Helm v0.13.0 — operations-layer hardening

Helm v0.13.0

Helm v0.13.0 hardens the operations layer with patterns proven in live agent
operation: drift-tolerant config reconcile, a behavioral operating-contract
verifier, deterministic skill routing, a generic tool/MCP adapter layer,
grounding-by-guidance-injection, source-provenance tiering, fast-ACK request
intake, per-task interpreter fingerprinting, and non-file checkpoint backends.

Added

• helm reconcile: drift-tolerant, idempotent re-apply of workspace reference
  files against the packaged desired snapshot — classifies unchanged/missing/
  drifted/source_missing, adds missing files on --apply, preserves local
  overrides unless --force, and reports drift instead of clobbering.
• helm verify-contract: behavioral operating-invariant battery (command-guard
  deny/fail-closed, approval-gate TTL/consume-once, atomic ledger) complementing
  the structural doctor/validate checks — e.g. after a runtime bump.
• Deterministic skill router (scripts/skill_router.py): direct-routes when
  exactly one installed skill clears the confidence threshold, skipping
  model-based classification for unambiguous requests.
• Generic tool-adapter layer (scripts/tool_adapter.py): register external
  tools / MCP servers via a references/connectors.json data entry, with a
  built-in echo adapter, an MCP stub extension point, and a policy guard hook.
• Grounding-by-guidance-injection (scripts/grounding.py): assembles a skill's
  guidance and memory context into a model preamble, with a deterministic
  template fallback and a local-downgrade signal.
• Source-provenance tiering in the SourceBundle gate: refuses to promote a claim
  whose only readable corroboration is model_generated, ranking primary/raw >
  derived > model_generated (untiered evidence keeps prior behavior).
• Fast-ACK request intake (scripts/request_intake.py): dedups retried webhook/
  queue deliveries by delivery_id into a single pending task run.
• Per-task interpreter fingerprint + env-match, and run_checkpoint now uses
  sys.executable instead of a hardcoded python3 — fixing a silent pre-op
  checkpoint failure under a daemon whose PATH lacks the interpreter's directory.
• Non-file checkpoint backends (scripts/checkpoint_backends.py): capture the
  installed-distribution fingerprint (and diff it) before a runtime bump; a
  destructive command forces a pre-op checkpoint regardless of the profile flag.

Verification

• Full test suite: 1,596 passed (+73 over the 0.12.0 baseline of 1,523).

Helm v0.10.2

Helm v0.10.2

Helm v0.10.2 adds the first read-only loop and external skill-intake
primitives.

Added

• helm loops validate and helm loops inspect for reusable loop definitions.
• Loop examples for completion evidence and documentation sweep workflows.
• helm skill-intake classify and helm skill-intake validate for conservative external skill candidate review.
• A coding task finalization pipeline reference manifest.
• Loop documentation in docs/loops.md.

Changed

• Package metadata now declares the YAML parser dependency used by loop files.

Boundary

This release does not add run-loop, automatic external skill installation, or
automatic promotion of imported skills. Intake remains inspect-first and
operator-controlled.

Verification

• python3 -m pytest tests/test_loop_and_skill_intake.py -q
• python3 scripts/release_version_check.py --version 0.10.2
• python3 -m pytest -q → 1432 passed
• bash scripts/release_smoke.sh /tmp/helm-release-smoke-0.10.2

Helm v0.10.1

Helm v0.10.1

Helm v0.10.1 is a small ledger-attribution patch release.

Added

• Completed, blocked, and guard-audit task ledger rows now record experience_attribution so operators can review selected skills, selected tools, and missing evidence after a run.

Fixed

• helm memory capture-chat keeps queued / running rows free of final-only memory and attribution payloads.
• Chat capture attribution preserves conversation as the selected tool.
• Python module commands such as python -m pytest are attributed to the module name instead of -m.

Boundary

This release does not add automatic memory deletion or automatic skill promotion. Review and promotion stay operator-driven.

Verification

• python3 scripts/release_version_check.py --version 0.10.1
• python3 -m pytest -q → 1426 passed
• bash scripts/release_smoke.sh /tmp/helm-release-smoke-0.10.1

Helm v0.10.0 — harness-engineering layer

Helm v0.10.0

Helm v0.10.0 lands the harness-engineering layer: a coherent set of feature-flagged primitives that turn ad-hoc agent runs into observable, auditable, and gradually-enforceable operations. Everything new ships in shadow mode by default — decisions are logged but not enforced until an operator opts in based on accumulated evidence.

Added

• failure_signature: structured {component, tool, profile, error_class, target, fingerprint} derived from any failure event. Backed by an extensible classify_error() and normalize_target() so the same fingerprint identifies the same failure across runs.
• build_ledger_entry schema helper: a single chokepoint for every optional ledger field (failure_signature, sessions, snapshot_evidence, cleanup_status, policy_transition, browser_recon, browser stubs). No-null-fillers contract — fields appear only when explicitly set.
• task-state control container: helm_state_model.py now hosts the Forge-style "Control Flow Is Not Memory" separation. Required steps, completed steps, blockers, side-effect approvals, finalization state, and recovered messages live as structured state, not as transcript content. Compaction cannot drop control state.
• profile → tool-group grants: references/tool_groups.json maps each execution profile to a 3-bucket grant (allow / ask / deny) over the eight canonical tool groups. run_with_profile.py records the computed grant in every ledger entry and blocks profile-denied tool groups before subprocess execution.
• policy_transition: same-fingerprint / patch-failed / same-skill / credential-invalid-grant rules drive automatic next-action selection (stop_retry_and_diagnose, reload_file_and_decompose, create_skill_repair_candidate, auth_recovery_profile). Wired into adaptive_harness_lib.
• edit_policy + validation_gate: patch-first edit policy with checkpoint requirements; per-extension validation gate commands.
• agent reliability eval suite: six scenarios cover inspect-only, save-required, recovered Telegram context, external-side-effect approval, compaction-finalize integrity, and partial-completion reporting.
• trace_recorder + trace_replay: structured per-task JSON traces (tool sequence, validation gates, failure signature) with an atomic writer and a CLI replayer that prints replay plans (no re-execution this release).
• trace_to_skill candidates: aggregates traces into scaffold / repair / compound-runner candidates. skill_capture_ext adds draft-from-task and assess-draft subcommands.
• profile pause/resume: secret-token-gated pause/resume per profile, surfaced to the runner via OPENCLAW_PAUSE_GATE. Paused profiles exit with code 26 before any other gate runs.
• local_model_proxy spike + model_repair orchestrator: validator / nudge / retry / event-recorder primitives for small-model fallbacks. Library entry points consumed by external runners; HELM_MODEL_REPAIR flag, shadow-mode default.
• synthetic_respond_tool spike: schema injection + strip + enforce. Gated by HELM_SYNTHETIC_RESPOND AND the L3_local_model tier so cloud-tier calls are never affected.
• browser_work_verifier + browser_gate: pre-flight decision dict with allow_single_session, allow_parallel, require_user_login, require_confirmation, block_mutation, pause_profile, require_cleanup_evidence. Runner-side enforcement (OPENCLAW_BROWSER_GATE) handles session counting (max_sessions per profile, 10-minute window) and finalization gating (EXIT_CLEANUP_REQUIRED = 28).
• skill promotion pipeline: state ledger + digest generator + reply parser + CLI subcommand. Wired for daily Telegram digest with operator approval via reply messages.
• shadow_mode_report: 14-day aggregator across every feature-flagged surface plus recommend() that returns ready_to_enforce / needs_more_data / caution / no_signal per feature. CLI surface: helm shadow-report --since N --format md|json --with-recommendations.
• env_flags + io_utils shared helpers: centralised truthy detection and atomic JSON write — eliminates per-module reinvention.
• harness-engineering docs (13 files): inventory baseline, ledger-vs-command-log relationship, browser verifier design, browser profile policy, Control Flow Is Not Memory, Helm vs Forge positioning, chromux Phase 1 smoke, local-model-proxy spike, synthetic-respond-tool spike, chromux readonly runbook, skill-promotion pipeline, commit attribution, shadow-mode report runbook.

Changed

• OQ-4 / OQ-8 hard block (breaking for some workflows): workspace_edit and remote_handoff profiles now hard-block any browser action via the verifier (previously surfaced as require_confirmation). Workflows that previously relied on --approve-risk to pass browser tasks through these profiles must switch to service_ops or risky_edit.
• adaptive_harness_lib ledger reads tail-sample the task ledger (200-line tail) instead of full-read.
• command-line surface: run_with_profile.py adds --browser-action, --browser-url-pattern, --browser-logged-in, --browser-parallel, --browser-site-note. helm.py adds skill-promotion and shadow-report subcommands.

Fixed

• OQ-3 max_sessions enforcement (runner-side counter blocks new sessions when the cap is hit).
• OQ-7 finalization gate (tasks emitting require_cleanup_evidence cannot mark complete without cleanup_status).
• shadow_mode_report tail-cap visibility surfaced as window_truncated warning in markdown render.
• candidate_id NUL-byte defence: candidate_id_for raises ValueError on \x00 in either input.
• respond_tool_schema() returns a shallow copy instead of the live cache reference.
• _resolve_site_note_path cached via lru_cache(maxsize=256) with documented cache_clear() escape hatch.
• OPENCLAW_TRACES_DIR, OPENCLAW_DRAFTS_DIR, OPENCLAW_PAUSE_STATE, RESPOND_TOOL_SCHEMA_PATH env values now resolve ~.

Rollout Guidance

Every new feature is opt-in via env flag, defaulting OFF. Recommended sequence:

1. Keep all flags off. Run normal workflows for 1–2 weeks. The verifier, model-repair, and respond-tool modules log shadow decisions whenever a runner happens to invoke them with traces_dir set.
2. Run helm shadow-report --since 14d --with-recommendations (or schedule the workspace-side weekly cron). Review the per-feature verdict.
3. Flip a flag to 1 for any feature whose verdict is ready_to_enforce. Re-run the report a week later to confirm the change is stable.
4. For caution verdicts, inspect the samples and adjust thresholds (all thresholds in shadow_mode_recommendation.py are module-level constants).

Boundary

This release ships only the public Helm operations layer. It does not include OpenClaw workspace contents, private memory, personal connector state, local schedules, credentials, or raw task history.

Verification

• python3 scripts/release_version_check.py --version 0.10.0
• python3 -m pytest -q → 1372 passed
• two cross-cutting review cycles (duplication + over-engineering / bug + performance) returned CLEAN before merge

Helm 0.9.6

Helm v0.9.6

Helm v0.9.6 is a runtime hardening patch release focused on preventing stuck helper processes from turning into stuck operator workflows.

Added

• Regression tests for command-wrapper timeout handling and skill promotion timeout handling.

Changed

• Adaptive harness hydration now has an explicit timeout and reports timeout status with exit code 124.
• Adaptive harness wrapper execution now has a final guard timeout around run_with_profile.
• Common Helm script execution now has a default timeout. Set HELM_SCRIPT_TIMEOUT_SECONDS=0 only when a deliberately unbounded local run is required.

Fixed

• helm skill-lifecycle promote-from-trajectory --apply no longer waits indefinitely if draft generation stalls.
• Timeout output is normalized before being emitted in JSON payloads.

Boundary

This release does not include private OpenClaw memory, personal connector state, local schedules, credentials, or raw task history. It only ships the public Helm operations layer and release metadata.

Verification

• python3 scripts/release_version_check.py --version 0.9.6
• python3 -m pytest -q

Helm v0.9.5

Helm v0.9.5

Helm v0.9.5 documents the OpenHuman-inspired operations digest boundary extracted from OpenClaw dogfooding and keeps release metadata synchronized.

Added

• OpenClaw integration docs now describe the portable operations digest pattern:
  • artifact registry metadata with content hashes and source task context
  • connector freshness records with stale thresholds and last-attempt state
  • daily digest summaries for capture status, artifact roles, connector freshness, and review queue pressure
  • recoverable JSONL retention through archives instead of silent deletion
• README and Korean README now include operations digest and connector freshness as first-class Helm concepts.

Changed

• Bumped package metadata, citation metadata, README release banners, changelog, and release-note links to 0.9.5.

Boundary

This release is documentation and version-management only. It does not ship private OpenClaw memory, personal connector state, local paths, credentials, schedules, or raw task history.

Verification

• python3 scripts/release_version_check.py --version 0.9.5
• python3 -m pytest -q

Helm v0.9.0

Helm v0.9.0 - Task State, Evidence Gates, and HITL Patterns

Helm 0.9.0 expands the operator-facing control plane for long-running agent
work. The release focuses on append-only task state, explicit completion
evidence, checkpoint retention, outcome-aware skill lifecycle review, direct
corpus inspection hints, and human-approved decision pattern tracking.

Highlights

• helm task list|show|block|complete|retry|doctor|mark-stale|reclaim adds
  append-only task inspection and manual state transitions without rewriting
  prior ledger rows.
• Adaptive harness postflight can now require profile-level completion evidence.
  Successful processes that lack required evidence are moved to
  needs_verification instead of being treated as operationally complete.
• helm harness record-evidence --completion-evidence lets operators attach
  reviewed evidence labels after inspection.
• helm checkpoint prune|protect|policy adds human-triggered retention planning
  while preserving recent, pinned, and task-referenced checkpoints.
• Skill lifecycle runner events now include outcome metadata, with
  outcome-report, outcome-candidates, selection-stats, and
  promote-from-trajectory for review-only draft creation.
• helm dci exposes direct corpus interaction queries, and query results now
  include direct inspection hints for tasks, commands, checkpoints, and files.
• HITL decision pattern tracking records repeated approvals and rejections as
  audit data. Approved patterns remain policy metadata; they do not execute
  commands or promote skills automatically.

Human Review Boundary

This release keeps side effects explicit. Stale task recovery, retry decisions,
checkpoint pruning, trajectory draft creation, and HITL policy approval are all
manual commands. Pattern learning can identify automation candidates, but the
policy file records review state only.

Docs

• docs/task-state.md
• docs/adaptive-harness.md
• docs/skill-lifecycle.md
• docs/ops-memory-query.md
• docs/hitl-decision-patterns.md
• docs/evidence-label-convention.md

Validation

• python3 -m pytest -q passed: 399 tests.
• git diff --check passed.

Migration

No migration is required. Existing task ledgers and lifecycle sidecars remain
append-only. New fields such as task_state_schema_version, heartbeat_at,
completion_evidence, and lifecycle outcome metadata are added when new
events are recorded.

Helm v0.8.0

Helm v0.8.0 — Privacy, Retrieval, and Curator Revalidation

Helm 0.8.0 expands the operating layer around long-running agent workspaces:
private context now has a local reversible tokenization boundary, durable
context retrieval exposes ranking reasons, and skill lifecycle negative claims
can be reviewed or safely probed without editing SKILL.md.

Highlights

• helm privacy scan|tokenize|restore adds a local-first privacy boundary for
  emails, phone numbers, likely secrets, and Korean resident-registration-like
  identifiers. Recoverable mappings stay in the workspace-local vault; restore
  operations are audited.
• helm context --explain-ranking exposes why results ranked the way they did,
  including field-aware score components, recency boost, adapter/source signals,
  and shallow ontology graph expansion for entity-centered queries.
• helm skill-lifecycle revalidate-claim records manual negative-claim review
  outcomes and can run a claim-specific probe_command when it matches
  negative_claim_safe_probe_prefixes.
• Memory policy docs now distinguish raw facts, episodes, observations, and
  operating rules so future reflection-style workflows can stay evidence-first.

Skill Lifecycle

Negative-claim handling now moves beyond "find due claims" into an explicit
review workflow:

helm skill-lifecycle revalidate-claim --path ~/.openclaw/workspace \
  --skill old-skill \
  --claim-id sha256:abc123 \
  --status resolved \
  --note "command now exists"

Safe probes are opt-in. A persisted claim must carry probe_command, and that
command must match a configured argv prefix:

{
  "negative_claim_safe_probe_prefixes": [
    ["python3", "scripts/model_provider_probe.py"],
    ["openclaw", "health"]
  ]
}

helm skill-lifecycle revalidate-claim --path ~/.openclaw/workspace \
  --skill old-skill \
  --claim-id sha256:abc123 \
  --probe-command "openclaw health" \
  --probe

Successful probes mark the claim resolved; failed or timed-out probes mark it
still_valid. Probe output is stored on the claim, and lifecycle events record
the review.

Docs

• docs/privacy-boundary.md
• docs/ops-memory-query.md
• docs/memory-operations-policy.md
• docs/skill-lifecycle.md

Validation

• python3 -m pytest passed: 379 tests.
• git diff --check passed.

Migration

No migration is required. Existing 0.7.x lifecycle metadata remains compatible.
The new negative_claim_safe_probe_prefixes config key defaults to an empty
list, so probe execution is disabled until explicitly configured.

Helm v0.7.3

Helm v0.7.3 — Lifecycle Reporting Tightening

Date: 2026-05-03

Helm 0.7.3 is a small correctness and packaging release for the
skill-lifecycle work shipped in 0.7.0-0.7.2. It keeps the public CLI
surface stable while making summary output less ambiguous and confirming
that the packaged helm command works after user installation.

Changed

• umbrella candidates in helm skill-lifecycle status --json and
  helm skill-lifecycle report --format json now include the source
  signal for each cluster. This matches the standalone
  helm skill-lifecycle umbrella --json command and prevents duplicate
  tokens such as market from looking like the same recommendation.
• markdown lifecycle reports now label umbrella clusters as
  name_token, description_token, downstream_share, or
  execution_profile instead of using the generic shared token
  heading for every cluster.
• the OpenClaw workspace runner hook path was smoke-tested against the
  same lifecycle sidecar metadata used by Helm. A local inspect_local
  run with --skill car recorded both skill_used and
  skill_success events.
• the workspace briefing dedup gate was tightened so URL and filename
  slug matches are treated as high-specificity Obsidian signals. In the
  Gemini Embedding 2 regression case, Obsidian matches now narrow to the
  relevant Gemini note instead of unrelated hub/index notes while still
  returning seen_before=true.

Packaging

• package metadata bumped to 0.7.3.
• installed package smoke passed using the console script:
  helm skill-lifecycle scan --path ~/.openclaw/workspace --dry-run --json.

Tests

• 60 lifecycle test cases passing.
• full suite: 369 tests passing.

Migration

No migration required. Existing 0.7.x lifecycle metadata is compatible.

Helm v0.7.2 — PRD optional polish

Helm v0.7.2 — PRD optional polish

Date: 2026-05-03

Helm 0.7.2 fills the remaining "deliberately deferred" items from the PRD
review that turned out to be cheap to add and useful in practice. After
this release, every PRD requirement that does not depend on OpenClaw core
source access or explicit LLM automation is shipped.

Added

• helm curator <subcommand> — short alias for every
  helm skill-lifecycle <subcommand>. PRD 6.3 listed this as optional;
  added because the alias costs one argparse line and shortens common
  reports.
• umbrella execution_profile signal — clusters active skills by their
  declared default_profile in
  <workspace>/references/skill_profile_policies.json. Closes the last
  unimplemented signal from PRD 6.6 (the six were: name prefix/suffix,
  description, downstream tool, execution profile, domain category,
  narrow-skill majority — domain-category overlaps with downstream and
  was already covered).
• helm skill-lifecycle revalidation-due — surfaces persisted negative
  claims whose TTL has elapsed and status is not resolved. Each
  result includes the skill_id, the TTL anchor (detected_at or
  last_revalidated_at), and overdue days. This is the
  non-LLM portion of PRD Phase 5 — automation of probe / patch
  generation is still out of scope per PRD section 3.2.
• helm skill-lifecycle archive --dry-run now prints the file count,
  total bytes, and a sample of files that would move. The PRD asked for
  a "diff/preview" before archive; since archive is a rename and not a
  content edit, a textual content diff is meaningless — but a concrete
  inventory of what is being moved is genuinely useful.

Tests

• 60 lifecycle test cases (5 added since v0.7.1): execution-profile
  signal positive/negative, TTL-based revalidation-due (anchored on
  detected_at and last_revalidated_at), status="resolved"
  exclusion, and archive plan file summary
• Full suite: 369 tests passing

Validation

• smoke-tested against ~/.openclaw/workspace:
  • helm curator status works identically to helm skill-lifecycle status
  • umbrella now reports an execution_profile cluster
    (inspect_local, 6 upper-layer skills)
  • archive --dry-run household-ledger-ko previews 5 files / 7.6 KB
    with sample list
  • revalidation-due returns empty (claims persisted today; will fire
    in 30 days when the default TTL elapses)

What remains genuinely out of scope

After v0.7.2, the only PRD items still unimplemented require OpenClaw
core changes or explicit LLM automation that the PRD itself defers:

• native runtime hook for skill_viewed at prompt-injection time —
  needs OpenClaw cooperation. Workarounds shipped: observe
  (atime polling) and view (manual)
• Control UI lifecycle summary — needs OpenClaw UI source. The
  workspace-side helm skill-lifecycle status substitutes
• LLM-based skill consolidation / automatic patch generation — PRD
  section 3.2 lists this as a non-goal until an explicit approval
  workflow lands

Migration

No migration required. Backward-compatible polish on top of v0.7.1.