# Release notes

What each release brings. To upgrade, run `ade init --dry-run` to see what would change, then `ade init` in each repository.

## 0.8.0 (07/11/2026)

New:

- After an upgrade, a pilot session hears what changed in ADE since the project's last `ade init` (kept in `.ade/news.md`). Lanes do not get it, and it survives compaction for a week.
- A ruling announces itself the first time a governed file is touched, including when Bash writes it.
- The first-edit briefing names the project's test units, says when a tool rewrites a file in place, lists headed callers first and scratch last, counts a busy file's callers by folder, and lists living docs before dated records.
- `ade graph` in a lane uses that lane's own `[graph]` settings.
- `ade graph --route` draws the conductor's route as a Mermaid flowchart, looping back with the twice rule.
- Every answer on a card reaches the card's next model, and `ade decide` records who answered.
- A park asks whoever `ade.toml` says answers, and retries now; a park question names its own id; `ade conduct` parks a land question at once.
- The outcomes line says who a question was meant for, and land questions no longer say only a person can answer.
- `ade decide --ask` warns when its text names a card but `--card` is missing.
- Under `[git] push = "pr"`, land follows the landed card's PR.
- `ade init` on an upgrade says what carries over and what does not, lists kit files you edited in the old kit, and names `ade.toml` values that are only an old default, printed as `ade.toml` writes them. It also says to start the agent from the project folder.
- The generated ade skill says where things belong and shows each verb's argument shape with good and bad calls.
- Grep notes count what was acted on, not just what was read.
- The cockpit flight strip matches the Claude Code flight band. Pilots outside Claude Code, or on Remote Control, get the band in one cockpit terminal.
- Pilot guidance drops the per-stage background waits.
- A builder that ends `MET` after editing is read as done.
- Roles can pass engine-specific args, and OpenCode reviewers run read-only.
- `ade init` installs an OpenCode plugin and a Pi extension, only for projects that use those engines, so they get ADE's hooks too. ADE's hooks now cover PowerShell tools, and Codex gets the full hook set.
- `ade init` tells Codex users to accept ADE's hooks once in Codex and reports which it has not trusted yet. When the `ade` on PATH is not this kit, it says to run `ade link` so Codex hook commands survive updates.
- Pi provider lanes run a card from a prompt file, read its JSON usage and run under the OS read guard like OpenCode's; listing seats never writes a Pi prompt file.
- Every machine-read question checks its answer against one closed list and refuses anything else with exit 2, naming the valid forms (land: `land`, `rework: TEXT`, `drop`; drafted cards take `retry: NOTE`). The generated skill's answer forms come from that list.
- Run as root, a first `ade init` writes `lane_mode = "auto"`, since Claude Code refuses `bypassPermissions` as root, and warns when an existing `ade.toml` has it.

Safer:

- Land stops a lane that changed files outside its card's paths.
- The bash guard judges backtick, `eval` and `$(...)` bodies, including inside quotes.
- A reviewer's edits never override a not-ready verdict.
- A huge review prompt stops the card instead of crashing `ade conduct`.
- A new file's path warning says what it really reaches.
- A sandboxed Codex pilot is refused before the lane, with a cure that leads with the plain terminal, and the lane folder's writability is probed first.
- `ade init` no longer writes a Codex sandbox table, and uninstall takes back one an earlier init wrote.
- The bash guard judges PowerShell's delete and write forms like `rm` and redirection.
- The test stage fails a lane whose added or changed test file runs no tests.

Fixes:

- A huge diff is reviewed by summary, and the summary stays under its cap.
- A review cut off after its verdict line is retried once, and a forked review gets the handover once.
- The graph keeps files the sandbox will not stat and drops deleted ones.
- A note's named tests credit only that note.
- `ade status` and `ade cockpit` count only live cards.
- Closing a card saves and removes its lane.
- On Windows the cockpit opens its own console reliably.
- Land's PR check cannot hang.

## 0.7.0 (04/11/2026)

New:

- `ade init` installs an optional flight band for Claude Code (the `flight-band` part, copied into `.claude/skills/ade-flight-band` and git-ignored). It reads ADE's records every three seconds and draws the flying card's five stages above the prompt, with a toast when a card lands or parks. In VS Code and Claude Desktop it also opens a pane. It writes nothing to the transcript, and a Remote Control viewer sees none of it. Codex users keep `ade cockpit --follow`.
- `ade cockpit` starts with one line per card of the latest flight: stages passed, under way and not reached, or `landed SHA` or `parked: reason`.
- `ade wait stage CARD STAGE` (lane, build, review, test or land) waits for that stage of a card to finish, so each stage can be its own background task. It exits 3 when the stage, or an earlier one, ended without advancing.
- `ade loop CARD --hold-land` stops the run at land and asks a person, as a `[land] ask` path does, for that run only.
- `ade card hold CARD REASON` holds an existing open card, as `ade card add --hold` does for a new one; release it with the `ade decide --answer` line it prints.
- `ade card show` ends with one `next:` line of hops: the card's open questions, its latest saved outputs and its branch.
- `ade card add` warns when a path it names is protected, with the cure when one is configured.
- A file's briefing names every tool whose header `writes:` it, and groups the files a tool generates from it on one line.
- A header's `reads: run:PATH` (a path or glob) makes the file a caller of what it runs.
- The `ade loop` and `ade conduct` guides tell pilots to run a card in the background beside `ade wait stage` waits, and to keep the main checkout on trunk while a card flies.
- `ade config --seats` (and `[report] seats = true`, which writes a `config:` line to each call's lane log) shows per role and engine the argv, env and settings files a call gets, without spending anything.
- Role profiles: `[roles.<role>.profiles.NAME]` sets a voice, models and effort for one kind of card; `ade card add --profile NAME` picks it, and `[profiles]` can select it by glob.
- `[roles.<role>] system_prompt` names a repo-relative file added to Claude Code's system prompt. Claude lanes no longer spawn subagents unless the role sets `subagents = true`.
- `[providers.<engine>] pass_env` lists non-secret host variables a lane keeps though `scrub_env` would drop them; a key or token name is refused at load.
- A land question answered `rework: TEXT` sends the lane back to the builder with TEXT and then asks again; any other answer holds the card.
- A hold-land question names the card's paths.
- `ade conduct` ends with each card's verdict and the stops it retried for it.
- A card drafted after midday counts its veto window from the next morning.
- The pilot's brief says a denied read on a secret-like file may come from your own sandbox, not the product.

Safer:

- Every Codex lane, `bypassPermissions` included, now runs under the permission profile built from `[guards] secrets`, which denies reads of those files, turns the network on and lets the lane write its git folders. The template's Codex `modes` is now a single `default` entry. ADE has proven this guard on macOS only.
- `ade init` warns when your `ade.toml`'s Codex modes for the lane mode lack `{deny_reads}` (as one from before this change does), and prints the line to set.
- Only one `ade loop` runs per card: a second run refuses while the card's lane is in use, and takes over from a run that has died.
- Claude lanes now also drop a host session's memory stores, thinking budget, MCP settings and cache-TTL variables (`CLAUDE_MEMORY_STORES`, `MAX_THINKING_TOKENS`, `MCP_*`, `ENABLE_PROMPT_CACHING_1H`, `FORCE_PROMPT_CACHING_5M`) in the template's `scrub_env`. An `ade.toml` that sets its own `scrub_env` gets this only if you take the template's line; `ade init` names any template entries it lacks.
- A claude call with an API key set that writes 1-hour cache is marked `billing_suspect` in its usage row, with a warning on stderr that points at the [run lanes on API credits](https://atlas-ade.dev/docs/run-lanes-on-api-credits/index.md) page: the lane may have inherited a host's plan login instead of billing the key.
- Lanes never inherit a host variable ending in `_KEY`, `_TOKEN` or `_SECRET` (case-blind), except each engine's own auth variable, such as `ANTHROPIC_AUTH_TOKEN` for claude.
- A claude key that is out of credit stops the card as `provider.credit`.

Fixes:

- `ade graph` copes with a sandbox that denies reads of some files: it carries their entries over from the committed graph and says how many. Writing a new graph in that state refuses, so edges are not dropped.
- When land's catch-up with the remote trunk clashes only in the graph file, the graph is rendered anew instead of the catch-up failing.
- A lane log that another run moved away mid-call stops the card with a reason instead of a traceback.
- ADE's output no longer crashes on a console that cannot show a character (such as Windows cp1252); the character prints as `?`.
- The card lock works on Windows: ADE locks a sibling file and leaves the lock data readable.
- `ade init` writes hooks that name this kit's `ade` when the `ade` first on PATH is a different one.
- A test-tree helper (such as `tests/helpers.py`) selects the tests that import it, instead of running alone and finding none.
- A plan's usage-limit answer stops the card as capacity.

## 0.6.0 (02/11/2026)

New:

- Each role can have its own reasoning effort per engine, set beside its models. A Codex lane never inherits your own Codex effort: a role with none gets `[providers.codex] default_effort`, which the template sets to medium.
- `ade config WORD` looks up any `ade.toml` setting by word. `ade config --roles` shows each role's model and effort for every engine, with where each came from and which engine is active. `ade config --probe` tries each configured role model once, in a throwaway folder.
- `ade loop` and `ade conduct` take `--model ROLE=ENGINE:MODEL` and `--effort ROLE=LEVEL` (repeatable) for one flight, without editing `ade.toml`. Usage rows record the model the provider says it served and the effort passed.
- Codex's default model is `gpt-6.1-sol` in every role. Model ids are passed verbatim, so `gpt-6-sol` is a fixed id, not a "latest" alias.
- `[providers.codex]` can set `auto_compact_token_limit` and `context_window`; when set, Codex lanes are passed them. There is no kit default.
- `ade land` refuses a merge that leaves `ade budget` over: it puts trunk back, names each over row and its cure, and pushes nothing.
- `ade budget` counts a `test functions` row against `[budgets]`, and `ade budget --tests` names tests that went red on two cards where nothing they guard broke.
- `ade rehearse --coverage` lists every verb and parts switch that no scenario runs; land notes it and never blocks on it.
- With `[tests] fail_proof = true` (off in the template), land puts the card's changed code files back from trunk, reruns the card's changed tests, and records whether they fail without the change.
- Builders are told to keep going until the done line is met, and are told when the test cap is full so they replace a test instead of landing code untested.
- `ade land CARD --catch-up` stops and names the card when another pushed card branch is stacked on this one, so the lower branch is not taken out of the stack.
- Every `ade conduct` run gets a flight id (f1, f2, ...), shown with its card and calls in the cockpit and telemetry.
- `ade card add` prints the co-moves of the paths it names, as the edit brief does.
- `ade init` writes a generated ADE skill and an AGENTS.md "Using ADE" section, so a fresh agent learns ADE unaided. The role block names no model; run `ade config --roles` for those.
- The graph reads Go, Rust, Java/Kotlin, C# and C/C++ as well as Python and TypeScript/JavaScript, and the template's test globs match those languages' usual test files.
- `[usage] unit` picks how usage reads: `dollars` (the default), `meter` or `plan_dollars`. The meter model comes from `[usage] meter_model`, and `[usage] plan` and `plan_price` let `plan_dollars` convert shares into your plan's weekly price.
- Claude's shares are an estimate, labelled as lanes only, and sit beside the real week reading when one exists.
- Codex's shares are measured from the jumps in its own meter.
- `ade card paths ID --path P` (repeatable) replaces an open card's paths.

Fixes:

- Graph header paths keep spaces and `+`: entries split on commas, and a path may be backquoted.
- A header missing only `writes:` still makes its `reads:` edges, and any other partial header is reported by `ade graph` instead of dropped silently.
- `ade handover` lists only open cards under "Open cards".
- When land's catch-up with the remote trunk fails, it says which: the conflicting files, or the red test command's last line.
- A park question of a card that has landed or been closed no longer lingers in `ade decide`, the status line, the cockpit or briefings.

Removed:

- `ade observe`. Old observation rows still read without error.

## 0.5.0 (02/11/2026)

New:

- opencode lanes run inside an OS read guard that hides your `[guards]` secrets files, and the template turns it on by default. The guard runs on macOS, and on Linux only when bwrap is installed; `ade init` says when there is none.
- Rulings can be imported once from a file, retired with a recorded reason (and the ruling that replaces them), and read in full with `ade decide --show ID`. An answer to a retired ruling is refused.
- Briefs and the handover list the rulings that govern the paths at hand first, one line each. Builders and reviewers get your project's voice for their role.
- `ade card close` closes a card with a recorded reason, and a builder can close a card whose done line is already met.
- A card can be added held, with its reason and what releases it, and the cockpit shows it as held.
- `ade status` lists open lane worktrees with their age and whether they are dirty.
- `ade cockpit --follow` redraws the board live, and `ade session attach NAME --follow` waits for the next run of that session.
- `ade land CARD --catch-up` brings a pushed but unmerged card branch up to date with the remote trunk, whatever `[git] push` says.
- Briefs name the file generated from the one you are changing, and `ade card add` warns about a path that matches no tracked file.
- `ade status` shows how many grep notes were followed by a Read of the noted file.
- Interactive `codex` in the main checkout gets the same grep graph notes as Claude once the hook is trusted, which takes running `codex` there once (`ade init` writes `.codex/hooks.json`). Codex lanes get none, and `ade init` says so. ADE never passes the hook-trust bypass flag.

Safer:

- Claude and Codex lanes deny reads of your `[guards]` secrets files, except the ones you list in `secret_ok`, which stay readable in Claude lanes (Codex lanes deny them too). Windows drive and UNC paths count as absolute.
- A card whose id was renumbered on another machine is never resolved to the wrong card without saying so, and a renumbered card is found again by its title, paths and done line.
- A silent engine stops at a stall bound well before its timeout, and a timeout kills the engine's whole process group.
- opencode lanes stop at a 15-minute stall bound, now that its json output is known to stream.
- `ade push` sends only the records branch and tags under `[git] push = "pr"`, and lanes leave the records branch to `ade`.
- `ade init` warns when Codex runs in bypass lanes, and when the hooks run a different `ade` than the one `init` wrote.

Fixes:

- On Windows, an engine call's leftover processes end through a Job Object, and a dropped card's patch applies.
- A landing cut off before its push ships on the next `ade land`, and a landed card is re-shipped only while the remote trunk lacks it.
- A pull-request landing deletes remote card branches that the trunk already contains.
- A review patch that does not apply is kept whole, patches in Codex's own form apply, and a review patch never moves the generated graph.
- Review edits made in the lane regenerate the graph.
- The test stage regenerates a stale graph instead of stopping.
- An open question without a deadline no longer crashes its readers.
- The week meter says API key instead of not reported.
- `ade budget --refusals` now also counts refusals that were only printed before: a refused records push while opening or catching up a pull request, and a lane whose session name is already taken when `ade conduct` starts it. Refusal rows now go on the records branch, so the counts survive a lost state folder and add up across machines; a refusal that cannot be backed up still blocks as before.

## 0.4.0 (31/10/2026)

New (each is off until you set it in `ade.toml` or ask for it):

- `[land] ask` lists paths that land only on a person's answer.
- `[review] engine = "opposite"` has the other engine review a lane.
- `[conduct] follow_stop` and `cap` let a run go on unattended and stop at a spend cap.
- Proofs: `ade card add --proof` adds a command that land runs on the merged main; `ade card show` shows it and drafts write it as PROOF lines.
- `ade graph FILE` shows what the graph knows about one file.
- Test commands may use `{paths}`, `{base}` and `{tip}`.
- `[graph]` blessed helper folders are reused by the briefing and the builder.
- `[review] fork` forks reviews from one warm parent a day.
- Claude lanes stream events, so `ade watch` shows progress.
- Lanes say whether they bill a login or an API key.
- The home screen and a bare `ade decide` say what to do next.

Safer:

- Land stops a lane that changed a protected path, whatever wrote it, or its own `[tests]` table.
- The bash guard refuses deleting the trunk or tags, and reads each part of a chained command.
- `lane_mode` sets Codex's sandbox too.
- A builder must say DONE, or the card stops.
- A test changed without its code, and literal pins, are noted at land.
- Usage rows stay on the machine.

Fixes:

- An engine timeout or capacity answer is a retried stop, not a traceback.
- A landing whose only conflict is `graph.json` regenerates it.
- A landing cut off after its merge finishes on rerun.
- Header reads and writes may name globs.
- A test that names a file by path reaches it.
- A hanging test fails red, and a failed stop names the failing tests.
- Review patches with miscounted hunks apply.
- A closed pipe ends `ade` quietly.

## 0.3.0 (30/10/2026)

- Two lanes at once.
- `ade card draft`.
- `[git] push = "pr"`, with remote catch-up.
- `ade digest`.
- `ade conduct --follow`.
- Park questions.
- First-run setup.
- The opencode engine.
- The neighbour check and the draft rehearsal.

## 0.2.0 (28/10/2026)

- `ade conduct --lanes` and `ade card list --free`.

## 0.1.0 (27/10/2026)

- First release: portable downloads for Linux, macOS and Windows.