[github-actions]

v2026.10.19 — 2026-10-17

Codex hook fixes, targeted evidence, faster releases. The managed pre-push hook now says when a push went through ungated (as Codex's PATH caused) and keeps receipts under the workspace-write sandbox. Evidence routes for config edits, merged changes, redirected reports, generated clients and seed/data globs need no whole-suite run. Release plan PRs and the main push of a version-only release merge take a CI fast path, and release-prepare reuses main's green CI. Cross-device sync itself (Stage C) stays off on stable.

Upgrade note

• Playbook runs and approvals move to new tables on first open, and the old tables are frozen: an older CLEO on the same project (for example a pinned stable) gets an upgrade-required error when it starts a playbook run or records an approval. Upgrade every CLEO that shares the project (provenance: T12535)

Project hooks

• The managed pre-push hook prints one clear WARNING line naming why a push went through without project checks, and flags a checkout whose hooks are activated (provenance: T13774)
• Project hook receipts fall back to a self-ignoring .cleo/hook-receipts directory when the Git-private directory is read-only, as under Codex workspace-write (provenance: T13775)
• Future hook promotions require exact-commit hosted dispatches and retained native agent receipts with explicit trust, context and fault metadata (provenance: T13831, T13818)
• Still open from the v2026.10.17 Codex limits: the one-time hook trust step, tracked as T13773

Goal protocol

• CLEO Goal is a separate package (@cleocode/goal, bins cleo-goal/ocg) that is not yet published on npm, and its pilots are still pending. Until it is installed, cleo go, cleo goal status and the Stop tick find no runtime and cleo doctor reports it as not installed.
• cleo doctor reports the CLEO Goal runtime (opt-in npm update check), and cleo goal install --harness registers an installed CLEO Goal with a harness for this project (provenance: T13819, T13820)
• CLEO's unwired goal loop is retired: cleo goal keeps only the protocol verbs draft and close (ADR-097) (provenance: T13797)
• cleo tasks changeset <id> [--test-plan] reports a task's change set, commits and the exact test files it owes, as data (provenance: T13795)
• cleo go hands the ready wave to CLEO Goal; cleo goal status reads the live run through cleo-goal status --json; the Stop tick resolves cleo-goal, then ocg (provenance: T13821)
• The Claude Code Stop hook's no-goal path stays light (about 260 modules, no store), now pinned by gate 39 (provenance: T13830)

Evidence

• Targeted evidence for config edits, merged changes, redirected JSON reports and generated-client dependents, with no whole-suite run (provenance: T13778, T13779, T13780, T13781, T13782, T13783)
• Declared seed/data globs owe dependents a typecheck, not tests, and a test file edited beside the data no longer cancels that (provenance: T13786)
• ci:<pr> evidence looks past a later main run whose jobs failed in a setup action before any test ran (provenance: T13809)
• Only the owner may use CLEO_OWNER_OVERRIDE, and the override cap is an owner-only per-project setting (evidence.overrideCapPerSession, default 10, max 100) behind an explicit, anchored owner enrollment (provenance: T13787, T13790)
• An unconfirmed owner enrollment no longer sets the override cap, and any committed owner-settings.json in git history marks a re-enrollment unconfirmed (provenance: T13829)

Release pipeline

• release-prepare reuses main CI's green run, verified server-side (provenance: T13823)
• Release plan PRs, and the main push of a version-only release merge, take the CI fast path (provenance: T13824, T13833)
• One release PR, scripted end to end: cleo release open <v> --ref release/plan-<v> and scripts/release-run.mjs (provenance: T13825)

Store

• Closing the store settles in-flight best-effort writes first, so a late write can no longer stall the next writer for 30 s (provenance: T13630)

Docs

• cleo docs update keeps the prior version linked to its doc (provenance: T13734)
• cleo docs add errors name the bound positional and the exact fix (provenance: T13726)
• Docs CRDT section ids are anchored to headings, so inserting a section no longer shifts later ids, and a stale edit merges three-way, section by section, against the version it was authored from (provenance: T13584)
• cleo docs versions reads a doc's conduit history (version is now a display ordinal 1..N; the stored number moves to storedVersionNumber); cleo docs doctor --apply backfills versions from before the conduit adoption from the audit log, and records unrecoverable ones as gaps instead of inventing them (provenance: T13727)
• Unrecoverable conduit-history gaps are reported at info level after apply (provenance: T13843)

Backups and cross-device sync

• Unencrypted exports of projects with two or more playbook approvals no longer fail; a non-JSON journal image never ships (provenance: T13817)
• The first vault push over a format-2 parent prunes only the local rows in that parent's own snapshot, so a lost synced row is refused instead of hidden (provenance: T13816)
• cleo cloud pull judges each local change against the head snapshot's copy: a file equal to the head's, or a new file the head lacks, is no longer a change that refuses the pull, so a device can pull and then push without --force (provenance: T13813)
• Live on stable: playbook runs and approvals move to tasks_playbook_runs/tasks_playbook_approvals on first open (old rows are copied; where both copies of a run differ, the old one wins and the other is archived), the old tables are then frozen (see the upgrade note); deleting a run deletes its approvals; unencrypted cleo backup export strips credential columns from journal images (provenance: T12535)
• Sync groundwork (sync itself stays off on stable until Stage C): project sticky notes, playbook runs and playbook approvals get row uids for a second device; two devices adopting the same legacy doc, or making the first docs update on it, mint one doc uid (provenance: T12535, T13586)

Not in this release

• fix(T13842): docs fetch serves the merged head, not the last writer's raw input #2338 (T13842, docs fetch serves the merged head) is not included; it is planned for a later release.

Preflight evidence

Linux test shards ran in https://github.com/kryptobaseddev/cleo/actions/runs/39023766407.