[lukemaj]

What changed: AgentsMD 17.3.0 bundles five reviewed outcomes from the 2026-10-18 backlog clearing. Delegated "not possible" results need a failed challenge, and filed work leaves the turn with an owner (#226). Retiring another agent's worktree needs that agent idle, or a handoff to it (#230). The Elon gate stops misreading patch data and now covers gh api creation (#225, #226). Three routing rows name the action they guard (#164). The instructions say harness and machine instead of host, and --harness is added with --host kept as an alias (#213).
Why: These were discussed and decided Issues left stale, plus two gate defects found in real use.
So what: Merging this PR is the publication step. The push to main changes VERSION, so the release workflow tags v17.3.0, creates the GitHub Release and wakes the Marketplace, which promotes it through Toolybara. That is a Human Gate for the user: everything is prepared, nothing is published. Reviews on f27a862 all passed: Opus final train review (high) ready, Luna pass, Grok roast pass. CI is green.

Fixes #226
Fixes #230
Fixes #225
Fixes #213

Part of #164 (its re-measurement one week after release stays open).

Component map

Component PR	Issue	Head merged into the train	Review
#232 (supersedes #227)	#226	7ebd013	Luna pass; content byte-identical to 9672e94, which Sol and Grok passed on #227
#231	#230	2da6d73	Luna fail r1 (same-step retirement), fixed, Luna pass r2
#233	#225, #226	db497bc	Luna pass r1, r2; Grok fail r1 (--input bypass), fixed, Grok pass r2
#240 (supersedes #200)	#164	bd20051	Luna pass; frozen Grok rerun P1 to P4 pass
#239	#213	fea4653	Luna pass (note: conflicting alias values, last wins); Grok pass

The version commit f27a862 adds only VERSION, the five mirrors and the CHANGELOG entry.

Elon record

• Requirements and who asked: The user, via Gavin (2026-10-18 23:10 and 23:20 Warsaw), asked to clear AgentsMD's discussed backlog without needing them, with merge approval for that work and publication kept as a Human Gate. Each component's requirement and owner is on its Issue.
• Deleted: Separate releases per component. Each would have published on merge, so they were integrated unversioned. Also the turn-end owner hook from Delegated "not possible" results reach the user unchallenged #226: its design file was lost and it needs a Chromeria Issue first, so it moves to Turn-end hook: warn when filed wanted work leaves the turn without an owner #243 (blocked).
• Bottleneck: Publication. Merging any version change to main publishes, so the train waits here for the user.
• Checked myself: Every component's review status creator and exact head before merging it into the train. The --input semantics against gh api --help. The Grok rerun records, via Luna. The full suite on fix: keep patch data out of the Elon gate and gate gh api creation (#225, #226) #233's head myself. versionctl doctor --ci --base origin/main is valid (17.2.0 to 17.3.0), and release-check passes at f27a862.

Proof

• tools/versionctl/bin/versionctl release-check --sha f27a862082061e985dffe4a863b824e467bab389: release candidate OK, v17.3.0.
• versionctl doctor --ci --base origin/main: transition valid, no bump required.
• Full suite on f27a862: 444 + 7 tests OK (AgentsMD 17.3.0: backlog train (#226, #230, #225, #164, #213) #242 (comment)), rerun by the final reviewer.
• Final train review (Opus, high): ready, AgentsMD 17.3.0: backlog train (#226, #230, #225, #164, #213) #242 (comment). Luna: pass, AgentsMD 17.3.0: backlog train (#226, #230, #225, #164, #213) #242 (comment). Grok roast: pass, AgentsMD 17.3.0: backlog train (#226, #230, #225, #164, #213) #242 (comment).

Follow-ups from the final train review: #243 (owner hook), #244 (README and Muse docs still describe the gate as gh issue create / gh pr create only), #245 (user decision on MISSION.md "compatible hosts").

Website impact: unverified. Code search on toolboxmd/toolbox.md returned no results for any term, so the /agentsmd pages could not be checked for "host" wording. A narrative update may be needed.

Live verification: pending the user's normal use after release.

🤖 Generated with Claude Code

[lukemaj]

Proof on f27a862 (coordinator, bestia, 2026-10-19 03:55 Warsaw):

• python3 -m unittest discover -v -s tests -p 'test_*.py': Ran 444 tests in 143.5s, OK. An earlier non-verbose run was stopped by a 30-minute background limit under load average about 50; the rerun found no hung test.
• python3 -m unittest discover -s tools/versionctl/tests -p 'test_*.py': OK.
• versionctl release-check --sha f27a862: release candidate OK, v17.3.0.
• versionctl doctor --ci --base origin/main: transition 17.2.0 to 17.3.0 valid.

[lukemaj]

Final train review: Opus (claude-opus-5-5, high) on f27a862

Verdict: ready. The candidate has no blocking finding. Before merging, the user decides one linkage point (note 1). The other notes are documentation follow-ups.

What I checked

• I read the full cumulative diff 2f04c90..f27a862 (56 files), the PR body and comments, Issues Delegated "not possible" results reach the user unchallenged #226, Finalization: confirm the owning agent is idle before retiring its worktree #230, Elon hook treats command examples in patch data as execution #225, Say harness for the agent program and machine for the computer #213 and Procedure trigger audit: measure which operations procedures fire, then fix the worst #164 with their comments, and PRs wip: carry #226 negative-result gate onto integration train #232 and Accept a delegated negative only after one failed challenge #227 with their reviews.

• Merge integrity: all five train merges have an empty git show --remerge-diff, so no conflict was resolved by hand. f27a862 touches only VERSION, the four plugin.json files, tools/versionctl/pyproject.toml and CHANGELOG. The newest review/independent status on each component head (7ebd013, 2da6d73, db497bc, bd20051, fea4653) is success, posted by lukemaj.

• Cross-component interactions:

  • wip: carry #226 negative-result gate onto integration train #232's new orchestration and bounded-delegation text and fix: confirm workspace writer is idle before retirement #231's finalization text contain no "host". The finalization text says "harness's thread or task status", which keeps the Issue's meaning.
  • Port action routing triggers and frozen Grok evidence (#164) #240's routing rows contain no "host".
  • test_instructions_say_harness_for_the_program_and_machine_for_the_computer passes on the combined tree. A git grep -iw 'hosts?' over bin hooks opencode evals skills (prototype UI excluded), the manifests, README.md and docs/*.md finds only the --host alias.
  • In fix: keep patch data out of the Elon gate and gate gh api creation (#225, #226) #233's gate code, --hostname is correctly left unrenamed. It is gh's own flag, not a harness flag.

• Core global/AGENTS.md: four wording-only edits (harness's link, --harness, "setup and harness limits" with the #install-boundary anchor still present, Persistent Machine Automation and machine service). No rule's meaning changes, and the ADR path stays as Say harness for the agent program and machine for the computer #213 decided.

• Installed callers:

  • hooks/muse/_adapter.py:58 and opencode/agentsmd-project-direction.js:83,133 still pass --host, and hooks/hooks.json passes no flag.
  • argparse maps --host to the same harness destination, and AGENTSMD_HOST is unchanged.
  • No other toolboxmd checkout imports agentsmd_instructions or its renamed HOSTS/host= names.
  • Mixed versions work in both directions: the clone's core points at the clone's own bin, and old instructions still pass --host.

• Elon gate: I sent 18 adversarial PreToolUse events, each with both --harness claude and --host claude, and got 0 mismatches. Blocked (exit 2), with and without -X POST:

  • gh api posts to repos/o/r/issues
  • --method=POST, -XPOST
  • {owner}/{repo} placeholders
  • a full https://api.github.com/... URL
  • ?query
  • a global --repo flag before api
  • a missing --input file
  • commands chained after &&
  • exec_command gh issue create

  Allowed (exit 0):

  • a body with the record
  • GET
  • statuses, issues/N/comments and PATCH issues/N
  • apply_patch and functions.exec patch envelopes that contain gh pr create or gh api examples

• Version: minor is right, because --harness is a new compatible capability and the rest is wording plus a stricter gate that enforces an existing rule. The mirrors agree on 17.3.0, and the CHANGELOG lists every shipped outcome accurately.

Proof rerun (temporary clone at f27a862)

• python3 -m unittest discover -s tests -p 'test_*.py': Ran 444 tests in 1813.978s, OK.
• python3 -m unittest discover -s tools/versionctl/tests -p 'test_*.py': Ran 7 tests, OK.
• versionctl release-check --sha f27a862...: release candidate OK: v17.3.0.
• git diff --check 2f04c90 f27a862: clean, and the diff adds no em dashes. CI validate passed on this head.

Acceptance

• Finalization: confirm the owning agent is idle before retiring its worktree #230: met. The owner-idle check and owner handoff are in finalization.md:19-26, and the contract test passes.
• Elon hook treats command examples in patch data as execution #225: met. Patch payloads are accepted as edits, a real create without the record still fails, and nested functions.exec patches keep the tool boundary. Regressions are in tests/test_elon_gate.py.
• Delegated "not possible" results reach the user unchallenged #226: both checkboxes are met. The gate and eval are in bounded-delegation.md:40-49 and evals/negative-result-gate.json. The worker brief requirement is the report shape in orchestration.md:69-72. The owner rule is in orchestration.md:109-116 with evals/issue-owner.json, and the gh api gap is closed.
• Say harness for the agent program and machine for the computer #213: met for instructions, glossary and tools. Both spellings are tested in tests/test_shared_preferences.py:335.
• Procedure trigger audit: measure which operations procedures fire, then fix the worst #164: "Part of" is correct, because the re-measurement stays open.

Findings

1. Note (decide before merge; does not change the candidate): "Fixes Delegated "not possible" results reach the user unchallenged #226" closes the only record of the turn-end owner hook. Delegated "not possible" results reach the user unchallenged #226's checkbox criteria are met, so the keyword is technically right. But the user's 2026-10-14 decisions on Delegated "not possible" results reach the user unchallenged #226 say "The turn-end hook stays in AgentsMD; the sweep itself moves to a Chromeria Issue". No AgentsMD or Chromeria Issue tracks either item: searches found only Make rules reliable: turn mechanical rules into hooks, check conversation rules at reply time #201, which covers reply checks, not ownership. This PR records the hook under the Elon record's Deleted field, not as a non-goal with a follow-up, and deleting a user-decided item is the user's call. Leaving filed work with no owner is the exact failure Delegated "not possible" results reach the user unchallenged #226 fixes. Recommended linkage: file an AgentsMD Issue for the turn-end owner hook, carrying the 2026-10-14 decisions and blocked by a Chromeria sweep Issue, then keep "Fixes Delegated "not possible" results reach the user unchallenged #226" and link that Issue from Delegated "not possible" results reach the user unchallenged #226 and this PR. Otherwise change the line to "Part of Delegated "not possible" results reach the user unchallenged #226".
2. Note: the Elon gate's documentation does not mention gh api. README.md:317 and docs/musecode.md:128 still say the gate covers only gh issue create and gh pr create, while the gate's own error text and the CHANGELOG now cover gh api. This is a small follow-up doc fix and is not needed for this release.
3. Note: Say harness for the agent program and machine for the computer #213 has an open user decision. MISSION.md:4 still says "compatible hosts". This is Project Direction, outside Say harness for the agent program and machine for the computer #213's "instructions or glossary" criterion, and only the user can change it. It is recorded on Say harness for the agent program and machine for the computer #213, which this merge closes. The user should decide whether to track it separately.
4. Note: website impact is unverified, as the PR states. README now shows --harness. Any site copy that shows --host still works, so this does not block publication, but website-current is not established.
5. Cleared:
   • Luna's note on conflicting --harness/--host values (last wins): no caller passes both.
   • The accepted gaps on Elon hook treats command examples in patch data as execution #225/Delegated "not possible" results reach the user unchallenged #226: gh api graphql create mutations, and a non-shell tool that wraps a real command in a patch envelope.
   • Live behavioral verification remains pending normal use, as the PR states.

[lukemaj]

Review: Luna (codex gpt-6-luna, medium) on f27a862

Verdict: pass

Note:

• docs/work/164-trigger-audit/results-2026-10-01.md:65,91,150,181 (added with Port action routing triggers and frozen Grok evidence (#164) #240) retains “Hosts load AgentsMD,” a “Host” results-table heading, “every host,” and “host-version metadata.” This is historical benchmark reporting, so it does not block the harness/machine instruction wording; it is the remaining new prose that uses “host” for an agent program.

Checked: the cumulative diff at the stated head; the version commit and all five version values; installed --host callers against the --harness aliases; git diff --check; changed report links. The coordinator’s full-suite result was not rerun.

[lukemaj]

Roast: Grok (grok-4.7, high) on f27a862

Verdict: pass. Ship 17.3.0 as one release. None of the five outcomes should be held back.

Blocking

None.

Notes

1. skills/operations/references/orchestration.md:69-72 tells a worker that a report of "failed" must list the tool's docs, bundled README, --help, environment variables, and config keys. skills/operations/references/bounded-delegation.md:41-42 then says an ordinary failed slice, one that does not say the work cannot be done, is recorded at once. The brief sentence is the one that gets copied, and tests/test_negative_result_gate.py locks that wording. Ordinary test failures were not the 2026-10-14 incident. A coordinator who reads bounded-delegation before relaying is covered. A worker who follows the brief is not. This is not blocking: the carve-out exists in the file the coordinator is told to read, and holding the train would also hold the Elon hook treats command examples in patch data as execution #225 fix for patch text that is not a command.

2. CHANGELOG.md:17 does not tell a user what Procedure trigger audit: measure which operations procedures fire, then fix the worst #164 changed for them. The other 17.3.0 bullets do. This one should say that agents load orchestration before delegating, version control before a commit or version bump, and delivery before opening or merging a PR.

3. README.md:324-325 says Issues and PRs created through the GitHub API are not checked. That half of the sentence is false at this SHA. MCP creation remains unchecked. Docs: say the Elon gate also checks gh api Issue and PR creation #244 already tracks the doc fix. The edit should replace this sentence, not only extend the gh issue create / gh pr create line at README.md:317. The hook blocks gh api regardless, so this does not hold the release.

4. bin/project-direction:654 (API_CREATE) only matches when repos/ is the first path segment. Against this function, gh api https://ghe.example/api/v3/repos/o/r/issues -f title=x is allowed. https://api.github.com/repos/o/r/issues is blocked, and --hostname plus a repos/... path is blocked. I did not send the HTTP request. GitHub Enterprise full URLs are the extra hole. gh api graphql stays the gap already accepted on fix: keep patch data out of the Elon gate and gate gh api creation (#225, #226) #233. Neither is a github.com reason to hold 17.3.0.

Why one release

The five outcomes are independent, and publication is one merge onto main. The change that makes agents better on day one is the Elon gate: patch payloads are no longer treated as executed commands (#225), and gh api creates now need the record. The new rules are not in the always-loaded core. global/AGENTS.md is four renames, 19,044 bytes to 19,059. Same meaning. Not vaguer.

I ran elon_gate from this SHA on comments, reviews, merges, labels, assignees, reactions, dispatches, update-branch, sub-issues, GET, pagination, and statuses. Those were allowed. Creates without the record were blocked, including a missing --input file and commands after &&. gh api --repo after the subcommand is not blocked, and gh api --help rejects --repo there, so that allow cannot create.

#164 stays "Part of". The frozen Grok rerun passed P1 to P4 on arm c0e91ab, and docs/work/164-trigger-audit/results-2026-10-01.md says that arm is not this package and that version control still needs the post-release remeasure. That matches the PR.

Fixes #226

Honest, with #243. The negative-result gate, its eval, the worker brief, the owner prose, and the gh api hole are in this tree. The turn-end hook is not. #243 carries the 2026-10-14 decisions, and this PR's Elon record points at it. Closing #226 does not delete that decision. I do not leave the linkage note open.

I agree with the Opus ready verdict and with the accepted gaps already recorded there. I am not restating the caller check, the empty remerge diffs, or the minor bump.

[lukemaj]

Released and installed (2026-10-19, bestia). Tag and GitHub Release v17.3.0 at ee1a08c; marketplace promoted (toolboxmd/marketplace#195). Installed 17.3.0 on Claude Code, Codex and Grok through their plugin managers, and on Muse from a clean git archive v17.3.0 source (all five hooks trusted_enabled; hook definitions unchanged since 17.2.0, so Codex hook trust carries over). Global instruction links valid-stable-link on codex, claude, grok, opencode and muse; OpenCode lists operations from the clone link. Behavioral Live Verification is pending the user's real work. Cleanup: removed the superseded fix/226-negative-result-gate worktree and branches (content verified on main).