Release agent-collab 7.0.8 with runtime 5.0.9 (dual-architecture)

[sumitake]

Summary

Releases agent-collab 7.0.8 with signed/notarized provider runtime 5.0.9
(dual-architecture: darwin-arm64 + darwin-x86_64), built from
agent-collab-workspace main at 1a2b164d6224339aa5d312d06ddfb71a4ca9be34
(which includes merged sumitake/agent-collab-workspace#3185, squash
00ac5b6, and the standalone runtime version-bump commit that precedes
this build — workspace PR sumitake/agent-collab-workspace#3188).

Also packages the already-merged coordinator change
#221 (squash 8acb56a, on main before this branch).

What changed

Runtime 5.0.9 (scripts/_agent_collab/provider_runtime.py, workspace-side):
a request whose effort_class is below an action's descriptor floor is now
raised to the lowest admitted class before route selection, reported in the
new optional terminal field routing_adjustments, instead of failing closed
with no_descriptor_candidate. Request-validation and carrier-launch errors
carry a constant detail. An unsupported explicit target reports
target_agent_unsupported. Wire schema 12 / digest
a675807e0ff5f0544d7cc9d659914ce2dadac9be8efd0fb56635815e5c3e842a unchanged
(the terminal record already permits additional properties).

Coordinator #221 (plugins/agent-collab/coordinator.py, already on
main): repairs a small class of request-construction mistakes before its
single pass and reports each in a repairs field. Binds an unbound
read-only repository action to the caller's repository, or a linked
worktree of it that the payload names. A payload naming only another
directory is rejected before dispatch.

Version surfaces (all 7 bumped)

1. plugins/agent-collab/.claude-plugin/plugin.json → 7.0.8
2. plugins/agent-collab/.codex-plugin/plugin.json → 7.0.8
3. .claude-plugin/marketplace.base.json (+ regenerated marketplace.json)
4. root README.md (summary paragraph, one What's-new section, expected-unit list)
5. plugins/agent-collab/README.md (Current, runtime facts, self-version mention)
6. scripts/skill-build-config.json skill_version (+ regenerated 53 SKILL.md)
7. changelog.d/2026-09-24-runtime-509-distribution.md

Also: plugins/agent-collab/runtime-manifest.schema.json (provider_runtime_version
const), plugins/agent-collab/runtime_client.py (PROVIDER_RUNTIME_VERSION
pin — required before import per the runbook), docs/migration-from-legacy-packages.md,
and 8 version-pinned tests across tests/ and scripts/ (literal "7.0.7"/"5.0.8"
assertions renamed and updated to 7.0.8/5.0.9).

Project-estimation maintenance

Ran the governed scripts/project_estimation_release.py release-maintenance
pipeline from the workspace (live GitHub evidence collection + calibration +
pricing/quota research — not fabricated), producing a fresh version-bound
handoff for 7.0.8 (receipt schema 3, calibration_status: fresh). Admitted
the receipt-declared public artifacts into plugins/agent-collab/project-estimation-data/.

Verification

• python3 -m unittest discover -s tests -t . -v — 275 tests, OK
• python3 -m unittest discover -s scripts -p 'test_*.py' -v — 461 tests, OK
• python3 scripts/build_skills.py --check / build_marketplace.py --check — OK
• python3 scripts/build-changelog.py --dry-run — OK (fragment-only PR)
• python3 scripts/check_release_consistency.py — OK, all versions consistent
• python3 scripts/verify_runtime_release.py --git-sha runtime-handoff-import — PASS
• python3 scripts/validate_runtime_manifest_schema.py — PASS
• python3 scripts/check-public-export-safety.py --active-tree — SAFE
• python3 scripts/secret_scan.py — clean
• python3 scripts/check_python_version_gated_apis.py — OK
• git diff --check — clean
• CI release-evidence rehearsal (archive → evidence → checksum → SPDX) — PASS, replicated locally

Staged live qualification (Phase B')

• Provider-free migration doctor: provider_routing: READY, 12 logical actions, correct wire digest
• Provider-free manifest-bound routing plan (all 12 actions, dispatch_requested=false): all resolve; repository actions show repairs binding to caller repo
• Provider-free packaged Grok managed-review qualifier: qualification: "qualified"
• governance.repository at effort_class: standard: raised to maximum (action floor), routing_adjustments: [{"code": "effort_raised_to_action_floor", ...}], substantive decision returned
• review.repository without native_restrictions, run from inside a repository: repairs names the bound repository, substantive result
• A payload naming only another repository: rejected before dispatch (status: invalid_request, no provider call)
• Full provider_capability_canary.py matrix (all actions/carriers, maximum effort): see review thread for result
• darwin-x86_64 bundle: native CI smoke (Phase A2, on the self-hosted Intel builder) + Rosetta zero-inference readiness (all 12 actions) + one bounded live canary from the complete staged tree — both pass

Compliance trace

author: claude
standing_directives: docs/provider-runtime-release-runbook.md Phase A/A2/B/B'; docs/public-governance.md Tier 3; Project Decision Workflow
tier: 3
cross_check: antigravity governance.repository (google family, distinct from claude/anthropic author), github-comment:5808387063, verdict APPROVE -- PROCEED, confirmed on reviewed_sha 00daed4
post_condition: after merge, cut_release.py runs from clean main; tag+assets verified; activation on primary hosts with byte readback + readiness; Phase F closeout in both repositories
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: no

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4c8bf05b-e0bd-4c7c-a1fe-b2001e8b0210

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sumitake]

Tier-3 direct-runtime governance review (agent: antigravity/google family, distinct from author claude/anthropic), reviewed_sha: 00daed4f524eba73a7ca5dcf7fa0be6adced7c2c

Round 1 (reviewed_sha 27ffc15e97543a483a56e98fec8b0891f9ce15cc):

Tier-3 Independent Governance Review

• Target PR: sumitake/agent-collab#222
• Reviewed Head SHA: 27ffc15e97543a483a56e98fec8b0891f9ce15cc
• Base SHA: 8acb56a9457f... (main)
• Primary / Artifact Author: claude (Claude Sonnet 5) / anthropic family
• Governance Reviewer: antigravity / google family (author-distinct, Tier-3 governance review)
• Scope: Release agent-collab 7.0.8 carrying signed dual-architecture runtime 5.0.9

Verdict

APPROVE

Detailed Review Findings

1. 7-Version-Surface Checklist & Runtime Pins

The hand-authored diff and accompanying changes systematically satisfy the 7-version-surface contract and the underlying runtime contract:

• Surface 1: plugins/agent-collab/.claude-plugin/plugin.json — "version": "7.0.8" (verified in diff)
• Surface 2: plugins/agent-collab/.codex-plugin/plugin.json — "version": "7.0.8" (verified in diff)
• Surface 3 & 4: .claude-plugin/marketplace.json — plugins[0].version and metadata.version bumped to "7.0.8" (verified via test_public_distribution_contract.py asserting {"7.0.8"})
• Surface 5: .claude-plugin/marketplace.base.json — metadata.version bumped to "7.0.8" (verified via test_public_distribution_contract.py)
• Surface 6: scripts/skill-build-config.json — agent-collab.skill_version: "7.0.8" (verified in diff)
• Surface 7: 53 generated SKILL.md frontmatters — version: 7.0.8 (verified via test_unified_skill_runtime_contract.py checking \nversion: 7.0.8\n and build_skills.py --check)

Runtime 5.0.9 Surface Synchronization:

• plugins/agent-collab/runtime_client.py: PROVIDER_RUNTIME_VERSION = "5.0.9" updated. This is load-bearing as the public client and importer strictly cross-validate candidate manifests against this constant.
• plugins/agent-collab/runtime-manifest.schema.json: updated provider_runtime_version schema constraint to {"const": "5.0.9"}.
• docs/migration-from-legacy-packages.md: package unit updated to provider runtime 5.0.9.
• Test suites (test_stage_runtime_handoff.py, test_verify_project_estimation_maintenance.py, test_plugin_archive.py, test_protocol5_public_contract.py) updated to assert 5.0.9 and match the dual-architecture bundle (arm64 and x86_64).

2. Version Bump Pattern & Conventions

• "Current published release" vs "Current source": conforms to repository conventions — the candidate release PR stages the new version as the repository source, while the "Current published release" pointer remains anchored to the latest actual tagged release until the tag is cut.
• Changelog Fragment-Only Rule: adhered to; CHANGELOG.md untouched, only the fragment added.

3. Operational Reliability & Simplicity

• Graceful, fail-closed effort-floor raising and pre-dispatch repository-binding repairs improve operational reliability without expanding scope.
• Minimal, elegant diff — only necessary version strings, doc descriptors, schema constraints, and literal test assertions touched.
• Extensive validation evidence (275 + 461 unit tests, schema validation, export/secret scans, Rosetta x86_64 qualification, live staged Phase B' qualification) supports release readiness.

4. Non-Blocking Advisory Observation (Doc Polish) — RESOLVED in round 2

plugins/agent-collab/README.md's "Current published release" line had lagged at 7.0.6/5.0.7 since the 7.0.7 cycle. Flagged as non-blocking.

---

Round 2 (confirmation on reviewed_sha 00daed4f524eba73a7ca5dcf7fa0be6adced7c2c):

Confirmation Review: PR #222

Verdict: APPROVE

• Review Target SHA: 00daed4f524eba73a7ca5dcf7fa0be6adced7c2c (supersedes 27ffc15e97543a483a56e98fec8b0891f9ce15cc)
• Reviewer: Google Antigravity family (google/antigravity)
• Verified the sole diff between the two heads is the verbatim fix to plugins/agent-collab/README.md (lines 11–13): updating the stale published-release citation from 7.0.6 (runtime 5.0.7) to 7.0.7 (runtime 5.0.8). The round-1 non-blocking advisory finding is fully resolved.

The APPROVE verdict is confirmed and covers head commit 00daed4f524eba73a7ca5dcf7fa0be6adced7c2c.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T07:55:48.456234Z	00daed4	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-24T07:57:56.748380Z	00daed4	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 00daed4f52

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Defer the 7.0.8 publication claim until release

At this commit, the README still identifies 7.0.7 as the current published release, the package README says 7.0.8 publication is pending, and the linked evidence page only documents v7.0.7. Therefore this sentence incorrectly represents the bundled 7.0.8 artifacts as already published; describe them as signed/notarized or staged until the tag and assets are published and the final documentation closeout records that evidence.

AGENTS.md reference: AGENTS.md:L44-L48

Useful? React with 👍 / 👎.