Releases / Roadmap
The page separates shipped behavior from specifications. Civilization may survive this radical act of honesty.
Releases
Newest first. The current version is marked with a badge.
Why the first public release is not v0.1 or v1.0
The public release does not reset the project history.
M8Shift was bootstrapped on 2026-06-21 as a weekend prototype and built in days, not months — developed using M8Shift itself to coordinate its own work. Two AI agents work as buddies: they implement in turns and cross-review every change to catch regressions before they land. That contradiction-driven peer review compresses what would take a team months into hours. The first public release is therefore not an artificial v0.1 or a marketing v1.0: it is the version actually available and stabilized at publication time — already iterated to a state-of-the-art tool and shared openly.
Version numbers follow the working artifact: shipped relay behavior, install scripts, checksums, documentation, and validation features. Publishing the project publicly makes that accumulated state visible; it does not make the software begin from zero.
Proven by building itself
Dogfooded and proven by itself
M8Shift is used to coordinate its own development — M8Shift writing M8Shift — and to deploy itself. In its first days it has also coordinated other kinds of work: video-clip pipelines, book writing, legal drafting, and more. The relay's implement-then-adversarially-review loop is what makes the speed safe. It is still early, think late-alpha, and hardening continues; reaching v3.26 in under a week is itself the proof of the method.
In numbers — first 5 days
From 2026-06-21 to 2026-06-26, for about $120 of paid AI:
| Evidence | Snapshot |
|---|---|
| Tooling | ~6,900 lines of tool code + ~3,550 lines of tests (255 tests at v3.26.0; 384 at v3.41.1 — count ≠ coverage) |
| Knowledge base | 29 RFCs · ~10,000 lines of docs · bilingual site (70 pages, 9 languages) |
| Release pace | 165 commits across 25 releases (v1.0.0 → v3.26.0) |
Human-equivalent estimate
This is an illustrative order-of-magnitude estimate, not a hard benchmark. Under the assumption that equivalent work would need to be tested, documented, reviewed, and internationalized to a comparable standard, it represents roughly 1–2 person-years of skilled engineering — a 4–5 person team for several months — compressed into 5 days.
At the same level of approximation, ~$120 of paid AI versus ~$150k–300k of equivalent loaded labor suggests cost efficiency on the order of ~1,000×. The real cost of AI is higher than the price paid; this is a scale illustration, not an absolute fact.
M8Shift is shared openly so anyone can benefit from the method, not just from this specific codebase.
Feature focus — the headline advances
🚀 Token compression, on by default (RTK)
The context companion can run RTK as an identity-pinned, telemetry-off, argv-only shell-output filter — a lossy semantic filter (it extracts the signal: errors, test results, log lines) that reduces what an agent reads. In our own measurements the referenced context pack cut the hand-off context by ~97%, and RTK on real shell output by ~54–68% by dropping non-signal lines (a filter drop-rate, not lossless compression). Since v3.34.0 it is the default when RTK is present and pinned, and fully-degrading otherwise: absent, unpinned, or corrupt → native packing, no error. Telemetry is disabled on setup; the core stays stdlib-only. Since v3.36.0 you can see the state at a glance — status-runtime, doctor, and m8shift-context.py status print RTK: ON (pinned, compressing packs) or RTK: OFF (native) with the last-pack ratio, so a shift always knows whether it is actually saving tokens.
🧠 Broad-context compression, opt-in only (Headroom adapter)
Since v3.40.0, m8shift-context.py compress --backend auto keeps broad records such as conversation, history, file, report, diff, and large-context on the builtin digest unless an operator explicitly sets backends.headroom_ext.auto_enabled: true and identity-pins the bundled m8shift-headroom launcher (install.sh --with-headroom, pinned headroom-ai==0.28.0, requires --allow-project-local-adapters). Explicit --backend headroom_ext gives ~45–55% on prose (it errors on shell content). The reason is architectural: M8Shift's default handoff is a tiny lossy digest plus always-retrievable raw evidence, while Headroom targets a more near-lossless conversation compression problem. M8Shift never starts Headroom proxy/MCP/server modes; the shipped m8shift-headroom wrapper forces offline/cache-only execution (socket-blocked, model from cache). Since v3.41.0, records also carry --access-mode and --whole-content routing signals for the later evidence gate, while retrieve hash-checks raw and compact evidence before serving it.
Other advances users feel:
- 🛡️ Authority that survives interactive work —
lease-keepermaintains both the real write lease and protective liveness, whileguard-execplaces the pen check directly beside one shell-free mutation. - 🎟️ Scoped gateway delivery — a named gateway receives one expiring, single-use capability for an exact push/comment/PR-create transport action; merge, tag, close, deletion and force-push remain human-authorized.
- 🔎 Publication proof, not remote-name trust — the push gate binds policy to the canonical destination, supports twice-observed published-base receipts for clean new refs, scans merge-resolution content, and never calls an incomplete stage clean.
- ⚡ Parallelism — the degree-2 worktree companion runs several agents on isolated branches and serialises the merge-back through one integration pen (the core stays strictly one-pen).
- 💸 An economic view of usage — the core
cooldownparks the relay before a rolling usage-window limit is hit (RFC 040 Phase B), so a shift never blindly burns a session cap. - 🧾 Provenance & traceability — every commit can carry which model produced it (
Agent-Model), and decisions are recorded in a structured, tool-independent trace (RFC 031). - 🗺️ On the design board — parallel multi-session (RFC 038) remains future work; model/task cost routing (RFC 039) has shipped its Phase 1 advisory
route recommend(v3.35.0), with delegation/launch still under review; usage monitoring (RFC 040) shipped Phase 2 inv3.48.0, Phase 3 inv3.53.0and Phase 4 scaffolds inv3.56.0, then live-verified Claude/Codex adapters and a unified multi-window display inv3.57.0; adoption discipline and local update (RFC 048) shipped acrossv3.49.0andv3.50.0; project compartmentalization (RFC 052) shipped its first slice inv3.56.0and was completed inv3.57.0; holder liveness and stale-claim hardening (RFC 049) is complete inv3.57.0; agent skills & manual specialists (RFC 041 / RFC 050) shipped their open-format Phase 1+1b inv3.58.0; exact-identity fleet orchestration (RFC 072) shipped slices 1–6 inv3.61.0; the vendor-neutral agent-CLI adapter registry and detached durable fleet recovery (RFC 073) shipped slices 1–2 inv3.61.0, with live Gemini/resume and the #59 routing-matrix extension (slices 3–4) accepted but not yet shipped; per-agent usage throttles (#88, an RFC 040 amendment) shipped inv3.61.0.
Release history
| Version | Status | What shipped |
|---|---|---|
| v4.2.0 current | 2026-08-23 | Certified premises, preserved classifications, and a gate that may fail but never hang (Révision · #320 · #327–#334 · #335–#344 · #359–#365 · #368–#372 · #377–#390): • One turn, one producer — a listener reserves the pen before launching its provider child, so a listener and an interactive session of the same identity can no longer both take charge of one incoming turn; the new core verb unclaim undoes an unused claim and restores the exact awaiting state, refusing observably once the child has authored.• advanced certifies an identified premise — the launch snapshot digests the exact pre-turn block into the immutable run plan; certification requires the sole direct successor of that premise, still backed by the same premise bytes; an intervening turn, a multi-turn run, or a rewritten premise is the retryable premise_superseded, and ping-pong consumption stays success.• No-retry classifications survive a timeout — terminal, rate-limit and neutral statuses keep their doctrine under timed_out: a provider that prints its reset then hangs still places the scoped usage hold; runner and listener status vocabularies are held in lockstep by an exact-set witness, ending the twice-named-list defect family.• Evidence stays honest under degradation — oversized reviewer output is truncated on an exact UTF-8 boundary and delivered with digests over exactly the stored bytes; a width-truncated process census is marked degraded end to end and stop --all refuses to certify a relay it could not read; a dropped quota window and a local-only branch leave visible traces.• Lifecycle identity and safe reaping — lanes are enumerated by the relay they poll, failed-start reaping revalidates process identity immediately before the first signal (a reused pid is never signalled), a runner inside an ephemeral worktree is refused at arming time, and relay/workspace roots are formally distinct for externalized topologies. • Fleet upgrades and verified kits — re-entrant kit-upgrade transactions with recovery checkpoints, offline verification of installed adopter subsets, doctor drift baselines, and loaded-versus-on-disk dashboard skew. • The test gate may fail, never hang — every installer-family child runs bounded and hermetic (group kill, stripped inherited relay identity); measured on the previously affected host, the unfiltered suite reaches its verdict green. Suite: 1435 → 1619 collected tests. Read the release notes on GitHub. |
| v4.1.0 | 2026-08-12 | Authority becomes explicit from the pen to the forge (Révision · #263–#266 · #279–#281 · #300–#302 · #306–#307 · #312–#313 · #316–#317): • Interactive liveness and write authority stay together — lease-keeper refreshes the actual pen and emits a bounded protective heartbeat while one shell-free child lives; it stops the child if either guarantee fails. guard-exec checks the pen immediately before one external argv, and configured Git hooks fail closed instead of silently skipping that authority check.• A gateway receives one capability, never ambient authority — the live holder can issue a 30–900 second one-shot mandate bound to actor, action, exact targets, project/cwd, relay turn, canonical argv digest and executable bytes. The gateway atomically consumes it and launches a re-hashed private executable snapshot. Only exact push/comment/PR-create transport fits; merge, close, tag, deletion, mirror and force-push do not. • The publish gate proves the destination — public policy binds to a canonical endpoint fingerprint, not a remote nickname. A twice-observed single-use published-base receipt can narrow a clean new branch or tag while the pushed tag and every unpublished commit remain scanned; merge-resolution content is compared against every parent. • No configured stage that failed to run is called clean — closed enforcement spellings, missing-scanner handling, shell-safe argv construction, bounded Unicode-aware matching and a minimum length for allow: exceptions close the fail-open family without weakening the deletion-only cleanup path.• Runtime and quota evidence say what actually happened — headless completion requires the exact run id on the advancing turn; quota adapters separate measured, unusable-response and unavailable states; tokscale consumes its real redacted v4.13.0 quota shape; doctor makes stale worktree publication hooks visible without fetching.• Review is not merge consent — peer approval remains independent evidence; only the human maintainer authorizes an exact PR/head merge. Existing v4 relays need no format migration and retain the Python 3.12 floor. Read the release notes on GitHub. |
| v4.0.0 | 2026-08-08 | The publish gate reads names — and refuses rather than guessing (Génération · #291 · #292 · #295 · #297 · #262 · #251 · #252): • Denied identifiers are caught in file and directory NAMES — every scanner the pre-push hook ran matched file content, so a repository whose only offence was a directory named after a confidential term published cleanly under enforcement. The gate now enumerates tree entry names in every invocation mode, including the --all audit and the plain command, over the same revision selector the content scan uses, so the audit cannot answer one question for names and another for contents.• Nothing is framed by a sentinel the data could imitate — commit boundaries in the name walk are a NUL run, a byte Git forbids inside a pathname. The previous marker was a literal commit prefix, which is a perfectly legal path prefix: it did not close the collision it replaced, it moved it.• An audit that cannot see its whole window refuses to answer — a range-less scan requests one commit more than --max-commits allows and returns an error rather than a verdict on the prefix it happened to read. A push is still judged whole: bounding it would let a denied name ride in on the oldest transmitted commit.• An incomplete scan is never a clean scan — an enumeration that fails is an error, not an empty result, and its diagnostic never echoes Git's stderr, which quotes the offending path. • The gate no longer blocks the cleanup it demands — a push whose only change removes a denied name is reported and allowed, while introducing and then removing one in the same push still blocks, because the introducing commit is transmitted either way. • Publication is judged by endpoint proof, not by a local cache — findings are classified against the SHA Git obtains from the destination during push negotiation. A remote-tracking ref outlives the remote it mirrors and cannot answer "is this published"; a downgrade now requires every finding proven, not one. • Python 3.12 floor — CVE-2025-71176 affects every pytest below 9.0.3 with no 8.x backport, and pytest 9 needs Python 3.10+. Remediation and the old floor were mutually exclusive. update refuses this Generation crossing without --allow-generation-change, and the relay format is untouched: an M8SHIFT.md written by v3.x is read without migration. |
| v3.65.0 | 2026-07-20 | Failover policy, gateway observability, self-healing watchers (#212 · #229 · #214 · RFC 077): • Safe-boundary failover policy (pure, no live switch) — a pure eight-rule decision table routes between operator-declared model lines only between invocations (never mid-stream, never releasing a pen), compiles the target as an RFC 070 pin in dry-run without launching or replaying, records an immutable m8shift.route-decision.v1 audit line, and a usage hold always precedes routing; a three-facts fixture (account credit > 0, one model line near zero, another available) proves that no account-level average can ever collapse the founding exhaustion incident.• Gateway delivery observability — merge/tag/push/recovery actions append digest-only events to a gateway.jsonl side-ledger (closed action/outcome enums, denylist redaction that refuses rather than leaks, per-record atomicity), surfaced by a TOP GATEWAY line that stays visible during PAUSED — delivery in flight is no longer indistinguishable from silence; RFC 065 gains four incident-derived delivery rules (merge-verified-before-delete, fresh-PR cache recovery, ambiguous-405 reachability diagnostic, stacked-branch lineage).• Self-healing usage watchers — a managed lifecycle closes four observed failure modes (silent death, dual-epoch duplicates, in-process keychain freeze, live-ticking dead reads): a singleton lease with --replace takeover, managed stop/reconcile verbs, every tick a fresh out-of-process snapshot subprocess with a group-kill deadline (the in-process HUNG class is structurally gone), health measured by tick freshness AND read-success rate, and fail-closed identity verification before any signal so a recycled PID can never kill an unrelated process; the maintainers' own legacy watcher pair was recycled under the managed lifecycle as the release dogfood.• RFC 001–077 implementation audit — a versioned 77-row inventory with a precise gap register and a prioritized real-gap backlog, separating voluntary design-only proposals from genuine unimplemented work. |
| v3.64.0 | 2026-07-18 | Bootstrap hardening — an adopter incident becomes product law (#92 · #207 · #208 · #209 · #215): • Executable incident discipline — the bootstrap failure ships as a versioned incident record with hermetic reproductions; corrected-behavior contracts landed as intentional expected-failures whose removal is atomic with each fix, so an unfinished fix can never look green. • Runner compatibility handshake ( runner-exit-v2) — listener start probes the runner (bounded, provider never launched) and classifies current/legacy/broken/absent runners with an actionable provisioning remedy, including notify-only mode; rc 2 is reserved for a deterministic argv refusal that halts immediately, while transient infrastructure failures keep retrying.• Probe-led environment truth — a write-probe on the working and runtime directories (confirmed both before and after launch) is the only path to a terminal environment_blocked; text signatures are advisory IDs only; child output is tee'd bounded and echoed to interactive TTYs exclusively — durable artifacts carry counts, enums, and signature IDs, never provider text.• One listener truth table — a single pure core decision table feeds CLI status, runtime attention, notifications, and the dashboard: HALTED (resident) / operator_action_required with a stable cause, no more ALIVE-yet-absent contradictions, legacy sidecars stay valid across self-update, and every halt notifies at the transition.• Reentrant bootstrap — init provisions a version-locked runner into the kit (checksummed, no host paths), emits a marker-owned BOOTSTRAP.md runbook a fresh agent can replay from durable artifacts alone, and a shared scaffold write-gate refuses out-of-root writes (--confirm-script-dir) and conflicting M8SHIFT_ROOT before any file is touched.• Self-documenting CLIs — every entry point answers a bare invocation with full curated help (rc 0) oriented to humans and AI agents alike; the dashboard opens the TUI on a TTY but prints help to pipes instead of hanging them. • Release-gate determinism: hook-invoking tests pin their stdin to the git contract, ending environment-dependent hangs. |
| v3.63.0 | 2026-07-17 | Third live vendor, honest quota, instant navigation, arbitrated exchange standard (RFC 073 s3 · #203 · RFC 074): • Gemini becomes a live vendor — the provider-keyed registry compiles real Gemini CLI one-shot launches (pinned model, API-key-only auth via requires_env + child allowlist, bounded health, fail-closed resume); proven end to end by a real Gemini process claiming a pen and appending a turn in an isolated relay; adopter default registry stays healthy without the key.• Quota you can plan with — every usage surface leads with an explicitly labelled remaining figure derived from the vendor-cumulative full window (decision window first, 5h second, honest n/a); the vendor figure is authoritative and resyncs through resets including out-of-band manual full resets, emitting an observable usage.reset_detected event; machine surfaces carry both used_ratio and remaining_ratio.• Navigation without the lag — dashboard navigation keys re-render from the cached snapshot (zero engine subprocess spawns per keystroke), key bursts drain into one frame, reader turns are cached, and AWAITING states show a neutral no-TTL strip. • A fourth vendor in the registry — a source-validated Mistral Vibe adapter stub registers alongside Gemini, with the core anchor mapping verified against the CLI. • RFC 074 — standardized inter-agent exchange (arbitrated) — 15 primary shift stages in a structured turn field, a versioned vendor-neutral turn schema succeeding the emergent Stage 4 fields, and a read-only whole-shift export with mandatory digests and denylist redaction; ten operator decisions recorded, implementation separately authorized. • Also: advisory routing matrix phase 1, visible ellipsis on truncated model/effort ids, and per-turn effort declarations. |
| v3.62.0 | 2026-07-17 | Liveness evidence — usage freshness, producer coverage, stranded attention (#192 · #193 · RFC 027/056/062 amendments): • Usage freshness that cannot lie — the status snapshot carries additive captured_at/age_seconds/freshness/stale fields and the dashboard renders a mandatory, truncation-immune STALE marker before any stale ratio; machine readers get the same fields via status --json.• Detectable producers — usage watch records a per-agent lifecycle sidecar (pid, apply/advisory mode, heartbeat) so a dead refresher and stale data are separate findings.• Stranded turns get noticed — every AWAITING_<X> derives an advisory attention verdict (covered / human_resume_needed / stranded) from listener, presence, and usage-watch evidence (damaged evidence is unknown, never covered); past a strict 300 s boundary the runtime emits a deduplicated, local-tier-only stranded notification; listener start --notify-only gives interactive agents durable human wake-up without provider invocation.• A listening contract with teeth — RFC 062, the protocol, the agent pack, and the floor stanza now state that an expiring bounded wait counts as listening only while the agent stays blocked on it. • Hardening from adversarial review: the core sidecar reader survives invalid UTF-8 and deep JSON; notification I/O failures never end a listener; the byte-stable dashboard golden is decoupled from release versions (mirror CI green across releases). |
| v3.61.0 | 2026-07-16 | Fleet manager, vendor-neutral adapters + detached durability, per-agent throttles (RFC 072 · RFC 073 s1–2 · #88): • Exact-identity fleet orchestration (#85, RFC 072 slices 1–6) — declarative m8shift.fleet.spec.v1 fleet specs (curated provider template + explicit model only); pure fleet plan/health; holder-attributed fleet apply that bootstraps one git-ignored exact identity artifact per lane and delegates enrollment to core roster add; batch reconcile/stop/resume (stop keeps relay membership intact); immutable fleet jobs with explicit done criteria and shell-free verification recipes — provider exit alone cannot complete them; the designated integrator assigns at most two isolated producer worktrees and exclusively delegates verified merge/handoff/drop.• Vendor-neutral agent CLI adapter spine (#65/#66, RFC 073 slice 1) — a formal launch_argv/stop/resume/health contract (m8shift.agent-cli-adapter.v1) dispatched through a provider-keyed registry; Codex and Claude managed launch compilation moved behind adapters with byte-identical conformance fixtures; a registered Gemini validated stub proves a third provider joins without a core or generic-launcher change; live flags and resume stay fail-closed pending probe evidence.• Detached durable fleet control plane (#65, RFC 073 slice 2) — fleet supervise --detach installs one control plane through launchd/user-systemd/Windows service definitions when available, or reports the weaker local process-group-detached tier explicitly; schema-versioned, crash-consistent .m8shift/runtime/fleet/ records with fsync + atomic replace; PID start-identity reconciliation adopts exact live survivors, restarts a missing desired-running lane once, defers a transient probe failure unverified, and fails closed to needs_reconciliation on corrupt, stale, reused, or ambiguous evidence; SIGTERM-clean shutdown and stale-pid takeover after a reboot.• Per-agent usage throttles (#88, RFC 040 amendment) — a limit_hit gates only the affected agent's claim/next/wait and managed-listener launch; peers keep their normal relay rights and new applies never set global PAUSED; hold deadlines come from the exact normalized decision_window that triggered the verdict; explicit usage resume --agent clears only a freshly recovered target.• Also: provider-pinned agent models (#86, RFC 070), positional CLI help + command reference (#83), top-owned incremental status fold (#79, RFC 069), commit-time checksum refresh (#51), and claim-on-pickup liveness (#47). |
| v3.60.0 | 2026-07-13 | Skills, snapshot v1 + dashboard, generation-safe upgrade, usage honesty (Révision): • Operational advisory skills — release-manager, adversarial-verifier, ci-triage, leak-warden (scan half; compartmentalization invariants stay guide rules a skill cannot relax). • Init capability profiles + machine bootstrap — `init --profile bare |
| v3.59.0 | 2026-07-12 | Security baseline + runtime honesty (RFC 052 · RFC 047 · RFC 051 · #107 #108): • Repository security baseline — advanced CodeQL (security-extended + quality suites), a Bandit SAST gate, ShellCheck + actionlint, OpenSSF Scorecard, and Dependabot over SHA-pinned actions; SECURITY.md ships private vulnerability reporting and an honest security model.• OWASP LLM / MITRE ATLAS threat model — a framework-to-control matrix with explicit out-of-scope calls, backed by a behavioral, mutation-gated conformance suite: each mapped technique has a named test that fails when its invariant breaks. • Anti-leak gate, activated and fast — the RFC 052 pre-commit/pre-push hooks gain a documented activation path and a confidential-denylist CI backstop; scrub-check --range and pushed-range pre-push scanning turn a minutes-long full-history walk into a seconds-fast scan of exactly what a push publishes; doctor now reports a dormant gate (security.anti_leak_gate_dormant).• Runtime honesty (#108 slice 2 + #107) — listener capability fields ( backend_configured, can_invoke_agent, survives_parent_exit, last_successful_run; ALIVE keeps meaning process residency), a TTY waiter notice, a stale-AWAITING advisory (300 s default, doctor --stale-after), and an explicit last-known stale usage fallback.• GoRoCo versioning — CONTRIBUTING defines the Génération.Révision.Correction bump policy and the verified release sequence. • Release gate — 909 tests green on macOS and Linux (CI matrix py3.8 + py3.13), checksums verified, threat conformance 7/7, full GitHub Actions pipeline green. |
| v3.58.0 | 2026-07-12 | Open-format Agent Skills + operational hardening (RFC 050 · RFC 041 · #108 #102 #103): • Agent Skills, open format — specialist/competency definitions are agentskills.io skills ( skills/<name>/SKILL.md, name/description frontmatter, M8Shift lane properties under namespaced metadata: keys); two seed specialists ship — an advisory security reviewer with a bundled report template and a mutating worktree implementer carrying an explicit foreign-loader safety contract — with no executable payloads.• Advisory skills validation — doctor gains bounded fail-open skills.* findings over a conservative stdlib frontmatter subset; valid-but-unsupported YAML degrades to one whole-file unvalidated info finding, and skills findings never gate --lint.• Host wake-up guard — born from a live stalled-handoff incident: the generated stanza floor and agent pack now state that waiters detect but never launch, teach the poll / waiter / listener / chat-wait vocabulary, require a listener-status check before any autonomy claim, and mandate disclosing when a human must reactivate the agent. • Deterministic shift demos — four tiny two-agent exercises with pinned oracles (checksum, exactly-one-red test, spec-to-test, adversarial refutation) runnable in minutes, with an executed-quickstart anti-rot pin. • Opt-in tokscale spend adapter — local spend aggregation through a bounded tri-state token reader (a known zero is data; summary-plus-breakdown never double-counts), local_estimate provenance, no invented windows, and a hard never-submit boundary so usage data never leaves the machine through M8Shift.• Release gate — 886 tests pass (1 skipped), checksums 14/14, generated docs no drift, adversarial RC review performed from an isolated copy, dogfood relay promoted to the tagged engine. |
| v3.57.0 | 2026-07-11 | RFC 049 + RFC 052 complete; live usage path hardened (#101 #104 #105 #106): • Holder liveness — protective heartbeat beats are separate from audit-only TTL refreshes; stale recovery is two-phase and refuses a fresh live holder unless a human-authorized override is audited.• Managed listener liveness — a live child gets protective beats and an early claim --refresh, without direct relay writes, plain claims, or force-steals.• Worktree ownership guard — ownership sidecars, explicit audited takeover, per-id locks, generation nonces against ABA, and a durable takeover ledger complete RFC 049 PR C while keeping the guard honestly advisory. • Unified multi-window usage — status / watch show every plausible provider window with consumed percentage and reset, field-level degradation, deterministic caps, and the unchanged single-window fallback.• Live-hardened provider adapters — Claude accepts the verified five_hour / seven_day used-percent shape with aware reset normalization; Codex keeps app-server stdin open and reads through a bounded daemon-thread deadline, including silent-live-child protection.• Project compartmentalization complete — confidential out-of-repo denylist + scrub hooks, opt-in anchor hygiene, and mechanical one-project session binding ship RFC 052 PR2–PR4. • Release gate — 853 tests pass (1 skipped), checksums 14/14, generated docs have no drift, and the dogfood relay itself was upgraded through m8shift.py update. |
| v3.56.0 | 2026-07-08 | RFC 040 Phase 4 + RFC 052 PR1 (#100 #101) — usage-provider adapters and project compartmentalization: • Default usage-adapter scaffolds — usage init now ships four disabled-by-default provider adapters (claude-jsonl-scan, claude-quota-keychain, codex-jsonl-scan, codex-ratelimits): inert until explicitly enabled, no-clobber, identity-pinned.• Claude Keychain OAuth reference adapter — reads the Claude Code OAuth token from the macOS Keychain (or an explicit file override) entirely in memory and emits only an official fixture ( used_ratio / resets_at) — never the access/refresh token, account identity, or raw response body; no plaintext credential default on non-macOS; fail-open on every error path (malformed response, broken stdout, arbitrary-precision overflow, any exception → empty official fixture, never a crash or a leak); per-window resilient, so one malformed window never discards good readings.• Validation & contract tests — a test-hardening slice pins the Phase-4 privacy / fail-open / disabled-by-default guarantees; the merge gate used mutation testing — every contract test proven to fail when its behavior is broken. • doctor --hygiene / --hygiene-only (RFC 052 PR1) — a raw-read lint flags real home paths in tracked docs and examples (placeholder-aware; high-confidence hits gate under --lint), and the agent-guidance floor gains a compartmentalization rule: a fact learned in one project keeps its identity there; cross-project reference is deny-by-default.At this release point, codex-ratelimits was still a disabled scaffold; its verified implementation followed in v3.57.0. |
| v3.55.0 | 2026-07-08 | Token consumption display + runner artifact refresh (#59 #60): • Token consumption in the usage line — the read-only core advisory shows raw consumption ( used <count>/<window>, humanized P/T/B/M/k, bounded window count) alongside or in place of the ratio; still echo-only and byte-identical when no usage sidecar is present.• update refreshes installed runner artifacts (RFC 048) — the new default runner component refreshes installed scripts/watch-status.sh / examples/headless_runner.py from a newer source, gated by sha256-proven .m8shift/kit.json metadata: never creates absent runners, never blind-overwrites edited/untracked ones, refuses symlinked/non-regular targets or root-escaping real paths.• Preflight diagnostics — doctor --source emits read-only runner.stale / runner.manual_review_required; watch-status.sh carries a lockstep-tested M8SHIFT_RUNNER_VERSION marker.• Review gate — implemented by Codex, adversarially reviewed by Claude: five findings (HIGH path-confinement, MEDIUM non-UTF-8 backup crash, three LOW) fixed before merge. |
| v3.54.0 | 2026-07-07 | RFC 051 — usage advisory in the core display (#55): • Read-only usage line — core status / watch (and watch-status.sh) render the last recorded per-agent snapshot from the companion's local sidecar; the quota picture is visible where a human watches.• The core computes nothing — it echoes recorded bytes; no adapter run, no socket, no companion spawn. • Hardened reader — TOCTOU-safe ( os.open O_NOFOLLOW/O_NONBLOCK + fstat), bounded, agent-validated, output-sanitized (no ANSI/control escapes, never a non-finite number), byte-identical when no usable snapshot exists.• Review gate — design + implementation adversarial review caught real defects (non-string timestamps, huge-integer ratio overflow, a sidecar-swap TOCTOU) before merge. |
| v3.53.0 | 2026-07-05 | RFC 040 Phase 3 — real, opt-in usage adapters (#47; framework shipped in v3.48.0, data made real with no core change): • Slice 1 — additive per-window used_ratio, so a remaining-percent source is never encoded as tokens.• Slice 2 — built-in opt-in jsonl_scan of local agent-session logs: aggregate-only (never message content), bounded (files/candidates/bytes/mtime/wall-clock), version-tolerant, symlink-safe; a spent/reporting source that never gates.• Slice 3 — argv-only operator OAuth example mapping a remaining-percent endpoint to used_ratio (M8Shift never opens the socket; fail-open; credential never printed) + a disabled claude-quota scaffold.• Slice 4 — opt-in budget.json bridge so a spent scan can gate as local_estimate (never official, never overrides, fail-safe on malformed input).• Review gate — adversarial review per slice; real bad-shape defects (NaN, content-recursion, unbounded scan, malformed credential/budget, ratio overflow) fixed before merge. |
| v3.52.0 | 2026-07-05 | Multi-OS core install (#24 #42 #43): • Two installers in lockstep — install.sh (macOS/Linux/WSL/Git Bash) and install.ps1 (native Windows), with structural static parity tests executed where pwsh exists.• Minimal, honest core install — Python 3.8+, a download path, write permission, SHA-256; no sudo, no PATH mutation, no daemon; capability detection prints one honest line per optional helper. • Helper containment — opted-in helper failures never abort the core install (contained, warned, init runs, exit 0); --dry-run prints the plan even without Python.• doctor --install — read-only post-install verification (Python floor, core presence, manifest validity/drift, companion status; optional-absent is info).• Manifest coverage — checksums cover every shipped companion; mixed companion-update outcomes fold to partial with per-companion JSON rows and a fixed audit gate. |
| v3.51.0 | 2026-07-05 | Guidance batch — evidence & shared-state disciplines (#22 #23 #25): • Raw-proof rule (protocol core) — compressed or filtered views (digests, packs, adapter output, summaries) are orientation, not proof; proof-bearing claims are verified against raw originals. • Shared-checkout rule (protocol core) — destructive git ops like reset --hard need explicit human authorization; a refused checkout is a signal, not an obstacle; both rules fit the hard 2000-proxy-token core budget.• Workspace advisory — doctor --source adds an info-level workspace.dirty_worktree finding before updates land generated writes.• Memory-parasite audit — the agents-guide gains the recurring contributor process: workarounds memorized by operating agents mask product gaps — audit, classify, convert to issues. |
| v3.50.1 | 2026-07-04 | Hotfix from v3.50.0 dogfooding: • Best provable baseline — long-lived relays can keep an old M8SHIFT.md banner while their installed script is current; update now uses the best provable baseline among kit metadata, banner, and target script, so a stale banner no longer vetoes a supported manually-promoted relay; truly pre-3.41 targets still refuse. |
| v3.50.0 | 2026-07-04 | RFC 048 PR B — source-driven local update: • update --target DIR --source DIR — run the new source copy; it refreshes protocol, agent pack, anchors, installed companions, then the core last.• Safety envelope — preserves M8SHIFT.md byte-for-byte, verifies source checksums when present, refuses downgrade / unsupported baseline / active WORKING_* by default.• Auditability — bounded update audit rows + doctor --source update recommendations. |
| v3.49.0 | 2026-07-04 | RFC 048 PR A — adoption discipline pack + health diagnostics: • Generated agent pack — init now generates M8SHIFT.agent-pack.md; anchors keep a compact mandatory safety floor.• Health diagnostics — doctor reports missing/stale/invalid packs and stale stanzas.• Safe repair — init --force-generated repairs only corrupted generated pack blocks without resetting the relay. |
| v3.48.0 | 2026-07-04 | RFC 040 Phase 2 — AI session usage monitoring: • Read-only usage snapshots — argv-only bounded adapters, append-only ledger, fail-open unknown.• Cooperative guard/watch/wait/resume — holds only through the core cooldown with the provider's own resets_at; own-WORKING advisory, peer-WORKING advice-only, explicit-only resume.• Outcome — an unattended lane can hold through a quota window instead of dying silently. |
| v3.47.0 | 2026-07-04 | RFC 047 complete — listener lifecycle companion: • One-command supervised lane — listener start; zero model spend while polling, one bounded turn per wake, --resume-working gated stuck-retry.• OS backends — launchd/systemd/schtasks with safe local fallbacks (macOS protected-folder detection); persistent halted honored across service managers.• Observability — writer-side log rotation and nine listener.* doctor findings. |
| v3.46.0 | 2026-07-04 | RFC 047 Phase A — headless runner final-state enforcement: • Authorship-primary classification — a provider turn ending while the relay is open is non-completion, not success; total post-run classification. • Refresh-only heartbeat guard — claim --refresh (TOCTOU closed); exit map 0/1/2/3/4 and run.non_completion events.• Self-documentation — detailed --help on every parameter (v3.45.1, AST coverage guard). |
v3.45.0 | RFC 046 part 1 — execution modes & project identity: status and watch now surface the project name, cwd, and relay root (human output, --json, and the watch banner), so multiple open terminals or tabs stay distinguishable; the label prefers the operator's init --name (persisted on the session start event) with a folder-name fallback, cwd is the real working directory and root the relay root; the status-guard rule moves into the generated protocol core (every anchor + M8SHIFT.protocol.md): never claim you hold the pen or reached DONE from memory — re-run status before ending a turn; the agents-guide adds the interactive-vs-headless distinction and the interactive honesty message. | |
v3.44.0 | RFC 044 companion install + RFC 045 module reference: init gains a version-locked companion-install phase (--companions runtime,context,..., --with-runtime and friends, --full, --companion-source <dir>) that copies companion scripts version-locked to the core — idempotent, no-clobber (never downgrades, refuses edited or newer files), atomic, preflighted before any mutation — with a merged .m8shift/kit.json manifest and read-only doctor kit findings; docs/en/modules/ adds one reference page per shipped script (7 modules) with color Mermaid ownership diagrams, command tables, tagged safe examples, and a version-literal drift test. | |
v3.43.0 | RFC 037 Phase D — Headroom/Kompress adapter now bundled + active: install.sh --with-headroom builds a pinned native-arch venv (headroom-ai==0.28.0 + onnxruntime==1.27.0 + transformers==5.12.1), preloads chopratejas/kompress-v2-base, and identity-pins the m8shift-headroom launcher; compress --backend headroom_ext yields ~45–55% real offline Kompress reduction on prose (errors on shell); auto stays on the builtin digest until the Phase D gate. | |
v3.42.0 | Security hardening: case-insensitive-FS fix so a case-variant of a project-local adapter bin dir on PATH can no longer bypass the --allow-project-local-adapters opt-in (#94); CodeQL host-parse fix; RTK telemetry hardening; agents-guide coordination discipline (stale-lock / force-claim / worktree isolation). | |
v3.41.0 | RFC 042 Phase B + #91: compression records now store access_mode / whole_content advisory routing signals without opening signal-driven Headroom routing; the v3.40 manual headroom_ext opt-in is preserved; retrieve verifies raw and compact hashes before serving evidence; architecture/spec docs add color communication and agent-flow diagrams. | |
v3.40.0 | RFC 037 Headroom follow-up: broad contexts now stay on builtin in auto unless backends.headroom_ext.auto_enabled: true; explicit --backend headroom_ext remains available as a different, opt-in compression experiment. | |
v3.39.0 | RFC 037 Phase D — optional Headroom backend hook: added the identity-pinned headroom_ext adapter contract and safe degradation for absent, unpinned, failed, or drifted backends. | |
v3.38.0 | RFC 037 Phase C — backend dispatch + RTK: m8shift-context.py compress records requested/actual backend/version, uses identity-pinned rtk-shell-output for shell/tool content types, and fail-closes explicit backend errors to reference-only. | |
v3.37.0 | RFC 037 Phase B — local compression records: redacted raw refs, compact digests, builtin stdlib compressor, bounded retrieve, secret-pattern hardening, and reference-only fail-safe for bad config/backend paths. | |
v3.36.0 | RTK visibility (#79): you can now see whether token compression is active — per-agent self-declared M8SHIFT_RTK in status-runtime, and the context adapter's pinned/native state (RTK: ON (pinned, compressing packs) / RTK: OFF (native)) with the last-pack ratio in status-runtime, doctor, and the new m8shift-context.py status. Read-only, advisory, fail-closed to OFF; no network, no telemetry re-enable, self-declared only. | |
v3.35.0 | RFC 039 Phase 1 — model/task routing (#59): an advisory route recommend that picks the cheapest capability-eligible model for a task (tier floor + required capabilities + context window), fail-safe when the self-model is unknown — recommendation only, never launches anything. | |
v3.34.2 | Retention path hardening (backslash-normalised denylist + O_NOFOLLOW/symlink refusal on runtime writes) and the full colour module map of core + companions in the architecture docs. | |
v3.34.1 | RTK corrupt-manifest auto-fallback: a broken/non-object adapter manifest degrades a default pack to native packing instead of aborting — fully-degrading by design. | |
v3.34.0 | RTK is the default context-pack filter when identity-pinned (never on PATH alone), with an install offer (consent) and rtk telemetry disable on setup — token compression on by default, safely (RFC 034). Mandatory agent rules: RTK token-economy, the decision template, and the issue templates. | |
v3.33.0 | RFC 028 headless command templates: curated argv-only provider examples, a run-plan validator, an env allowlist, and post-run LOCK verification — a curation layer over RFC 014/020, no new launcher. | |
v3.32.0 | RFC 027 local notifications companion: tiers 0–4 (stdout · prompt file · TTY bell · OS presets · argv-only operator hook), dedup window, and an audit log — advisory, no daemon, no network. | |
v3.31.0 | RFC 031 tool-independent decision traceability: forge / GitHub / git or a markdown ADR fallback, decisions target/scaffold, and an advisory append --stance — decisions are never lost, whatever the tooling. | |
v3.30.0 | init manages the host project .gitignore with a marker block (consent + --gitignore/--no-gitignore) — relay state stays local, and the agent anchors are left for the operator to decide. | |
v3.29.0 | RFC 026 configurable retention policy: per-ledger fixed-count / age / combined-union strategies, archive + audit index, fail-safe on undatable rows — opt-in and fully-degrading. | |
v3.28.1 | Self-declared Agent-Model provenance: M8SHIFT_AGENT_MODEL → a commit trailer stamped alongside Coordinated-With, fail-open and independent of the relay version — the forge history shows which model produced each commit. Non-UTF-8 commit-message fail-open fix. | |
v3.28.0 | Native context companion (m8shift-context.py): referenced context packs, receipts and metrics, plus an identity-pinned RTK shell_output_filter adapter — verified fail-closed against renamed/wrapper/PATH-hijack execution (RFC 034). PAUSED-aware wait: the listener stays armed, quiet, and wakes on resume (RFC 035). Runtime headroom guard m8shift-runtime.py headroom with tiered proxy signals (RFC 036; unrelated to the external Headroom adapter). Bounded git() collector timeout. | |
v3.27.0 | Doctor/status split: core-safe doctor versus runtime companion diagnostics (RFC 024); runtime status composed over presence/progress/inbox/run sidecars (RFC 025). | |
v3.26.0 | Bounded runtime sidecar retention with m8shift-runtime.py retention prune --keep N; archives older JSONL rows by default while leaving the core relay untouched. | |
v3.25.0 | Immutable headless run plans and post-run LOCK verification. | |
v3.24.0 | Runtime no-progress detection for companion loops. | |
v3.23.0 | Runtime lane ownership: one fresh managed runtime per agent identity, explicit stale takeover. | |
v3.22.0 | Runtime sidecars for presence, run lifecycle, progress, operator inbox, idempotency, approvals, reports, and diagnostics. | |
v3.21.0 | doctor --lint core-safe diagnostics, including relay/LOCK validity, anchors, protocol drift, sessions, duplicate open sessions, and livelock indicators. | |
v3.19.0 | Token-footprint split: small mandatory protocol core plus on-demand reference. | |
v3.18.3 | Session reports and decision ledgers generated from existing turns. | |
v3.17.0 | Stable PAUSED state for open sessions with no active work, plus explicit resume. | |
v3.16.0 | Provider registry, runtime scaffold, and hardened headless runner surfaces. | |
v3.15.0 | Runtime companion v1 and cooperative turn request / steering commands. | |
v3.13.0 | Stage-4 contract validation: contract validate, doctor --contracts, dedicated contract flags on append, headless runner run IDs/lifecycle events, updated checksums, and documentation alignment. | |
v3.12.1 | Timezone-prefixed human timestamps (CEST 2026-…, fallback local), Windows PowerShell installer, checksum refresh, FAQ expansion, release/install docs, worktree toolbox links, and site documentation refresh. | |
v3.9.0 | Relay loop guardrails: next, status --for, append --wait, plus the next --force live-lock refusal fix. | |
v3.8.0 | Session history and human local-time display next to UTC. | |
v3.7.0 | doctor, session history groundwork, version lockstep across distributed scripts, test rename, runtime/session RFCs, and documentation hygiene. | |
v3.5.0 | Opt-in m8shift-worktree.py companion: isolated git worktrees for parallel feature work and one serialized integration pen. | |
v3.4.x | Task ledger, version stamp / --version, runner and claim-check review fixes, and audit cleanup around N-agent documentation. | |
v3.3.0 | claim --check, a read-only advisory overlap probe for files touched by other agents. | |
v3.2.0 | Shared memory via remember, durable notes, and recap headlines. | |
v3.1.0 | Advisory turn fields on append: branch, commit, tests, next, blocked-on, and custom x_* fields. | |
v3.0.0 | M8Shift-only rename, English core, injectable language packs, and localized build tooling. | |
v2.4.0 | Stage-2 N-agent relay: configurable roster and directed handoffs to any active agent. | |
v2.3.0 | Read surfaces: recap, peek, log, and status --json. | |
v2.2.x / v2.1.x / v2.0.0 | M8Shift rebrand phases, technical rename, backwards-compatible transition, i18n EN/FR, and public repository layout. | |
v1.x | Original relay protocol: claim-before-work, exclusive pen, canonical anchors, bridge files, and early VS Code/user documentation. |
Roadmap stages
| Stage | Status | Delivered | Remaining / boundary |
|---|---|---|---|
| Stage 1 — Relay foundation | available | Local passive CLI; single shared pen; claim-before-work; immutable turn journal; atomic writes and inter-process lock; stale-lock recovery; configurable agent pair; generated anchors and protocol. | Core invariant: one writer at a time. |
| Stage 2 — M8Shift core | available | m8shift.py CLI; generated files M8SHIFT.*; anchors; documentation; tests; this website. | The core remains a portable single-file relay. |
| Stage 3 — N-agent directed relay | available | N-agent roster; directed handoffs to any other roster member; structured advisory turn fields; shared memory; task ledger; recap; peek; log; status JSON; session history; loop guardrails via next, status --for, and append --wait. | Coordination is cooperative and advisory; agents still need to follow the protocol. |
| Stage 4 — Contracts and validation | available | Advisory branch/commit/tests/next/blocked fields and custom x_* fields; claim --check; typed Stage-4 contract fields on append; read-only validation via contract validate [--strict] [--json] [--all] and doctor --contracts. | Validation never routes work, grants permissions, runs tools, or mutates the LOCK. |
| Stage 5 — Isolated concurrency | companion available | m8shift-worktree.py for branches/worktrees per task; serialized integration pen; status, claim, done, integrate, and drop operations; RFC 049 PR C ownership sidecars, explicit audited takeover, per-id locks, generation nonces, and durable takeover ledger. | True degree > 1 writes in one shared working tree remain rejected for the core; isolated worktrees are the supported parallelism model, and ownership remains an advisory companion guard rather than a filesystem security boundary. |
| Stage 6 — Integrations | shipped | Local integration layer: install scripts; checksums; verify-by-default; watch; site/docs sync; reference headless runner with --once, M8SHIFT_RUN_ID, immutable run plans, post-run LOCK verification, and .m8shift/runtime/runs.jsonl lifecycle events. Runtime companion surfaces include providers, roles, workflows, approvals, reports, status-runtime, doctor, progress, operator inbox, lane ownership, bounded retention, managed listeners with protective liveness, and disabled-by-default live-verified usage adapters. | Companions are advisory: no second pen, no direct M8SHIFT.md edits, no network requirement in the core, and no auto-force or automatic resume. Release artifacts and package distribution remain convenience layers around the single-file core. |
| Post-Stage-6 / future companions | deferred | RFC-governed direction only; not part of the passive core today. | IDE recipes/panel; read-only MCP adapter; orchestrator recipes (partly realized since v3.61.0 by the RFC 072 fleet manager in the runtime companion); optional local notifications; hosted/runtime control plane; headless command templates; richer companion workboard. |
RFC status discipline
RFC numbers are permanent creation-order identifiers. They do not track implementation order; for example RFC 010 shipped last because it is a retained/rejected/deferred pattern filter.
RFC index
The full, current RFC catalogue — 001–053, with per-RFC shipped/draft status and the version each shipped in — lives in the RFC reference (single source of truth). This roadmap previously duplicated the list and drifted out of date; the duplicate has been removed to keep one authoritative table.