Harden and simplify delegation, Autopilot, and recovery

.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-architect",
-  "description": "CLI coding-agent orchestration for Claude through Codex, OpenCode, Pi, and Pythinker Code, with a commitment-boundary advisor.",
+  "description": "CLI coding-agent orchestration for Claude through Codex, OpenCode, Pi, Pythinker Code, Antigravity CLI, and headless Claude Code, with a commitment-boundary advisor.",
   "owner": {
     "name": "elkaix"
   },
@@ -12,7 +12,7 @@
       "name": "claude-architect",
       "displayName": "Claude Architect",
       "source": "./",
-      "version": "0.49.0",
+      "version": "0.52.0",
       "description": "Verified P0-A MCP delegation with macOS arm64 certified; eligible Linux Codex editing is tested; native Windows Codex editing is unsupported. Codex edit eligibility requires its proven native sandbox.",
       "author": {
         "name": "elkaix",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-architect",
   "displayName": "Claude Architect",
-  "version": "0.49.0",
+  "version": "0.52.0",
   "description": "Verified coding-agent delegation for Claude Code with isolated Producers, frozen candidate artifacts, independent review, and human-controlled integration.",
   "author": {
     "name": "Mohamed Elkholy",

.github/workflows/ci.yml

@@ -10,15 +10,15 @@ jobs:
         os: [macos-15, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with: { node-version: 22 }
       - run: node scripts/verify-native-helpers.mjs
       - if: runner.os == 'Windows'
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with: { version: 0.15.2 }
       - if: runner.os == 'Windows'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
       # Build the Job Object helper so the win32-gated suites exercise the
       # real fail-closed spawn path; the committed binary ships separately.
       - if: runner.os == 'Windows'
@@ -36,11 +36,11 @@ jobs:
       # validate-release runs `claude plugin validate`; the CLI is not on
       # hosted runners, so install it for the POSIX legs.
       - if: runner.os != 'Windows'
-        run: npm install -g @anthropic-ai/claude-code
+        run: npm install -g @anthropic-ai/claude-code@2.1.282
       - if: runner.os != 'Windows'
         run: bash scripts/validate-release.sh
       - if: runner.os == 'Windows'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: win32-job-kill-x64
           path: native/bin/win32-job-kill-x64.exe
@@ -49,11 +49,11 @@ jobs:
   windows-arm64-filesystem:
     runs-on: windows-11-arm
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with: { node-version: 22 }
       - run: node scripts/verify-native-helpers.mjs
-      - uses: mlugg/setup-zig@v2
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with: { version: 0.15.2 }
       - shell: cmd
         run: |

.github/workflows/codeql.yml

@@ -18,8 +18,8 @@ jobs:
   analyze:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4.37.7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: javascript-typescript
-      - uses: github/codeql-action/analyze@v4.37.7
+      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.nvmrc

@@ -0,0 +1 @@
+24

AGENTS.md

@@ -57,7 +57,7 @@ Before invoking **dynamic workflows**, **ultra code**, or any equivalent harness
 - Read-only roles cannot mutate files, Git state, processes, or external systems.
 - Roles communicate through versioned specs, manifests, patches, findings, and other durable artifacts—not hidden conversational state.
 - Verification is objective, recorded, and rerunnable; Producer claims are never evidence.
-- Candidate acceptance is governed by a configured decision authority, and the provenance of every decision is recorded (`human-elicitation`, `policy-autonomous`, or `caller-asserted`). The shipped default (`CLAUDE_ARCHITECT_DECISION_AUTHORITY` unset, or `autonomous`) records a decision without prompting **only** for an independently verified candidate carrying no failure, no advisory warnings, and a readable archive; every other case still requires a human through MCP elicitation and fails closed without it. `human` requires confirmation for every decision. Integration refuses any acceptance whose provenance is unknown (`caller-asserted`, or absent on a pre-provenance archive). Do not "restore" unconditional human acceptance — the autonomous default is deliberate, so a delegation does not stop to ask permission on the path where the runtime has already proven everything it can prove. Human control is retained where it is load-bearing: verification gates what may be accepted at all, and integration still refuses a moved `HEAD`, a dirty tree, or a hash that does not match the reviewed artifact.
+- Candidate acceptance is governed by a configured decision authority, and the provenance of every decision is recorded (`human-elicitation`, `policy-autonomous`, or `caller-asserted`). The shipped default (`CLAUDE_ARCHITECT_DECISION_AUTHORITY` unset, or `autonomous`) records a decision without prompting **only** for an independently verified candidate whose project verification ran under an OS confinement backend, carrying no failure, no advisory warnings, and a readable archive; a plain `delegate` candidate that changes verification inputs (tests, test or build configuration, dependency manifests) also needs a person, because its verification can no longer prove anything about it. Off macOS no OS backend exists, so every decision there requires a human. Every other case still requires a human through MCP elicitation and fails closed without it. The opt-in Jev screen (`CLAUDE_ARCHITECT_JEV=on` with `TYPESAFE_API_KEY`) can only withdraw autonomy, never grant it; an outage leaves the deterministic verdict unchanged. `human` requires confirmation for every decision, and Autopilot, whose promotions record `autopilot-policy` provenance, refuses to start or promote under it. Integration refuses any acceptance that does not name the exact artifact it is spent on, and any acceptance whose provenance is unknown (`caller-asserted`, or absent on a pre-provenance archive). Do not "restore" unconditional human acceptance — the autonomous default is deliberate, so a delegation does not stop to ask permission on the path where the runtime has already proven everything it can prove. Human control is retained where it is load-bearing: verification gates what may be accepted at all, and integration still refuses a moved `HEAD`, a dirty tree, or a hash that does not match the reviewed artifact.
 - Workflow state, decisions, evidence, and recovery data remain durable across process failure.
 - Final review covers the entire candidate branch and cumulative interactions across attempts, not only the latest patch.
 
@@ -79,7 +79,7 @@ Do not collapse these boundaries to simplify a test. Generated `runtime/` output
 Treat every external agent as an untrusted Producer.
 
 - Give each Producer only the bounded spec and capabilities required for one attempt.
-- Isolate concurrent writers in separate worktrees.
+- Isolate concurrent writers in separate worktrees. Managed worktrees live only under `<main checkout>/.worktrees/claude-architect/<id>`, a self-ignoring namespace the runtime owns; `.worktrees/` itself stays the user's. Every pipeline writer, including each fixer, starts in a fresh worktree at the current candidate.
 - Prevent nested delegation and sanitize inherited configuration.
 - Terminate complete process trees on cancellation or timeout.
 - If confinement or eligibility cannot be proven, make the edit lane unavailable. Never fall back to a less isolated path.
@@ -195,7 +195,7 @@ Agents must not change Git configuration unless the user explicitly requests it.
 
 ## No Mistakes delivery gate
 
-Use No Mistakes as the default delivery path for non-release feature branches produced through manual implementation or SDD. Release commits and tags remain governed by the release rules above. Claude Architect Autopilot is a separate trusted delivery controller and follows its own lifecycle.
+Use No Mistakes as the default delivery path for non-release feature branches produced through manual implementation or SDD. Release commits and tags remain governed by the release rules above. Claude Architect Autopilot ends at a final-reviewed local branch; it never pushes, opens a PR, or polls checks. That branch is handed to No Mistakes like any other feature branch.
 
 - Do not initialize or launch the gate implicitly. Run `no-mistakes init` only on explicit user request because it changes clone-local Git wiring and installs or refreshes user-level agent skills. A user invocation of `/no-mistakes` is explicit approval for that run.
 - After manual SDD's cumulative final review, require the feature branch to be committed and clean, then obtain explicit approval for bare `/no-mistakes` validate-only mode. Do not use the generic `superpowers:finishing-a-development-branch` merge/push path while this gate applies. Preserve the SDD ledger and branch workspace until the gate's live state permits cleanup and branch custody has returned.
@@ -204,7 +204,7 @@ Use No Mistakes as the default delivery path for non-release feature branches pr
 - Drive agent-run validation through `no-mistakes axi`, not a raw push. For a manual gated submission, use `git push no-mistakes <branch>`; `git push origin <branch>` bypasses the feature-branch gate and requires explicit user instruction.
 - While a run is active, the pipeline owns its branch and fixes. Relay every `ask-user` finding verbatim, respect `branch_sync.next_action`, and never improvise a reset, stash, merge, rebase, force operation, branch replacement, or direct edit around the pipeline.
 - Treat `checks-passed` as the stopping point: report the PR as ready and ask the user to review and merge it. Do not poll for merge or hand-rebase an actively monitored PR.
-- Never start or stack No Mistakes while Autopilot is active or after it reaches `ready-for-human-review`: Autopilot already owns exact-head push, PR identity, required-check polling, and cleanup. Never start Autopilot while No Mistakes is active or still retains branch custody. Starting either controller after the other reports `failed` or `cancelled` requires an explicit user decision and recovered branch custody.
+- Never start No Mistakes while Autopilot is active on the branch. Once Autopilot reaches `ready-for-human-review` it has released the branch, and a user-approved No Mistakes run delivers it. Never start Autopilot while No Mistakes is active or still retains branch custody. Starting either controller after the other reports `failed` or `cancelled` requires an explicit user decision and recovered branch custody.
 
 ## Git safety