Skip to content

v3.0.0

Released 2026-07-06.

A verifiability release. Every major surface in this line ships its primary artifact as a proof: a signed lineage receipt, an HMAC-chained journal entry, a content-addressed record, or a deterministic projection that two operators can recompute to the same bytes. The features are not "capability plus an audit log" bolted together; the audit substrate is the shape of the capability. Strip the chain and the feature loses its meaning, not just its logging.

Substrate

  • Lineage is now a single, always-on chained record. Every artifact-producing step folds into one Ed25519-signed lineage spine instead of the previous optional per-subsystem records; bernstein lineage verify <run_id> walks the whole chain. (#2292)
  • Deterministic replay records by default. The step journal is a Merkle chain where each entry hashes its predecessor, inputs, model, prompt, tool call, and tool result, so non-determinism surfaces as hash divergence rather than a flaky rerun. bernstein replay --from-step N rebuilds state by walking it. (#2293)

Governance and review

  • Maker-checker and judge-panel gates whose verdict is an adjudication receipt anchored to the audit chain; the decision, its inputs, and the panel identity are all recoverable after the fact. (#2294)
  • Attested pull-request review and autofix: the PR carries a receipt linking the originating issue, the plan, every tool call, and the diff, so a reviewer can verify the change was generated from the ticket without operator override. (#2296)
  • RBAC, budgets, and seat attribution as verifiable projections: an authorization or spend decision is a governance-decision journal entry, not a mutable in-memory grant. (#2309)
  • Verifiable spending mandates recorded as journal-anchored records, so a spend limit and its consumption are independently auditable. (#2306)

Interoperability

  • Stateless MCP protocol core with owned cross-request identity, so a session spanning stateless calls stays attributable. (#2307)
  • Bernstein exposed as an audited execution node with signed webhook receipts: every inbound trigger is a receipt in the chain. (#2310)
  • Outbound agent HTTP requests are signed and each signature chains to the audit log, so a receiver can prove which install identity issued a call. (#2305)
  • Native subagent delegation for fan-out execution, each delegation recorded as a chain entry. (#2308)

Modality and observability

  • Skill installs produce lineage receipts and catalog provenance, so a skill's usage history is attested rather than asserted by a registry. (#2301)
  • Fork-from-step using git worktree commits as the snapshot boundary: a fork is a real commit, isolated per worktree, not a soft copy. (#2295)
  • OpenTelemetry GenAI spans emitted as a signed projection of the audit chain, so an exported trace and the executed actions verify against each other. (#2300)
  • C2PA content credentials emitted as a deterministic projection: attached and produced media carry content-address-anchored provenance. (#2303)
  • Cross-session memory rebuilt as a tamper-evident, content-addressed store; a memory write is a chained receipt keyed by content hash. (#2298)
  • TUI reads the existing event stream instead of polling, so the interface is a projection of the same journal the run records. (#2297)
  • Recurring goals as deterministic projections onto a canonical task graph: two operators with identical state fire the byte-identical graph at time T. (#2302)
  • Stuck-worker escalation as a signed, forensically-reconstructable receipt carrying the last audit entries and a deterministic recommended action, so a stall can be handed to a postmortem with cryptographic certainty about the failure window. (#2299)

Federation and activity model

  • A2A federation where every inbound and outbound message is a signed lineage receipt anchored to the install identity, so a peer can verify a received message chains back to us. (#2304)
  • A typed activity boundary so any agent modality, not only coding CLIs, runs under the deterministic scheduler and is journaled identically, letting replay verify across modalities. (#2311)