0.9.2: coherent agent, command, task, workflow, and model execution #801

Outcome

Deliver the approved 0.9.2 coherent execution model for agents, commands, model mappings, scheduled tasks, and frozen workflows.

Equivalent inputs must resolve to the same command content, persona, engine, model, tools, and ordinary runtime settings regardless of whether execution starts from the CLI, a task, or a workflow.

Source of truth

• Implementation plan
• Normative design

The documents define behavior. This issue tracks delivery and release evidence; child issues must not independently change the approved design.

Work packages

• WP0 — 0.9.2 WP0: characterize execution contracts and add equivalence fixtures #803
• WP1 — 0.9.2 WP1: introduce shared source and resolved-execution contracts #804
• WP2 — 0.9.2 WP2: ship layered user-editable models.json mappings #802
• WP3 — 0.9.2 WP3: implement the common cascade resolver and authorization boundary #807
• WP4 — 0.9.2 WP4: add canonical command execution and inline command actions #806
• WP5 — 0.9.2 WP5: converge every engine on resolved-request lowering #809
• WP6 — 0.9.2 WP6: implement task v3, migration, and scheduler adapters #808
• WP7 — 0.9.2 WP7: compile Markdown and GitHub-shaped YAML workflows into one frozen IR #805
• WP8 — 0.9.2 WP8: complete diagnostics, documentation, and release evidence #810

Parallel milestone lanes

These existing issues are part of 0.9.2 but are not substitutes for the implementation work packages:

• Architecture and cleanup: Sever the website provider → website-ingest edge (the actual blocker for P3) #744, Remove the dead code and dead tests deferred out of the 0.9.1 cut #794
• Bundle and registry security: Re-run the dangerous-env-key audit on akm bundle update, not just add #765, Guard registry fetches against SSRF, DNS rebinding, and unsafe redirects #767, Reject and redact credential-bearing registry URLs across CLI output #811
• Gated verification and dependency security: ci: run gated suites, retain caches, and require release-candidate evidence #784, Resolve Transformers transitive advisories for installed AKM consumers #798
• Improve dry-run correctness: improve --dry-run must report the effective read-only execution plan #800
• Completed during milestone triage: walkStashGit does not skip symlinks, letting a git-backed bundle pull external files into the index #766

Release gate

0.9.2 is not complete merely because the carryover issues close. Completion requires:

• WP0-WP8 complete with linked implementation evidence
• bundle/registry security work complete or an explicit documented release decision
• gated semantic, Docker, and native-scheduler evidence
• trustworthy dry-run behavior for the dogfood period
• package, migration, conformance, full release-check, and manual dogfood evidence required by the implementation plan