Every long agent session ends the same way: the model announces it's done. Sometimes that's true. Sometimes "done" means three of the five files got edited, the test run it "confirmed" happened four thousand tokens ago against an older tree, and the file it claims to have verified was verified by reading its own edit back and admiring it.
The difference between those two endings is the whole product. An agent you have to re-check is a demo; an agent whose "done" survives an audit is a tool.
0.43.0 was about compression that keeps receipts. 0.44 points the same instinct at the other end of the pipeline: the supervisor now treats "done" as a claim that has to survive verification — item by item, condition by condition, with provenance. And in the same release, planning stops being something the model does to itself: the plan tool is gone from the model's hands entirely, replaced by an external manager that watches the work and keeps the checklist honest.
Around that core, the release grows a set of quality-of-life capabilities that long-session users have been asking for: session titles with a fuzzy startup picker, a cleaner /new
command, /monitor
for long-running watches, and MCP timeouts that finally understand the difference between "slow" and "stuck."
0.44.0 shipped on August 17, 0.44.1 followed the same day, and 0.44.2 closes out the cycle — everything below refers to the 0.44 line as one release, and 0.44.2 is the one to install.
Verification is a policy now, not a mood #
The quiet structural change first, because everything else stands on it.
Verification state used to live in boolean latches inside the supervisor's detectors — in-memory flags that lived and died with the process. Restart your laptop mid-task, resume the session, and the supervisor came back with amnesia: no memory of what it had promised to verify, and a fresh willingness to take the agent's word for things.
0.44 replaces the latches with a persisted verification policy. It's session-level state now: serialized with the session, restored on resume, folded into the governance hash, and projected into goal recitation on long compacted sessions — so neither a process restart nor a compression cycle can shake it off. The evidence ledger — the record of what was actually run, changed, and observed — persists across restarts the same way, which also kills a class of false alarms where a resumed turn looked like a verification gap simply because the ledger had been wiped. Turn answers are tracked in a dedicated ledger too, restored from the transcript on resume instead of being re-guessed from message history.
The behavior you'll notice: a session you resume behaves like a session you never left. What the supervisor knew, it still knows. What it was owed, it still collects.
The verify gate wants evidence with a shape #
The verify gate — the checkpoint that runs when the agent self-reports done
— got the deepest rework of the cycle. The theme is simple: a holistic "looks good" verdict is no longer a thing the verifier is allowed to produce.
Here's how the gate works now. When your request is resolved into a task, the classifier derives evidence conditions from it — a fulfillment checklist of what would have to be demonstrably true for "done" to be honest. At the gate, the verifier must address each condition in a structured tag, and a deterministic parser walks the response: an unmatched condition beats a holistic PASS, every time. A response missing its required tags gets exactly one format-only retry; substantive gaps don't get to retry their way through.
What the verifier sees got richer to match. Ground truth now carries a sliding window of recent command outputs instead of just the last one, plus git status
, and the git diff budget is distributed per file — one large file can no longer eat the budget and hide the changes in four others. The resolver's mandatory coverage classes grew from four to six, adding named-form and quantified coverage: requests that name things or count things get conditions that name and count them back, and a new unenumerated-category shape covers requests that quantify over a category without listing its members.
And there's a provenance bit that closes an old loophole: the gate is now told whether post-change verification happened by read-back only. An agent that edits a file and then re-reads its own edit has produced a diff, not a check — and the verifier can now see the difference and demand a behavioral one.
The verifier itself is held to discipline too:
No fallback model. If your configuredverifier_model
fails, the gate fails closed for the turn — it does not silently borrow the agent's own model, which would inherit exactly the blind spots the gate exists to catch.Exhausted iterations hard-stop. When the gap-fixing budget (max_iterations
, default 2) runs out, the turn stops instead of falling through to a friendlier judge.Implicit done is gated. An agent that just quietly stops producing tool calls gets the same checkpoint as one that announces completion.Answer-only turns are exempt. Asking "why does this function take a mutex?" doesn't drag mutation checks into a question that just needs an answer.
Two supporting changes make all of this cheaper and steadier: supervisor calls now use schema-enforced JSON output (with provider-side enforcement where the provider supports it and lenient recovery where it doesn't), and the classifier gets a bounded retry on malformed responses instead of falling straight to a fallback. The gate's exchange has its own budget now — max_tokens = 8192
under [supervisor.gate]
— covering both the verifier's reasoning and the size of the assembled deliverable it's shown.
Evidence-bound claims (claim_check
) got more precise in the same pass: explicit <evidence>
quotes must occur in current-turn tool output, and ordinary URLs, paths, and code examples are no longer inferred to be citations — fixture data in your codebase stops being mistaken for an external source.
Planning leaves the model's hands #
This is the change you'll feel first, and it's a philosophical one.
Since planning shipped, the plan was a tool the model called: plan(command="start", ...)
, plan(command="next", ...)
. Which meant the model graded its own homework — and a model that wants to be done has a way to look done: advance the checklist, mark tasks complete, close the plan. Finishing paperwork is not doing the work, but a self-managed checklist can't tell the difference.
In 0.44 there is no model-callable plan tool. Planning is supervisor-owned. For focused work, nothing changes — focused work stays plan-free, and answer-only and observe-only tasks can no longer form plans at all. When work genuinely has dependent phases or context-loss risk, the specialist emits a sparse hidden signal alongside a real work response, and a separate adaptive external plan manager — its own cheap model, one structured request/response per decision — creates, advances, revises, or finalizes the runtime-owned plan from the request, the specialist's context, and the recorded evidence. Evidence is checkpointed per phase. Sidecar plans are capped at six tasks. /plan
still shows you the checklist; it just can't be gamed from inside anymore, and on a verified PASS the remaining phases close atomically — one verified deliverable satisfying several phases is settled as exactly that, rather than forcing busywork re-runs.
Plans age honestly, too. Every plan tracks when it was last engaged — refreshed on creation, mutation, and restoration — and a plan that predates your latest message renders with an explicit stale marker. A checklist the conversation has moved past announces itself instead of quietly steering the work.
The manager is configurable and on by default:
[supervisor.plan]
enabled = true
model = "octohub:auto"
max_tokens = 2048 # generated JSON decision; not input context
trajectory_max_tokens = 4096 # bounded assistant/tool input slice
adoption_min_actions = 8
adoption_min_distinct_actions = 4
The adoption thresholds only nominate broad work — the classifier still rejects answer-only turns before a plan can form. And planner failures are latched per user turn, so a planner having a bad day degrades to "no plan this turn" instead of an unbounded retry loop.
There's a side benefit hiding here: the plan tool's schema was text the model stared at on every single turn, whether or not planning was relevant. That token tax is gone.
The removal reshuffles the builtin MCP servers. core
now holds session-native primitives (recall
); a new ** orchestration** server takes delegation and background work (
tap
, schedule
, and the new monitor
); runtime
keeps harness reconfiguration. If your roles or tap manifests pin server_refs
, the migration guidehas the full old-to-new table.
A detector for wasted reads #
One new supervisor detector, off by default, worth turning on: re-read detection. The supervisor tracks successful reads per path, and when the same path is fetched past a threshold with no intervening mutation, the model gets an advisory — it's re-fetching content it already has instead of using it. Mutating a path resets its counter, so edit-verify loops never trip it.
[supervisor.detectors]
reread_threshold = 4 # 0 = off (default)
It shares the existing sequential-advisory budget, so enabling it can't turn the supervisor into a nag.
Sessions you can find again #
Now the expansion half of the story. If you run many sessions — and daemon users run dozens — you know the failure mode: a directory full of session_1755301892
and no idea which one held the migration you half-finished on Tuesday.
Sessions have titles now. Set one with /rename
, or start named: /new Auth Refactor
. Titles live in a JSON sidecar next to the session (capped at 160 characters), show up in /list
and /info
, and are pushed into the terminal window header — your window manager finally knows which session is which.
And there's a picker. Start with a bare --resume
(no session name) and you get a fuzzy-searchable list of your sessions, filterable by name, title, role, and model, on the alternate screen. The query line supports real readline editing — Ctrl-A/E, Ctrl-U/K, Ctrl-W, Home/End — and Ctrl-N/P walks the list. Pick a session to resume it, or choose a fresh start.
/session
is retired in favor of ** /new**, which does what its name says: starts a fresh session, named in the same
YYMMDD-basename-HHMM-uuid4short
format octomind run
uses, with an optional title. The old command's switch-or-maybe-create ambiguity is gone. The session commands referencehas the full surface.
Two smaller additions round it out. ** /monitor** brings the orchestration server's event-stream watches to a slash command, so you can check on long-running monitors without composing a tool call. And the cost readout now splits
total spend from the
main model's share — for the first time you can see exactly what the supervisor machinery costs you, which, with
octohub:auto
doing the mechanics, is typically a rounding error next to what a single unverified "done" costs to clean up.## Compression, continued
0.43.0 replaced the compression pressure ladder with a computed engine; 0.44 is that engine's shakedown cruise, and it includes one honest correction.
Growth is now measured on the full context, not output tokens only. The 0.43.0 design reasoned that only output is new material. In practice, tool results and injections expand the context too — and on autonomous sessions they dominate. Measuring full-context growth makes runway predictions match reality, and a "runway ladder" lifts the fire line above the post-compression baseline so back-to-back cycles can't chase each other. User turns reset the adaptive horizon; a compression that can't buy real headroom is refused; and when the hard ceiling is genuinely breached, the engine can now override the model's own "nothing worth folding" veto — at the ceiling, folding something is not optional.
Folds preserve turn structure. Range selection is turn-aware: assistant responses and the bridges between user turns survive into continuations, and the continuation wrapper now carries your original request verbatim in a dedicated block, with validated next actions kept separate from raw messages. The agent resumes from what you actually asked, not from a paraphrase of it.
Goals are signed. Every recited goal carries a signature of the user task it came from, and goals whose request has been superseded are simply not recited. The stale-goal failure — an agent cheerfully pursuing the previous request after a compaction — is structurally closed.
The patch releases close the loop on the summary itself. 0.44.1 excludes prior summaries from the exact-keep dependency closure, so summaries can no longer nest inside summaries and grow the context monotonically — the compression system can now compress its own output. 0.44.2 protects the opposite failure: a prior summary is now always rendered in full before folding — never thinned out to fit a budget, and excluded from the fold's token budget entirely — so accumulated state can't silently erode across cycles. Folds are also anchored on the live plan, so what survives a compression is what the current phase of work actually needs. The recall index got the same anti-growth treatment, with historical block IDs stripped instead of accumulating. Details in the compression docs.
MCP timeouts understand progress #
Tool timeouts used to be a single number with a contradiction inside it: set it low and long-running tools die mid-work; set it high and a hung server stalls your session for the duration.
0.44 splits the concept. timeout_seconds
(default now unified at 30 across every component) is an idle deadline: each MCP progress notification resets it. A tool that's working and saying so can run as long as it needs; a tool that's gone quiet for 30 seconds is cut. On top of that sits an absolute cap of 20× the configured value, so a malicious or broken server can't immortalize itself by emitting heartbeats forever — and the peer is notified when the cap fires. Timeout errors now say which deadline fired and what to do about it. Full behavior in the MCP tools docs.
Fixes that matter more than their diff size #
The response loop was rebuilt as an orchestrator. The code path that takes a model response and turns it into executed tools, recorded evidence, and displayed output is now a single response-processing orchestrator: parallel tool execution with proper cancellation, tool-call previews with nested parameter formatting, loop/drift detection over tool results, adaptive steer backoff, and unified output sinks for terminal, JSONL, and WebSocket modes. One user-visible bug died in the rewrite: costs were being tracked twice on some paths.
System content can no longer impersonate you. Injected control-plane text — inbox turns, system-managed messages — no longer auto-activates skills or capabilities, and system events can no longer trip the task-completion gate. Only genuine user turns open it.
Long session names broke /send. Unix sockets have a hard path-length limit (
sun_path
), and descriptive session names could exceed it. Socket paths are now shortened deterministically via SHA-256 when needed, so the send command and inject listener work for every session name you can type.## Upgrading
brew install muvon/tap/octomind
cargo install octomind
Prebuilt binaries for every platform are on the releases page.
Three things to check after upgrading:
Config migrates to version 5 automatically, through the registered migration chain, with a backup written before the atomic replacement. New sections ([supervisor.plan]
, gatemax_tokens
,reread_threshold
) arrive with defaults; your values and comments survive.The Anything that calledplan
MCP tool is gone.plan(command=...)
— role instructions, tap manifests, scripts — should stop;/plan
remains as a display. If yourserver_refs
pinned tools by server, note thattap
andschedule
moved to the neworchestration
server, which is also wheremonitor
lives.Embedders, one breaking change: the MCP-side plan-driven compression API was removed outright. If you drove compression through plan boundaries programmatically, that path no longer exists — the adaptive engine owns compression decisions now.
The model hub is open to everyone — octomind login
, or /login
from inside a session, and you're routing.
There's a through-line in the last three releases. 0.42.1 made the summary prove its claims. 0.43.0 kept the originals within reach so a wrong summary could be checked. 0.44 finishes the thought at the place it matters most: "done" is no longer a thing the agent says. It's a verdict the evidence earns — and now the evidence survives restarts, the checklist can't be gamed from inside, and the judge is not allowed to shrug.