026-10-21: no placement or price changed.

Fixed

  • Documentation that had drifted from the code. The router intro and the README described the pre-0.28 rule (the cheapest model “on the tier”); with floor-v1 it is the cheapest profile at or above the minimum score. Under max_cost_usd the strongest eligible profile answers, not the default. The decider-skip rule now matches the code: nothing eligible, only the default, or, with a priced decider, nothing scoring above the default and a saving under ten times the decision’s cost. An unpriced profile ranks last overall, not within its tier. long is over 20,000 estimated tokens. claude-zai runs GLM, not Claude.
  • Executors and configuration. The ten-second grace after a timeout applies only to Kimi, Grok and GLM, which also need timeout or gtimeout on PATH when a timeout is set (macOS has neither by default); openai-compatible sends no effort; a native pool profile whose provider names another model fails 502 provider-identity-mismatch instead of being disclosed; the codex and claude-code adapters have rows; exit 65 and the patch verifier’s own exit codes are listed. The router’s error table lists every code it returns.
  • delegation-router check said an unpriced profile is “ranked last within its tier”; it says “ranked last”.

[0.30.2] — 2026-10-20

What a review of 0.30.1 found.

Fixed

  • doctor.sh with a missing or invalid configuration stopped the personal-configuration section on config_file: unbound variable and then reported a keys file at /.env. It now looks for the .env beside the path the commands read, whether or not the configuration validated.
  • check on an unreachable default said the router sets it aside. The default is never set aside, since doubt lands on it: check now says that a request landing on it is refused as no-usable-candidate.
  • delegation-router check --help said “no network”; it says “no model call”, since a runner’s own check may reach its service.
  • Documentation. 0.30.1 said that an undecidable request landing on a keyless default meets 401 provider-key-missing; it meets 400 no-usable-candidate, with unreachable: <why> as the reason, and the router page’s error table and routing steps say so. The README no longer claims every login is checked (a Codex or Claude Code login is not, only the CLI on PATH) and names the default as the exception; the check comment no longer promises prices outside --json; the external executors page says which runners read a key (GLM, Qwen, DeepSeek, and openai-compatible through credential_env) and which use their CLI’s login (Kimi, Grok, Gemini); the router page says an llm decider uses its profile’s key, kit key file included; the MiniMax walkthrough adds the profile to router.pool before check --json reports it and gives the full delegation-run command. The compatibility page leads with this release’s numbers and labels the earlier ones by release.

Changed

  • Shipped catalog refreshed on 2026-10-20 (0.30.0 and 0.30.1 were tagged without the refresh the release rules ask for): MiniMax-M3.1-Flash 42.4 → 42.7, still mid; every other placement and price unchanged.

[0.30.1] — 2026-10-20

Documentation only: the pages catch up with 0.28.0–0.30.0.

Changed

  • README: the Quick start says where keys go (the installer’s three, then ~/.config/delegation-kit/.env for any other) and that the real file is never committed; How the choice is made checks your models before the decision; check reports scores and reachability; decide --lane is named; the client paragraph says Claude Code and Codex cannot send requests to the router but can be picked by it; doctor reports the .env.
  • Router page: the same client note; a decider’s key and the Artificial Analysis key can live in the personal .env; provider-key-missing is what a named profile or an undecidable default meets, an auto request having set unreachable profiles aside.
  • Configuration guide: the router section names the profile score, reachability and decide --lane; Adding a model puts the key in the .env and walks through a complete MiniMax-M3.1-Flash profile, down to the receipt that confirms it.
  • External executors: where a runner reads its key.
  • The installed guard (Claude Code and Codex): decide --lane <role> for a task the user wants delegated, still discovery that grants nothing.

[0.30.0] — 2026-10-20

Keys can live in one .env beside the configuration.

Added

  • The personal .env. ${XDG_CONFIG_HOME:-$HOME/.config}/delegation-kit/.env (beside $DELEGATION_CONFIG_FILE when that is set) holds NAME=value lines that fill the variables your environment does not set: a profile’s credential_env, DEEPSEEK_API_KEY, QWEN_TOKEN_PLAN_API_KEY, ZAI_API_KEY, the deciders’ SAGE_API_KEY and TYPESAFE_API_KEY, AA_API_KEY. delegation-run, delegation-router and every runner read it; lines are parsed, never sourced; a variable already set wins; the file is ignored when it is a symlink or readable by group or others. Until now a key for an openai-compatible profile could only come from the environment. The installer copies the new .env.example there once, mode 600, every value empty, and never overwrites it; doctor reports its mode and how many variables it sets, never a value. The kit’s key files under the data home keep working, after the environment and the .env.
  • .env.example in the repository lists every variable the kit reads, with no values; .gitignore excepts it and still keeps out every other .env*.

[0.29.1] — 2026-10-19

Changed

  • MiniMax-M3.1-Flash replaces MiniMax-M3 in the catalog (owner decision). Released on 2026-10-19, it scores 42.4 on the Artificial Analysis Intelligence Index, which places it mid, at $0.15/$0.60 per million tokens, against MiniMax-M3’s 29.2 (small) at $0.30/$1.20. Its context and JSON mode are not published on the board, so the row leaves them unknown instead of carrying M3’s over; the router then applies no context or JSON-mode rule to it. The shipped catalog was refreshed from the board on 2026-10-19: every other placement and price is as on 2026-10-17.

[0.29.0] — 2026-10-19

A model you cannot reach is set aside before the decision, not chosen and failed.

Changed

  • Unreachable pool profiles are set aside. Before the decision, every pool profile is checked without a model call: an HTTP profile needs its key (the named variable or the kit’s key file), a native runner’s check --json must select a backend, codex and claude must be on PATH, and a profile that names credential_env needs that variable, as delegation-run does. A profile that fails is left out like a context too small and listed under blocked as unreachable: <why>, so the cheapest profile you can actually use answers. Before, the policy could pick a model whose key or login was missing and the request failed, with no fallback. serve checks once when it starts and names what it set aside in its start line; decide checks every time (the native runners’ checks run in parallel, about 3 s at worst); a login that lapses later still fails at dispatch, with its own error. A profile named as model is never set aside: it fails as before.
  • check and doctor say what this machine can reach. Each pool entry carries reachable, and an unreachable profile, or an unreachable llm decider, is a warning. decide --lane says “no reachable pool profile takes the role” when the only candidates are unreachable, and names the reason when the decision lands on an unreachable default.

[0.28.0] — 2026-10-19

The rating becomes a minimum score; the cheapest model that reaches it answers.

Changed

  • Policy floor-v1 replaces tiered-v1. The decider’s rating becomes a minimum score on the Artificial Analysis Intelligence Index: up to 1 of 4, none; at 2, the bottom of the mid band (37.6 on the 2026-10-17 catalog); from 3, the bottom of the frontier band (49.6); in between, in proportion (2.5 → 43.6). math, rare and tools raise it to the mid band, long to the frontier band; code still narrows to code-capable profiles. Every eligible profile at or above the minimum is a candidate, whatever its tier, and the cheapest wins; when none reaches it, the strongest eligible profile answers and says so (it used to fall to the default). Under tiered-v1 the rating picked one tier and the cheapest profile on it won, so GPT-5.6 Luna (small, 37.3) answered an easy request ahead of a cheaper GLM 5.3 Flash (mid, 41.8), and a stronger mid model such as Kimi K3 never answered while a cheaper mid one was eligible. Each profile now carries a score (the index at its reasoning setting, or the bottom of its band when placed by hand); check prints it, and decide and every response disclose minimum_score and the chosen profile’s score.
  • The LLM decider rates in half points (0, 0.5 … 4), so a request between two levels gets a minimum between them. An answer off that grid, or not a number, is outside the schema and lands on the default. Checked live with DeepSeek Flash: it uses the half points (2.5, 3.5), about 1 s and $0.00014 a decision.

Added

  • delegation-router decide --lane ROLE: the decider’s recommendation for a task you are about to delegate. Only the pool profiles that take the role, by the same check delegation-run makes, are candidates; the rest are listed under blocked; the recommendation names the profile’s capabilities on that role. A decision that would land on a default without the role recommends nothing, and says so. The model-routing skill asks Claude Code and Codex to pass the lane.

[0.27.2] — 2026-10-19

Changed

  • The Opus profiles run Claude Opus 5.5. Owner decision: opus-builder, opus-reviewer and opus-policy-annotator in config/presets.json, and the opus-builder and opus-reviewer Claude Code agents, move from claude-opus-5 to claude-opus-5-5 at the same efforts. Opus 5.5 is the best model on the Artificial Analysis board (57.6, frontier) and costs less per token than Opus 5 ($4/$20 against $5/$25 per million). doctor.sh checks the new pin. A personal configuration keeps the model it has; Upgrading in the configuration page says what to change.
  • The docs use the words the responses use. tier instead of rung and ladder (the X-Router-Tier header, the tier field), “decider” instead of “decision model”, “the profiles it may pick from” instead of “the pool it governs”. The README opens with what the router does.

Fixed

  • What leaves your machine. The README and the router page said nothing leaves the machine except the request to the chosen model. The decider also gets an excerpt of each request (the whole request with input: full) unless it runs on your machine; both pages now say so.
  • The README’s routing example. It said that adding GPT-5.6 Luna would send the rename to Luna, which tiered-v1 does not do when a cheaper code-capable model sits higher (GLM 5.3 Flash). The example now uses three models from the default install, one per tier (luna-clerk, deepseek-flash, opus-reviewer), each row checked against the policy’s choose(), and the Quick start pool spans the three tiers instead of three mid models.
  • install.sh warns when its bin directory is not on PATH. macOS does not put ~/.local/bin there, and the first command then failed with “command not found”; the installer prints the line to add.
  • The tagline “Your models. Your call. Your rules.” is gone from the README and the router page.

[0.27.1] — 2026-10-17

Fixed

  • npx delegation-kit installs its own release. Without --ref the wrapper cloned the default branch, so npx delegation-kit@0.27.0 would have installed whatever main held on the day it ran. It now clones the delegation-kit--v<version> tag of the package’s own package.json and refuses, naming the ref, when that tag is missing; --ref still picks another ref, and --ref or --repo without a value is refused.

[0.27.0] — 2026-10-17

You choose the decision model; it governs the models you already pay for.

Added

  • delegation-router, a local model router. A router block in the personal configuration names the decision model (decider, required) and the profiles it governs (pool, default, on any adapter). check resolves it without network; decide --prompt-file recommends one profile and never dispatches it (--raw shows the decider’s own answer); serve is an OpenAI-compatible /v1/chat/completions on loopback only. A "model": "auto" request goes through a deterministic prefilter (rung, context, cost ceiling, JSON mode, native limits), the decider and the tiered-v1 policy — the lowest rung the answer allows, code narrowing, math/rare/tools lifting to mid, the cheapest eligible profile in the rung, escalation never descent, a 0.55 confidence floor — then one forward with the chosen profile’s own key, streaming passed through. A pool profile named directly skips the decider. mode: shadow decides and discloses but dispatches the default.
  • Five deciders, all asking the same question — how much capability, which specialties — and reporting the same signals: llm (one of your HTTP profiles, temperature 0, the excerpt in a DATA block, 120 tokens of room; DeepSeek with thinking disabled, Qwen at minimal), sage (Levanto, scale + tags), jev (TypeSafe System One, score + nouls; arithmetic-looking numbers never below mid), dipylon (your own /decide, one yesno), classifier (a local POST {"text"}), and none as the rules-only baseline. Each is called with its own credential and prices its decision; url, credential_env, model and price override the defaults. Sage, Jev and llm through DeepSeek and Qwen were probed live before the release (see the compatibility page).
  • Native profiles in the pool through delegation-run: the conversation becomes a prompt file, the dispatcher runs the profile on its first read-only role in an empty temporary workdir, and the answer file comes back as one chat completion with the dispatcher’s receipt under router.delegation_run. Timeouts, identity checks, OAuth locks and sandboxes stay with the dispatcher; its exit codes are mapped. No tools, images or JSON mode on a native profile; a stream is one event. This is how Claude models join a pool.
  • The ladder comes from a third party. config/catalog.json places every model it can from the Artificial Analysis Intelligence Index with one published rule, index-bands-v1 (frontier within 8 points of the best model of the day, mid within 20, small below), and records the evidence beside each row; a profile’s own tier wins, a profile with effort is placed at that setting’s index, and every decision names its placement (tier_source). catalog show prints the source of every rung; catalog refresh makes one request to the API with the user’s key (AA_API_KEY, or config/artificial-analysis.env under the data home, mode 600) and writes catalog.local.json, which takes precedence while it is at least as recent; --shipped refreshes the shipped file before a release. The shipped snapshot of 2026-10-15 placed 24 of 25 models from the API and corrected four hand placements (GPT-5.6 Sol and GPT-5.5 are mid, GLM 5.2 and Mistral Large 3 small). Data attribution: Artificial Analysis.
  • delegation-router eval: an offline measure of one decider on a golden set the user assembled (prompt, paraphrases, recorded outcomes per profile). Reports accuracy, cost, optimal-selection ratio, robustness, undecidable rate, latency, the rules-only baseline, a deferral curve and an advisory gate.json. It calls the decider, never a pool profile.
  • Disclosure and refusals. X-Router-* headers and a router object with signals, reasons (including the candidates of the chosen rung with their estimated cost), blocked profiles, usage, cost and the provider-reported model (mismatch disclosed, not fatal). Refusals that never reach a provider: unknown model, browser Origin outside allow_origins (a listed origin gets CORS), cost ceiling from the configuration or X-Router-Max-Cost-USD, invalid body, missing credential, busy. Provider failures keep their meaning and lose their payload. The server prints one listening line and nothing else. Opt-in receipts (JSONL, mode 600, no prompt content) survive uninstall.sh.
  • delegation-route check reports the router; doctor.sh has a “Model router” section that opens with the decider and names the catalog in effect; the installer links delegation-router and ships the catalog and the decider prompt. The router suite, tests/router/, runs 64 tests against fake providers and services; CI runs ruff beside shellcheck.

Changed

  • One idea, up front. The README opens with the decision model and how the choice is made, with a worked table on the measured ladder; the explicit delegation commands, agents, Codex profiles and skills are described as the machinery the router dispatches through. Plugin, marketplace and npm descriptions say the same.
  • One configuration schema. delegation-config init writes schema_version: 2; a file that still says 1 is read identically, and the routing fields (tier, code, price, context, json_mode) are accepted on either.
  • doctor.sh names executor sections by adapter rather than by a model the presets may change; uninstall.sh reports what it removes in current terms; run-tests.sh prints each suite’s time as it finishes. The router and the test fakes bind without the reverse-DNS lookup http.server does, which had stalled the macOS CI job past its limit.
  • bin/lib has one module per domain: configuration, credentials, catalog, router policy, pipeline, deciders, bridge, server, eval.

Removed

  • The pre-0.24 migration (routing-gates.json import, retired-file sweep, retired-profile checks): an install older than 0.25 goes through 0.26 first.
  • model-routing.md and ADAPTING.md (folded into the configuration page); the historical snapshots and matrices of docs/compatibility.md and the “Flags retired” section of the executors page — this changelog and git history keep them.

[0.26.1] — 2026-09-16

Fixed

  • docs/compatibility.md: the 0.26.0 snapshot stated a doctor count of 56; the observed count was 55 OK, 0 WARN, 0 FAIL, because a concurrent user dispatch held the Grok OAuth lock during the pass. Documentation only.

[0.26.0] — 2026-09-16

Changed

  • No dispatch timeout unless the profile sets one. The kit no longer decides how long a delegated task may take: the fixed 900-second limits of delegation-kimi and delegation-grok, the 600-second default request deadline of the chat-completions adapters, and Gemini’s inherited 5-minute agy default are gone (Gemini receives 24h). The profile parameter timeout is now accepted for every adapter and, when set, bounds the whole run everywhere with the same outcome: killed after the deadline plus a ten-second grace, nothing published, diagnostic reason timeout, exit 75. The native codex and claude-code dispatch in delegation-run, which had no deadline at all, honours it too. A 20-second connect timeout on HTTP adapters and the ten-second CLI probes of check remain; neither judges the task.
  • DELEGATION_GROK_TIMEOUT_SECONDS is gone; delegation-grok check reports timeout_seconds as the configured value or null.

Fixed

  • install.sh replaces command files by rename, never in place. Bash reads a script as it executes it; copying a new runner over the inode of one that is mid-dispatch could feed it the new bytes. The installer now writes beside the file and renames, so a running dispatch keeps its own copy until it exits.

Removed

  • --allow-provisional, the no-op kept for one release in 0.25.0. Passing it is now an unknown argument (exit 64) on every runner and on delegation-run.

[0.25.2] — 2026-09-13

Changed

  • The kimi-k3 preset declares only the roles delegation-kimi runs: clerk, scout, builder, frontend-builder, policy-annotation. The senior, judgement, and reviewer roles were inherited from the retired routing gate, where they had never been enabled, and the runner has no read-only implementation for them, so the router listed them as unsupported. Owner decision; the route suite now asserts that every shipped preset row is technically compatible. A personal configuration is not edited by the kit: remove the three roles by hand if a migrated file carries them.

[0.25.1] — 2026-09-11

Fixed

  • install.sh restores a key file the uninstaller backed up. uninstall.sh keeps zai.env, qwen-token-plan.env, and deepseek.env as $DELEGATION_DATA_HOME.<name>.env.bak, but a later install asked for the key again and never looked there, so a key could sit in the backup while the runner reported it missing (the Z.AI key did, from 2026-09-01 to 2026-09-11). The installer now copies a backup into place, mode 600, only when the data directory has no key file; an existing file is never replaced. Covered by the install-marker suite.
  • delegation-grok check reports adapter: "grok-build-cli", the name the presets and delegation-config use, instead of its backend key grok-build; the backend key itself is unchanged.
  • docs/user-configuration.md and ADAPTING.md no longer describe historical evidence or evaluation receipts; the router is described at schema 3.

[0.25.0] — 2026-09-11

The idea behind 0.24.0 was that which model runs is the user’s call, not the kit’s. That release made it true for the user and left the qualification machinery in place as history. This release removes it.

Removed

  • Routing gates. config/routing-gates.json and the six executable config/*-routing.json gates. No runner, router, or preset reads a gate any more; install.sh deletes the installed copies on upgrade.
  • The executor contract, evidence, and Epoch importer. bin/delegation-executor-contract with config/external-executor-contract.json, bin/delegation-evidence with config/model-evidence.json, and bin/delegation-epoch, together with their suites (external-executor-contract.sh, epoch-zip.sh) and the CI step that ran them. uninstall.sh keeps removing the retired commands for one release.
  • The schema compiler. bin/delegation-schema and schema-transport.sh; it served only the evaluation mode below.
  • The runners’ qualification mode. --evaluation, --evaluation-manifest, and --preflight-only are gone from delegation-glm, delegation-kimi, delegation-grok, delegation-gemini, and the shared chat-completions core behind delegation-qwen, delegation-deepseek, and delegation-openai-compatible, with the manifest verification, preflight receipts, attempt receipts, publication commit markers, and the “dirty checkout” refusal. Passing a removed flag is an unknown argument (exit 64). The Grok strict-identity VOID path is gone: a missing content model is tolerated everywhere, a surfaced mismatch still fails closed.
  • The gate-status helpers in bin/lib/delegation-runner-common.sh, the evidence column of delegation-route, compound lanes, and the doctor sections “Model-routing evidence”, “Central routing gates”, and “External executor contract”.
  • docs/external-executors.md shrinks from the contract description to the adapters, permission classes, patch verifier, identity, and exit codes.

Changed

  • config/presets.json is the shipped profile list (22 profiles, Gemini excluded), maintained by hand; delegation-config init copies it. The npm wrapper verifies this file instead of the gates. A legacy routing-gates.json is still imported on first migration and falls back to the preset when it is malformed.
  • Runner check reports {model, adapter, roles, efforts, selected_backend, backends} (plus default_effort for the chat-completions adapters and the native runtime controls); qualified_lanes, provisional_lanes, and candidate_lanes are gone. An unsupported role or effort exits 78 before any credential or runtime inspection.
  • delegation-route reports schema 3: rows carry technical_compatibility, capabilities, and selection only.
  • Doctor gains a “Route discovery” section over the personal configuration, reads adapter roles from each runner, and pings through adapter roles.
  • --allow-provisional stays a deprecated no-op that prints a warning; it is removed in the next minor release.
  • CLAUDE.md replaces “Routing gates” with “Presets and configuration”; evaluation/README.md is marked as an archive; model-routing.md states it governs nothing.

Migration

  • Nothing to do for a 0.24.0 personal configuration: the schema is unchanged. Re-run ./install.sh; it removes the retired files and commands from the data directory. Profiles that name a model the provider no longer serves (for example deepseek-v4-pro) are the user’s to edit in the personal configuration.
  • Scripts that called delegation-executor-contract, delegation-evidence, delegation-epoch, delegation-schema, or a runner’s --evaluation mode have no replacement; the frozen artifacts under evaluation/ remain as a record.

[0.24.0] — 2026-09-10

Added

  • Personal configuration. delegation-config init|validate|show|apply manages ${XDG_CONFIG_HOME:-$HOME/.config}/delegation-kit/config.json (schema 1, DELEGATION_CONFIG_FILE override): profiles carry an adapter, the actual requested model, a declared family, roles, and supported parameters. Credentials are never stored in profiles; credential_env names a variable for the three HTTP adapters. init derives a preset from the historical gates, snapshots a legacy install as migration-v1-backup, and never overwrites an existing file; apply regenerates managed Claude/Codex snippets and preserves edited ones. install.sh runs init and apply and keeps hand-edited host profiles.
  • delegation-run. One dispatcher runs a selected profile once through its adapter and writes output, metrics, and a version 2 .result.json receipt with review_status, requested versus provider-reported identity, and authorization_granted: false. Native codex and claude-code profiles run read-only through the CLIs; provider runners keep their own sandboxes.
  • delegation-openai-compatible. A text-only adapter for any OpenAI- compatible /chat/completions endpoint on the shared chat-completions core: HTTPS required except loopback, one non-streaming request, optional bearer auth, no /models call, no tools, no retry.
  • docs/user-configuration.md and the user-config regression suite (loopback HTTP, isolated configuration, no provider accounts).

Changed

  • Review is optional by default, for new and migrated installs. required accepts any compatible reviewer, cross-family requires two declared, different families. A mandatory policy never authorizes the reviewer call: results stay pending-review until the lead obtains it. init --preset strict selects cross-family.
  • The router reads the personal configuration and reports schema 2: configuration_valid, technical_compatibility, capabilities, and the historical evidence per row; check, lane, profile, resolve, and table stay read-only; a compound lane returns its members and protocol and requires separate member selections.
  • Evidence and gates are advisory. config/routing-gates.json, the executable gates, the executor contract, delegation-evidence, and evaluation/ keep their historical meaning and validation, but no longer grant or block execution; adapters own capabilities, roles, and efforts. --allow-provisional is accepted as a deprecated no-op everywhere.
  • DeepSeek re-pinned to deepseek-flash (DeepSeek V4.1 Flash, released 2026-09-10). DeepSeek routes every deepseek-v4-pro request to V4.1 Flash after 2026-09-14 12:00 Beijing time, which would have failed the runner’s exact identity check on every dispatch. Profile, executable gate (config/deepseek-flash-routing.json, the V4 Pro gate is removed on upgrade), contract family, runner default, doctor, installer, tests, and docs follow. One live exact-identity smoke at max passed on 2026-09-10; the builder lane stays provisional and explicit-only in the historical record.
  • Gemini re-pinned to gemini-3.8-flash on the staged bridge (gate config/gemini-3.8-flash-routing.json, the 3.7 gate is removed on upgrade), every lane still candidate or disabled; Gemini is excluded from the current presets by owner decision and existing personal choices are preserved.
  • Doctor gains a “Personal configuration” section (configuration valid, review policy, managed snippets, the new commands on PATH, the builder lane resolving selectable profiles) and describes the runners by their adapter defaults instead of pinned qualification.
  • Reviewer profiles on both hosts apply the configured review policy instead of hard-coded cross-family exclusion; the resident guards describe the three policies.

Removed

  • The routing-gate drift suite (central gate versus executable gates, producer-family exclusion, fallback). With execution no longer gated by evidence, those checks guarded a decision the kit no longer takes; delegation-executor-contract check and delegation-evidence check still validate the historical records for consistency.

Fixed

  • The Antigravity inventory parser matches exact ids in tab-separated ID/display-name rows.
  • config/deepseek.env is gitignored like the other key files.

[0.23.1] — 2026-09-07

Fixed

  • delegation-grok reported “ready” on a machine where every dispatch failed. Grok Build 1.0.13 denies the container runtime sockets (/var/run/docker.sock, podman, containerd, and the Docker Desktop paths under ~/.docker) in every sandbox profile and resolves each endpoint before applying Seatbelt; when one is a symlink — Docker Desktop’s optional default socket link — a custom profile such as delegation-kit is refused outright (“Refusing to start with its protections missing”), while the capability probe and model inventory still succeed. check now probes those endpoints after resolving the CLI and reports the lane unavailable with the offending path and the remedy; run fails closed at exit 69 before dispatch; and a refusal surfaced by the CLI itself is classified as sandbox_profile_refused (exit 69) instead of a generic dispatch_failed. DELEGATION_GROK_RUNTIME_SOCKET_ENDPOINTS overrides the endpoint list for tests. Found by the first live Grok probe since 2026-08-27, on a machine where the link had appeared on 2026-08-28.
  • install.sh said the compatible Grok Build CLI archive was not retained whenever the runtime was unavailable, even though the archive was in place; the message now depends only on the pinned archive, and runtime availability is doctor’s report.

[0.23.0] — 2026-09-07

Fixed

  • delegation-route table rendered its Fallback column from a field the rows never carried (fallback instead of provider_fallback), so the declared opus-reviewer security fallback to claude-opus-4.8 never appeared. The column now shows the target model and trigger; tests/routing-gates.sh asserts it.
  • README and doctor.sh still named Sol as the Codex reviewer/judge after the 0.22.0 migration to GPT-6 Astra; both now say Astra.
  • fable-judge was pinned to the fable alias while the central gate binds claude-fable-5-1; the agent, doctor.sh, and the suites now pin the exact id, matching opus-builder and opus-reviewer.
  • Removed the unused found_name helper from doctor.sh; .gitignore now covers .hermes/ per-machine agent state.

Changed

  • Shared runner library. bin/lib/delegation-runner-common.sh holds the helpers that were copied into every external runner (die, have, sha256_file, key_file_mode, normalized_destination, lane listing by status, acquire_oauth_lock_wait). All six runners source it after resolving their install root; install.sh copies it to $DATA_HOME/bin/lib and never links it onto PATH. runner_sha256 still hashes the runner file alone — the library is bound by runner_source_commit and the clean-checkout refusal.
  • Shared chat-completions core. bin/lib/delegation-chat-completions.sh is the whole text-only OpenAI-compatible transport; delegation-deepseek and delegation-qwen are now thin wrappers that set their identity and define provider hooks (request body, key validation, usage accounting, the Qwen next-snapshot probe). Both suites pass unchanged.
  • Router. The five near-identical jq blocks that compared the Kimi, Qwen, DeepSeek, Gemini, and Grok executable gates against the central gates are one check_executable_gate function; resolve computes the eligible rows and choices once. JSON output is byte-identical to 0.22.0.
  • docs/compatibility.md verified snapshot refreshed on 2026-09-07 with the numbers observed for this release.

[0.22.0] — 2026-09-06

Changed

  • Codex review/judgement lanes migrate from Sol to GPT-6 Astra (gpt-6-astra, effort high) on the owner decision following OpenAI’s 2026-09-03 launch. New family openai-gpt6 (distinct from gpt-5.6) keeps cross-family review meaningful. astra-reviewer @ high covers material-review and security; astra-judge @ high replaces sol-judge @ max. Super-judgement is now Fable 5.1 + Astra. Verified live on Codex CLI 0.153.4.

Fixed

  • .gitignore now covers config/qwen-token-plan.env (the Qwen Token Plan key file), which was previously unprotected.

[0.21.0] — 2026-09-01

Changed

  • Judgement lane migrates from Fable 5 to Fable 5.1 (claude-fable-5-1, still at max, still manual-qualified explicit-only) on the owner decision following Anthropic’s 2026-09-01 launch. fable-judge and the central gate bind to the exact aa-claude-fable-5-1-max row; Fable 5 evidence is retained as context. Verified live: authenticated Claude Code returned exact PONG and surfaced claude-fable-5-1 at requested max. This owner decision does not convert coding evidence into judgement qualification. Super-judgement (Fable 5.1 + Sol) semantics are unchanged.

[0.20.1] — 2026-09-01

Fixed

  • The npm wrapper consumed --skip-doctor but also forwarded it to install.sh, which refuses unknown arguments and exited 2. The wrapper now consumes the flag; the test asserts install.sh never sees it.

[0.20.0] — 2026-09-01

Added

  • User-directed activation (activation_policy in config/routing-gates.json): every dispatch must be selected or explicitly delegated by the user for the current request. The selection vocabulary is now closed at explicit-only / blocked; default, fallback, and preferred-explicit are removed and all lane-local fallback pointers are gone. PR #56.
  • delegation-route resolve --selected-profile <profile> validates one exact user-selected profile (exit 78 if it is not selectable for the lane) and the resolve output now returns choices / selected / selection_validated with requires_user_direction: true. PR #56.
  • delegation-patch-verify and config/external-patch-policy.json: a read-only, fail-closed trust boundary for text-patch lane output — path confinement, denied-path classes, capability and limit checks, strip level fixed by header grammar, read-only attestation. PR #55.
  • The external-executor contract now covers the patch policy: every text-patch lane declares the policy version and verifier, and check fails on a missing, stale, or drifted declaration. PR #55.
  • npm distribution: npx delegation-kit runs the universal installer without a manual clone (thin wrapper; installed artifacts are unchanged).

Changed

  • Resident policies replaced by a minimal user-direction guard on both hosts (claude/CLAUDE.delegation.md, codex/AGENTS.md): no standing permission to delegate, authorization is per dispatch and never carries to retries, reviews, or additional workers. install.sh registers it; doctor.sh verifies it on both hosts. PR #56.
  • All eight skills are explicitly user-triggered; orchestrate no longer mandates hidden agent calls — the user-approved finite dispatch list is the budget. PR #56.
  • The external-executor contract mirrors the closed vocabulary: every dispatchable lane carries requires_explicit_decision: true. The contract still describes and validates only; each runner remains the sole enforcement authority. PR #56.
  • README restructured for clarity: why/quick-start/how-it-works flow, the governance model in one place, and a command reference table.

[0.19.0] — 2026-08-29

Changed

  • Promote glm-5.3-flash / claude-zai / max as the sole GLM route after the exact v4 pack passed 9/9 no-retry attempts at score 1.0. All 204 assistant events carried the exact Flash identity, every terminal modelUsage reported the sole canonical first-party Flash participant, and every builder checker passed. Clerk/scout are qualified explicit-only; builder is provisional explicit-only. Historical GLM-5.3 and Flash v1-v3 evidence is not relabelled.
  • Keep Claude Code and Bun temporary paths inside the evaluation scratch and preserve USER in the sanitized environment. The first Flash attempt never reached the provider because the frozen native CLI tried to create /tmp/claude-501; that attempt remains a terminal VOID.
  • Record the terminal v3 identity probe and align future strict extraction with the actual Claude Code/Z.AI stream: content-bearing assistant events expose message.model, while modelUsage carries canonicalModel and provider. V3 is not relabelled; the fresh v4 pack supplies the evidence used by the promotion recorded above.

Verified

  • The exact v4 pack completed 9/9 no-retry attempts at score 1.0 for glm-5.3-flash / claude-zai / max; all 204 assistant events had complete Flash attribution, every usage record named the sole canonical first-party Flash participant, and all three builder checkers passed 6/6 tests.
  • The release candidate passed all 12 regression suites in 52 seconds, 59 routing checks, ShellCheck, JSON/evidence validation, the eight-check version gate, git diff --check, and independent cross-family review with verdict SHIP.
  • A clean release-candidate install matched source across the GLM runner, both gates, and the Claude/Codex executor skills. Static doctor reported 55 OK, 0 WARN, 0 FAIL; doctor.sh --ping --ping-glm reported 58 OK, 0 WARN, 0 FAIL, with GLM-5.3-Flash and both bridge directions returning PONG/reachable.

[0.18.0] — 2026-08-27

Added

  • Added delegation-grok run --oauth shared for concurrent Grok Build workers. Operational runs share one runner-owned persistent GROK_HOME generation, use the vendor auth lock for refresh coordination, and hold the kit lock only for generation adoption and atomic publication. External grok login wins a conflict; corrupt or superseded OAuth state fails closed. Evaluations remain serialized.

Fixed

  • Serialized Grok runs now hold an OAuth lock for the complete dispatch and atomically publish validated refreshed credentials back to the ambient login, instead of deleting a refreshed token with the ephemeral HOME. Sandbox attestation uses a unique per-run profile and ignores peer/malformed events; the agent cannot edit the credential, policy, or attestation files. Superseded credential generations are bounded instead of accumulating at rest.

Verified

  • The 0.18.0 release candidate passed all 12 regression suites in 52 seconds, 59 routing checks, ShellCheck, evidence validation, version consistency, and git diff --check. A real two-worker Grok 4.6/high smoke returned PONG twice in about five seconds, left both workspaces empty, and finished with ambient/shared OAuth hashes aligned. The provider did not separately expose the effective content model, so the smoke is operational compatibility proof, not strict model-identity evidence. The installed release candidate matched source across the changed runner, gates, and skills; the live doctor command completed with 57 OK, 0 WARN, 0 FAIL.

[0.17.0] — 2026-08-18

Changed

  • Reworked the native routing policy so Sonnet and Luna are limited to very small, non-builder clerk/scout/routine-review tasks. The former sonnet-builder and terra-scout profiles are retired; the old opus-reviewer/high profile is replaced by a max-effort cross-family reviewer.
  • Added opus-builder at claude-opus-5 / max and made it the fallback to the default terra-builder at gpt-5.6-terra / max. Added separate read-only opus-reviewer and terra-reviewer profiles, also at max, so both high-level models can build or review without mixing permissions.
  • Added an explicit model-family registry and fail-closed cross-family review rule. Every routine/material/security review resolution now requires the producer profile or family, removes all same-family reviewers, and exposes the exclusions in the router output. Runtime availability must still be checked; no eligible reviewer means stop, not self-review.
  • This is a breaking routing migration: callers resolving a review lane must now pass --producer-profile or --producer-family; omission exits 64 instead of selecting a potentially same-family reviewer.
  • Promoted security review from the former manual Opus-only route to producer-aware provisional defaults/fallbacks across Sol, Terra, and Opus. The Opus path continues to disclose Anthropic’s possible Opus 4.8 fallback for classifier-flagged cyber requests; exact Opus 5 identity is not guaranteed on that path. The former native senior route now has no operational profile.
  • Re-pinned the read-only sol-judge profile from high to max and fable-judge from xhigh to its verified supported max on explicit owner effort decisions. Both remain manually qualified and explicit-only; coding rows at the exact max tuples are contextual, not judgement evidence.
  • Recorded a scoped installed-profile smoke for opus-builder: the exact Opus/max request changed only its assigned file, passed git diff --check, and surfaced canonicalModel: claude-opus-5. The lane remains provisional; one synthetic edit is compatibility evidence, not general qualification.
  • Updated installation, cleanup, doctor, routing tests, and policy documents to enforce the new role and family boundaries and remove stale installed profiles.
  • Fixed the release doctor so its missing-producer probe preserves the caller’s shell options, and added an end-to-end regression for Codex configurations without a root-level sandbox_mode.

[0.16.0] — 2026-08-17

Added

  • Added delegation-deepseek, its executable and central gates, installer, doctor checks, executor skill, and regression suite. The official deepseek-v4-pro API is pinned to max; only the text-only builder lane is provisional/explicit-only after one exact live patch smoke, and every other lane remains blocked.

Changed

  • Re-pinned the fail-closed Antigravity bridge from Gemini 3.6 Flash to gemini-3.7-flash, including its gate, skill, policy, installer, doctor, and tests. No operational Gemini lane is inherited: the current local session cannot attest exact 3.7 inventory/OAuth, so all new routes remain blocked.
  • Refreshed the evidence registry with first-party Gemini 3.7 Flash and DeepSeek V4 Pro sources and contextual benchmark claims; neither source auto-qualifies a lane.

[0.15.0] — 2026-08-16

Changed

  • Sol becomes Codex’s default material reviewer without widening its role. sol-reviewer at high moves from manual explicit selection to the provisional material-review default on an explicit owner decision. It remains read-only and provisional because no exact review precision/recall row exists. sol-judge, judgement, and super-judgement remain manual and explicit-only; routine review and executor lanes are unchanged.
  • GLM-5.3/max replaces every previous GLM route across the active executor. The exact high/max comparison ran three no-retry attempts per lane on the same frozen runner. Both efforts scored 1.0 in all nine attempts and passed every builder checker; the preregistered efficiency rule selected high (372s, $0.334234) over max (505s, $0.719138), after which the owner explicitly selected max as the sole operational effort. Clerk and scout are qualified explicit-only and builder remains provisional explicit-only. The 5.2 and 5.3/high gates and central profiles were removed; upgrades delete stale installed copies while frozen receipts remain historical. The selected tuple was requalified 9/9 on the final max-only runner bytes; the public result records digests for both the comparison and operational receipts.
  • The evidence snapshot records Z.ai’s GLM-5.3 release, Coding Plan access, effort mapping, and launch benchmark claims as contextual-only evidence. No independent tracked leaderboard had a GLM-5.3 row on 2026-08-14.

Fixed

  • delegation-glm now reads model and profile identity from the selected executable gate, permits only glm-5.3/max, and capability-probes Claude Code with a ten-second fail-closed timeout. A separately verified native binary can be selected explicitly for diagnostics without weakening model, lane, effort, sandbox, or manifest checks.

[0.14.0] — 2026-08-13

Changed

  • Grok 4.6 replaces Grok 4.5 across the active integration. The runner, central and executable gates, skills, installed Claude/Codex policy, doctor, documentation, and regression fixtures now pin grok-4.6 through Grok Build at effort high. builder and frontend-builder remain provisional and preferred-explicit, so every dispatch still requires an explicit decision plus --allow-provisional; no reviewer, senior, or judgement lane was added.
  • The 2026-08-12 evidence snapshot adds separate Grok 4.6 observations from CursorBench 3.2, FrontierCode 1.1, APEX-SWE, APEX Agents, Code Arena WebDev, and xAI’s launch material. Every row is contextual: the independent results use non-production harnesses, WebDev is preliminary, and xAI’s figures are first-party claims. Grok 4.5 benchmark rows remain historical evidence and do not support the new route.

Fixed

  • Grok metrics no longer mistake a modelUsage billing participant for the model that authored the content. They record the requested model, any separately surfaced effective content model, and all usage participants, summing their tokens and cost. A surfaced mismatch fails every lane closed; a strict evaluation with no content-model identity is VOID rather than a false pass.
  • Upgrading removes the installed grok-4.5-routing.json and installs the 4.6 gate atomically with the current router and evidence snapshot before checking a retained private CLI archive. A portable upgrade regression covers stale gate removal, new-gate installation, and archive retention without depending on the user’s authentication state.

Verified

  • All ten regression suites, ShellCheck, JSON/evidence/gate validation, and the version/tag consistency checks pass. After reinstalling the dirty release candidate, delegation-grok check --json resolved Grok Build CLI 0.2.114 with grok-4.6-build, and ./doctor.sh --ping-grok returned PONG with 42 OK, 0 WARN, 0 FAIL.

[0.13.2] — 2026-08-05

Fixed

  • The Agent Arena row for Gemini 3.6 Flash had five of its six effects recorded with the wrong sign. The board encodes each effect’s direction as a coloured triangle rather than a character, so the automated capture that built the 0.13.0 snapshot read every value as positive; the row was committed with sign_inferred and only net_improvement_pct flipped, on an inference from the sort order. Read visually from the rendered board, the model is negative on every effect: net improvement -3.01%, confirmed success -1.63%, praise vs complaint -5.19%, bash recovery -2.69%, and steerability -6.70% — that last one being the scout lane’s own supporting metric, which makes this the difference between “unproven” and “measurably worse than the baseline agent in real sessions”. The flag is gone and the row now states that its signs were read, not inferred. The rows near the boundary were re-read too: GPT 5.6 Sol, Luna, and Terra at ranks 5, 17, and 18 are positive as recorded, so the error was isolated to the one row below the inflection.
  • skills/qwen-executor now tells the brief to demand a/ and b/ diff header prefixes. The text-only builder lane returns a patch the lead applies, and left to itself the model emits --- <path> on both sides; git apply defaults to -p1 and strips one leading component precisely because of that convention, so an unprefixed header resolves to a path that does not exist and a correct patch fails to apply — which reads like a wrong answer and is not one. Re-dispatched with the instruction, the model returned prefixed headers and the patch applied with a bare git apply. The skill also records -p0 as the recovery for a patch already in hand.

[0.13.1] — 2026-08-05

Fixed

  • The Gemini lane was unreachable from an SSH session, whatever the user did. agy picks its credential store from the environment: seeing SSH_CLIENT, SSH_CONNECTION, or SSH_TTY it switches to a file-based token store and never consults the macOS Keychain. delegation-gemini supplies credentials the opposite way — prepare_isolated_home symlinks the user’s ~/Library/Keychains into the isolated home and carries nothing else — so over SSH the CLI looked in a store that was never written, agy_status reported agy model inventory unavailable, and every dispatch failed closed with exit 69. Signing in again could not help: the login landed in the Keychain that the CLI had already decided to ignore. The runner now clears the three markers for every agy call that can touch credentials — the plugin inventory, the model inventory, and the dispatch itself. On a local session they are unset already, so this is a no-op there, and it grants nothing new: no additional tools, no filesystem access, only which credential store the CLI consults. Verified end to end from an SSH session: check reports ready and a real scout dispatch returned a correct answer at exit 0.
  • The unavailable-runtime reason now says to keep the login keychain unlocked, since that is the only store this runner can read; the previous text sent the reader to an interactive sign-in that would not have fixed the SSH case.
  • tests/gemini-runner-diagnostics.sh now runs its whole suite with SSH markers exported, and its agy stub exits 90 if any of them reaches the CLI. Neutering the fix makes the suite fail, so the regression is real rather than vacuous.

[0.13.0] — 2026-08-05

Changed

  • Routing gate — the three Codex executor lanes are re-pinned above the effort cliff. luna-clerk moves low → max, terra-scout low → medium, and terra-builder medium → max. Lanes, models, harnesses, sandboxes, and statuses are unchanged; only the pinned effort moved. The reason is that the cheap models do not degrade gracefully and the kit had its two highest-volume lanes pinned where they collapse: on the exact Artificial Analysis rows gpt-5.6-luna at low scores 15% SWE-Atlas-QnA — the clerk required metric — against 33% at max, and the Epoch effort ladder puts the same model at 1.5% DeepSWE at low against 67.2% at max. terra-builder gains both builder required metrics: DeepSWE 46% → 67% and Terminal-Bench v2 69% → 84%, at $2.76 rather than $0.90 per task. Each new effort was chosen because it already carries an exact benchmark row, so no lane trades measured evidence for expected capability. Owner decision on measured evidence, recorded in each lane’s qualification_basis.
  • Routing gate — Kimi K3 and Grok 4.5 become preferred-explicit on builder (they already were on frontend-builder). Both remain provisional and still require an explicit decision plus --allow-provisional; only the ordering among external builders changed. They are the only two carrying both builder required metrics on an exact production tuple, so they now rank above glm-builder and qwen3.8-max, which carry none. This records preference, not qualification: Kimi’s local evaluation is still a quota-truncated run and Grok’s a single non-held-out task.
  • Codex reasoning-effort support is per model, not global, and reaches further than this repository claimed. Probed against the provider on 2026-08-05: gpt-5.6-terra enumerates none · minimal · low · medium · high · xhigh · max and ran at high, xhigh, and max; gpt-5.6-sol and gpt-5.6-luna ran at xhigh and max; gpt-5.5 refuses max. The effort table in model-routing.md previously stopped every Codex row at high.

Fixed

  • delegation-evidence check silently passed a broken snapshot. It ran age="$(validate)", and a command substitution does not inherit set -e, so the jq -e covering schema, id uniqueness, and source references could fail while check still printed valid and exited 0 — only the freshness check, which uses an explicit return, was effective. The validation now fails with exit 65 and a message naming the file. Caught when a snapshot whose rows referenced three nonexistent sources was reported as valid.
  • preferred-explicit had no positional meaning: delegation-route resolve emitted the explicit array in profile-insertion order, so a plain explicit-only profile could be listed ahead of a preferred one. Preferred entries now come first, insertion order preserved within each group.

Added

  • 65 dated evidence rows and three sources in config/model-evidence.json: Agent Arena (data 2026-08-03, 1,607,993 sessions — first Claude Opus 5 rows, entering at ranks 1 and 3), Code Arena WebDev (data 2026-08-01, 510,194 votes — first qwen3.8-max row at rank 4, which is the frontend-builder required metric for a model that has no such lane), and the Epoch AI ZIP of 2026-08-04, whose first import of the DeepSWE effort ladder is what made the cliff visible. Existing rows are untouched; the gates reference them by id. Every Epoch row is contextual_only because mini-swe-agent is not a production harness, and the Gemini Agent Arena row carries sign_inferred because the board’s sign is not machine-readable.

[0.12.0] — 2026-08-04

Added

  • delegation-kimi run --oauth shared (or DELEGATION_KIMI_OAUTH_MODE=shared): concurrent Kimi dispatches. Until now the kit lock spanned the whole run, so a second agent died instantly with exit 75 — but the vendor supports ~30 concurrent instances when they share one KIMI_CODE_HOME, coordinating refresh-token rotation through the CLI’s own cross-process oauth lock. In shared mode, OAuth state lives in a runner-owned generation under $DELEGATION_DATA_HOME/kimi-shared-oauth; each run’s isolated home symlinks its credentials/ and oauth/ dirs at that generation so the vendor lock coordinates the children, and the kit lock shrinks to two brief critical sections (seeding the generation, publishing it back to the ambient home). Generations — not hash markers — keep a dead token family from clobbering a credential after an external kimi login; a busy kit lock at publish time defers to the next run instead of failing. The serialized default and its sandbox profile are byte-for-byte unchanged, --evaluation runs always serialize, and the live two-parallel smoke against the real CLI passed on 2026-08-04 with a real mid-run rotation through the symlinked generation.
  • DELEGATION_KIMI_OAUTH_WAIT_SECONDS (default 5, 0 = fail immediately): bounded wait on the kit lock for shared-mode seed and publish.
  • delegation-glm now distinguishes two 429 shapes in <output>.error.json: reason rate_limited (retry with backoff) versus quota_exhausted, which carries the window-reset epoch in the new next_flush_time field (diagnostic schema_version 2). Z.AI’s numeric body codes never reach the runner — a captured stream shows api_retry carries only the HTTP status — so quota detection keys on the rate_limit_event reset epoch instead.

Fixed

  • The delegation-glm stderr fallback grepped for Z.AI code 1312, which does not exist in the published error table, and missed 1302 — the actual rate/concurrency code.
  • A stray 429 event in an otherwise-completed GLM stream no longer overwrites an extract-phase reason (empty_result, model_mismatch, …) with rate_limited: reclassification is now scoped to dispatch failures.

[0.11.1] — 2026-08-03

Fixed

  • Made the CI release-tag check fetch the real tag object before validating it. actions/checkout maps the commit SHA onto refs/tags/<name>, leaving a lightweight ref even when the pushed tag is annotated, so the 0.11.0 tag run failed with tag is annotated: expected 'tag', got 'commit' while the tag itself was correct on both the server and locally.
  • Made tests/version-consistency.sh --tag fail when the tag object is absent instead of silently skipping the annotation and subject checks. A silent skip left the convention unenforced in exactly the environment it was written for.

[0.11.0] — 2026-08-03

Added

  • install.sh now writes installed-version.json into the data home, and doctor.sh compares it against the checkout. Until now a stale install was undetectable: every other doctor check inspects the installed copy against itself and passes while it lags the repository. A version mismatch is a FAIL, a same-version commit mismatch is a warning, and installs from a dirty checkout or with --claude-only/--codex-only scope are recorded so the marker never overstates what was installed.

  • Added tests/install-version-marker.sh, which installs into isolated homes and asserts both the marker’s contents and that doctor detects version drift, commit drift, a missing marker, and a missing install.

  • Added run-tests.sh, which runs every suite in parallel on one machine and prints the full log of any that fails. CI uses it, cutting the macOS job’s test step from ~116s to well under half without allocating a second runner. --sequential restores one-at-a-time output for debugging.

  • Added .github/workflows/ci.yml. Until now nothing verified a release except the person cutting it. Every pull request and push to main now runs shellcheck at -S warning, the version-surface check, and the regression suites on macOS; a tag push additionally validates the tag against the manifest version. Suites run on macOS because the Kimi runner requires /usr/bin/sandbox-exec and the Grok suite asserts BSD stat -f modes.

  • Added tests/version-consistency.sh, which enforces the CLAUDE.md release rules: the five version surfaces must agree, the newest changelog section must be the shipped version, and --tag validates the delegation-kit--v<semver> annotated-tag convention.

[0.10.0] — 2026-08-03

Changed

  • Repinned the Qwen bridge from qwen3.8-max-preview to qwen3.8-max after the model left preview on 2026-08-02. The rename rests on a local Token Plan probe confirming GET /models lists the unsuffixed id and that a chat completion pinned to it returns .model == "qwen3.8-max" with reasoning_effort: xhigh accepted; the -preview id still resolves in parallel. Renamed config/qwen3.8-max-preview-routing.json to config/qwen3.8-max-routing.json and the central gate profile to qwen3.8-max.
  • Promoted the Qwen builder lane to provisional / explicit-only at xhigh on an explicit owner routing decision. delegation-qwen run now accepts --allow-provisional, which is mutually exclusive with --evaluation; the previous blanket refusal of every provisional lane is gone. Every other lane stays a blocked candidate, and judgement stays disabled.
  • Cleared the Qwen policy-annotation manifest allowlist in both gates. The frozen manifest was bound to the qwen3.8-max-preview profile, model, and runner hash, so it can no longer validate; regenerate it against the new tuple before any evaluation run. The frozen v2/v3 evaluation artifacts are historical records and were deliberately left unrewritten.

Documentation

  • Recorded the promotion as an owner decision rather than measured capability. A 2026-08-03 re-check of the Artificial Analysis coding-agent board and Terminal-Bench 2.1 still found no qwen3.8-max row, so both builder required metrics (coding.deep_swe_pass_pct, coding.terminal_bench_v2_pass_pct) remain unmet and exact_evidence_ids stays empty. Alibaba has published no benchmark table for the model.
  • Added the contextual qwen-3.8-max-ga-launch evidence row and its qwen-3.8-max-ga-2026-08-03 source. Its metrics live under launch.* so they cannot satisfy any lane’s required_metrics. The snapshot date stays 2026-07-31 because this was a targeted re-check, not a full refresh.
  • Documented that the Qwen builder lane is text-only: the chat-completions transport exposes no tools and no terminal, so it returns a patch the lead applies and verifies rather than editing a worktree, and it is prompt-only.

[0.9.0] — 2026-08-01

Added

  • Added delegation-schema, a read-only deterministic compiler and verifier for Claude Code and Codex structured-output transport schemas.

Fixed

  • Made GLM lane evaluation compile its manifest-bound schema for Claude before dispatch, while leaving the normative schema and frozen protocols unchanged.
  • Made schema compilation preserve literal objects and property order, reject non-standard JSON, and fail closed on unsupported Codex keywords, unions, and documented Structured Outputs limits.
  • Made doctor.sh use Claude’s provider-free auth status and warn when a sanitized macOS environment drops USER and therefore Keychain resolution.
  • Made doctor.sh exercise both the Claude and Codex compiler paths before reporting the installed schema transport helper healthy.

Documentation

  • Defined separate requested, effective, and observed-usage model evidence for Claude safety fallback and internal classifier telemetry, including aggregate token/cost accounting and exact-identity VOID behavior.
  • Documented provider-specific schema preflights for raw Claude and Codex bridges; --help checks alone are not semantic compatibility checks.

[0.8.1] — 2026-07-31

Changed

  • Raised the maximum manifest-bound Kimi evaluation timeout from 600 to 1200 seconds. Operational Kimi runs remain capped at 900 seconds.

[0.8.0] — 2026-07-31

Added

  • Added hash-allowlisted, manifest-bound qualification for GLM clerk, scout, and builder at the exact glm-5.2 / claude-zai / high tuple.
  • Added portable lane-specific structured-output schemas, per-attempt receipts, full worktree and Git-control attestation, and a public minimal aggregate for the frozen repeated comparison.
  • Refreshed current GLM and cross-model context from Agent Arena, Code Arena WebDev, Terminal-Bench 2.1, SWE-bench-Live, OpenBench, Z.ai, and Epoch.

Changed

  • Qualified GLM clerk and scout as explicit-only routes after three valid repeats matched the best incumbent on each bounded pack.
  • Moved GLM builder from candidate/blocked to provisional/explicit-only after all three GLM attempts and all three Terra incumbent attempts passed the deterministic checker. Builder still requires --allow-provisional.
  • Extended central gate validation so private GLM qualification allowlists may cover clerk, scout, and builder without creating an operational route by themselves.

Fixed

  • Made the GLM runner actually pass the manifest-bound output schema to Claude Code and extract structured output without changing the historical policy-annotation path.
  • Replaced a non-portable generic comparison schema with lane-specific schemas accepted by both Claude Code and Codex.
  • Hardened GLM qualification with fixture-only data reads, a native-CLI process allowlist, an empty environment, immutable .git, ignored/untracked file and executable-mode hashing, and disabled Claude keychain prefetch. The final runner passed independent security review and macOS sandbox canaries.

Documentation

  • Documented the exact local decisions, costs, latency limitation, invalidated runner/preflight series, and two VOID Claude builder comparator attempts caused by an out-of-fixture write. No attempt in the final v6 series was retried.

[0.7.2] — 2026-07-31

Changed

  • Removed downstream Dipylon evaluation packs from the repository, installer, doctor, routing allowlists, and pack-specific tests.
  • Kept only kit-owned qualification manifests in the central routing allowlist and added a generic invariant that every allowlisted manifest is tracked.
  • Preserved the generic Qwen 900-second evaluation ceiling and timeout classification introduced alongside the downstream packs.

Documentation

  • Documented that project-specific evaluation packs belong in their owning repository or artifact registry and are deliberately ignored here.
  • Kept the 0.7.1 Claude Code, Codex, and external-runner compatibility matrix as the reproducible compatibility snapshot for this patch release.

[0.7.1] — 2026-07-31

Added

  • Added a reproducible compatibility matrix for all shipped Claude Code agents, Codex profiles, and gated external runners.
  • Recorded semantic smoke expectations, cross-CLI round-trip verification, fail-closed Qwen behavior, and byte-for-byte installation checks.

Documentation

  • Clarified that codex exec --ephemeral -p <profile> must not be combined with --ignore-user-config, which also suppresses the selected profile.
  • Clarified that Claude read-only roles expose Bash for inspection and therefore do not have the same OS-enforced write isolation as Codex read-only sandboxes.
  • Preserved all existing provisional, candidate, and blocked routing decisions; successful runtime verification is not a model promotion.

[0.7.0] — 2026-07-31

Added

  • Upgraded the Kimi bridge to a capability-probed Kimi Code runtime with lane-specific agent files and a digest-attested ripgrep allowlist.
  • Added bounded cancellation, timeout handling, sanitized heartbeat/error diagnostics, and explicit OAuth finalization.

Security

  • Confined Kimi process execution to the selected CLI, /usr/bin/true, and the exact pinned ripgrep runtime under the macOS sandbox.
  • Kept all Kimi lanes provisional and explicit-only without changing historical evaluation manifests.