VibeHard Agent Edition — Changelog

3.0.1 — October 28, 2026

• Brown-field adoption & gate precision (adopt, gate). Refines stand-in (shared database wrappers and multi-file driver imports), mass-assignment (inline suppression comments and OAuth/JWT claim verification schemas), idempotency-contract (atomic ON CONFLICT database deduplication), and ux-judge (/webhooks/* exclusion and nested MCP tool discovery).
• Unified .factory/ and .vibehard/ configuration discovery. encryption-asserted, pii, and compliance now read .factory/encryption.json alongside .vibehard/spec.json, and takeSnapshot preserves committed .factory/ and .vibehard/decisions.json files during brown-field adoption.
• Static MCP tools/list compatibility. Desktop MCP hosts that do not refresh after notifications/tools/list_changed now receive the full tool catalog on initial tools/list.
• REA companion self-update (rea --update). Running rea --update updates the local REA shim and ~/.local/state/vibehard/rea-install.json receipt in place.
• Verified. 3.0.1 passed the 649-file Agent Edition unit, clean-room, customer-persona canary, and auto-update verification suites.

Installing or upgrading to 3.0.1: Installed copies check for signed updates about every 6 hours and apply 3.0.1 automatically, or run vibehard-agent update (or curl -fsSL https://vibehard.ai/download/install-agent.sh | bash).

3.0.0 — October 27, 2026

• Zero-Trust AI Coding Referee (init-referee, verify, hook). Run vibehard-agent init-referee in any repository to install the planning skill and lifecycle hooks (PreToolUse and Stop). Once .vibehard/decisions.json is committed at baseCommit, the Referee locks the contract and blocks the coding agent from stopping until every verification gate passes.
• Gate 1 — Sealed Contract Conformance & Stateless HardTruth Rules. Verifies that .vibehard/decisions.json and hook configurations have not been tampered with or resealed mid-build, enforces required/forbidden files, checks all package.json dependency sections against allowed_deps and forbidden_deps, evaluates fail-closed git grep --untracked rules, and enforces stateless HardTruth Rule 3 (Anti-Stubbing) and HardTruth Rule 5 (Test-Surface Monotonicity).
• Gate 2 — Out-of-Custody Red-First TDD Worktree Replay. Checks out baseCommit in an isolated temporary git worktree, verifies the baseline suite was green, copies in only the newly added or modified test files, and executes test_cmd — proving the new tests fail before the implementation exists.
• Gate 3 — Context-Aware Diff-Scoped Mutation Testing. Mutates changed production lines round-robin across modified and new source files (skipping comments, string literals, and multi-line template literals) with crash-safe journaling (.vibehard/mutation-journal.json) and signal recovery, requiring the test suite to kill every mutant and at least one mutant per newly added module.
• Built-in gate preflight toolchain discovery. Built-in verification gates now populate tools via toolsFor(".") during preflight so toolchain availability is recorded consistently before gate execution.
• Verified. 3.0.0 passed the Agent Edition referee, auto-update dispatch, dynamic-import guard, receipt verification, and MCP server test suites (648 test files in the build receipt), plus pre-release security and conformance audits.

Installing or upgrading to 3.0.0: Installed copies check for signed updates about every 6 hours and apply 3.0.0 automatically, or run vibehard-agent update (or curl -fsSL https://vibehard.ai/download/install-agent.sh | bash). To enable the Zero-Trust Referee in a repository, run vibehard-agent init-referee and commit .vibehard/decisions.json before starting your build.

2.0.7 — October 23, 2026

• Signed licenses. Paid plans are unlocked by a signed license.json in ~/.vibehard-agent/. Without one, VibeHard runs the Community chain of 44 gates; with a valid Software Factory, Agentic Workflows or Enterprise license it runs all 48. Licenses are checked offline; no account call is made during a build.
• Your agent sees new tools as they unlock. VibeHard now tells connected agents when the tool list changes (tools/list_changed), so agents that cache the tool list at connect can still reach each step’s tool.
• Deeper, better-grounded PRDs. The PRD reads your brief, covers every part of the spec, is written section by section, and is reviewed against the decisions you already made. Sections nothing refers to come back as advice at scope review instead of failing the build.
• Decisions stay yours. Every interview answer records who gave it. Procurement and buy-versus-build choices that only you can make are recorded as yours.
• Serious findings reach you. When the architecture audit finds a high-severity problem, VibeHard now shows it to you at the final review instead of failing the job. Hand-rolled infrastructure that a standard service already covers goes back to the architect first.
• Spike work packages. Open technical questions become small spike tasks before the architecture is written. The pass bar for a spike is set by the plan, never by the agent doing the spike, and you review the results.
• Clearer progress and recoverable waits. Progress reports the current sub-step. When a work order is about to expire, VibeHard asks you instead of failing, and the job can be resumed. Idle drivers are woken when work arrives.
• Model provenance per stage. Each planning stage records which model class wrote it, and VibeHard warns when a lighter model wrote a planning document.
• Environment inventory. Builds record the tools and versions present on the build machine, so a plan never assumes a tool that is not there.
• Verified. 2.0.7 passed the full Agent Edition test suite (647 test files, 10,002 tests, from the build receipt), the provider-free source and binary checks, asset verification and clean-room installation checks for darwin-arm64, linux-x64 and linux-arm64.

Installing or upgrading to 2.0.7: Installed copies check for signed updates about every 6 hours and apply 2.0.7 automatically, or run vibehard-agent update (or curl -fsSL https://vibehard.ai/download/install-agent.sh | bash). If you hold a paid license, keep ~/.vibehard-agent/license.json in place before the update. Connected agents may need to reconnect once after the update (for example, run /mcp in your agent) because the tool interface version changed. Known issue: if you have a 2.0.6 job on a brief of more than about 20,000 characters that is paused after its second spec draft, before its spec is written, finish or cancel it before you update; resuming it after the update can stop with a replay error. A fix is planned for 2.0.8.

2.0.6 — October 21, 2026

• Stage-gated MCP entry points. vibehard_gate and vibehard_build_start are exposed cleanly alongside vibehard_session_open and vibehard_status at session start, keeping the initial MCP surface focused while preserving standalone gate verification.
• Pre-gate tree snapshot and seal integrity. The factory snapshots the authored workspace tree immediately before running the 44-gate chain and seals only the exact tree that the gates verified.
• Supervisor unit isolation. Daemon lifecycle checks never stop or load a supervisor unit belonging to a different daemon home, keeping isolated test and staging runs completely separate from your installed service.
• TypeScript 6 and 7 preflight support. The TypeScript compiler check treats the minimum version as a floor rather than an exact pin, accepting TypeScript 6 and 7 toolchains cleanly.
• Stricter buy-before-build and Linux sandbox hardening. Generic domain nouns no longer satisfy the buy-vs-build integration exemption, and Linux bwrap sandboxes resolve rustup toolchain proxies unconditionally.
• Built-in static reference analysis and guided onboarding. Includes vh-rea-static for local code inspection, reconciled REA shim contracts, and a guided first-build sample flow.
• Your agent is told what to do, step by step. Connected agents receive VibeHard’s working rules, ready-made MCP prompts (vibehard-build, vibehard-status, vibehard-next), and next_action guidance on every vibehard_progress call.
• Verified. 2.0.6 passed all 581 test files, L1 source and binary provider-free checks, asset verification (17 checks, version 2.0.6-agent), update-suite verification, and cleanroom installation checks across darwin-arm64, linux-x64, and linux-arm64.

Installing or upgrading to 2.0.6: Installed copies check for signed updates every 30 minutes and apply 2.0.6 automatically, or run vibehard-agent update (or curl -fsSL https://vibehard.ai/download/install-agent.sh | bash).