[HarperZ9]

Draft. Do not merge before the release go. This is the release change for 2.0.0. Merging it and pushing the tag v2.0.0 publishes the release. An independent review on 2026-11-14 said DO NOT TAG because of one finding (B1). That finding and the review's other items are fixed on main (#472, #473); the reviewer's probes were run again and the state is below. The fixes themselves have had no further independent review.

What is in it

• Version 2.0.0 at every site: pyproject.toml, desktop/pubspec.yaml (2.0.0+41), desktop/lib/version.dart, CITATION.cff, the README badge, the QUICKSTART.md line and the docs/GITHUB-ACTION.md pin. Homebrew and Scoop stay on 1.9.0 until PyPI has the 2.0.0 digests.
• RELEASE-NOTES-2.0.0.md: what you can do now; what changed by default; what the security review changed; what breaks and what to do; how old records verify; what did not change (licence, price); which versions get fixes; limits; release assets; the monitor rule pack digest (unchanged from 1.9.0, a76b7e89...).
• CHANGELOG.md: ## 2.0.0 (2026-11-14), in the order: what you can do now, what changed by default, what breaks, fixed, known limits. Every pull request merged since v1.9.0 is cited.
• README.md Limits: one sentence saying task success against other agents is unmeasured.
• SECURITY.md and docs/VERSIONING.md: 1.9.x gets security fixes until 2027-02-12.

State on 2026-11-14 (23:30 UTC)

• Main (through fix(gateway,code): the remaining findings of the independent review of 2.0.0 (D1, D2, D3, A1, A2, N1 to N5) #473, 716f549c) is merged in with an ordinary merge commit (a835f64c). The security pull requests on main: fix(gateway): server tool replies are served and recorded; no reply without a record #462, fix(gateway): the gateway ledger is kept on disk and chained across restarts #465, fix(gateway): unfinished streams are charged; calls in flight are bounded; pass-through allow-lists #466, fix(lean): Lean child processes get an allow-listed environment #467, fix(gateway): small review findings, key and network docs, known limits, release gate #468 from the first review; fix(code): on a native turn, a TOOL line in a reply's prose is not a call #469 and fix(gateway): confirmation review items C1 to C9: no ledger, no upstream call #470 after the confirmation review; fix(code): on a native turn the calls that run are the provider's tool-call objects (B1) #472 and fix(gateway,code): the remaining findings of the independent review of 2.0.0 (D1, D2, D3, A1, A2, N1 to N5) #473 after the third review.
• The third review (an independent reviewer who wrote none of the fixes) read fix(code): on a native turn, a TOOL line in a reply's prose is not a call #469 and fix(gateway): confirmation review items C1 to C9: no ledger, no upstream call #470 and found one blocker and ten other items:
  • B1, the blocker: text inside a native tool call's arguments could run as a different call, because a call's recorded line was cut at U+0085, U+2028 or U+2029. Fixed in fix(code): on a native turn the calls that run are the provider's tool-call objects (B1) #472: a call is one line whatever its arguments hold, the calls that run are the provider's objects, and the repair step never runs on a native turn.
  • Fixed in fix(gateway,code): the remaining findings of the independent review of 2.0.0 (D1, D2, D3, A1, A2, N1 to N5) #473: a ledger that stops taking writes after start now stops model calls (503) and resumes with a recorded gap; verify holds on a ledger a gateway is appending to; stray files in the ledger folder are ignored; a key's row is read and its slot taken under one lock; an unfinished stream is charged at least a quarter of its characters; the fallback to the text protocol starts only on an error that says tools are unsupported, and the session says so; the request head and the body of a model call have deadlines; gateway-ledger show cuts long fields; the Lean scan covers aliases and more spawn APIs; the limits page names /v1/embeddings.
• The reviewer's probe scripts were run again against main at 716f549c. The probes of B1, D1, D2, D3, A1, N1, N2, N3 and N5 no longer reproduce: the model's own call runs with its argument intact and no other call runs; one call reaches the provider when the ledger stops taking writes and the calls after it get 503; verify passes on a ledger a gateway is appending to (0 of 6 runs report a problem); stray files are ignored; the fallback does not start on a context-length error; the Lean scan catches all 18 planted forms; an abandoned stream with an 80,000 character prompt is charged 20,010 tokens; a client that drips header lines is closed at 1.2 seconds with a 0.5 second timeout; show prints a 681 character line where it printed 25,341. The forced-interleave probe for A2 still prints two served calls and 920 tokens: its second request now waits for the first one's admission and the two then run together, which is the documented margin for calls in flight. The probes of claims the review had confirmed still pass (103 probe cases passed in all).
• The notes say all of this, and say that fix(code): on a native turn the calls that run are the provider's tool-call objects (B1) #472 and fix(gateway,code): the remaining findings of the independent review of 2.0.0 (D1, D2, D3, A1, A2, N1 to N5) #473 have had no further independent review.
• The date is stamped: released 2026-11-14. python scripts/release_assets.py check --tag v2.0.0 --release prints release check clean for 2.0.0. If the tag slips a day, the dates are edited by hand and the dry run is rerun.

Dry run

Run 43652933825 on b33f31e4: plan, discover, build, gates on ubuntu and windows, and dry-run succeeded; publish, release and verify-pypi were skipped, as a dry run requires.

• Gates on both systems ran against the installed wheel with the source harness folder moved away. 1.x record control: 51,084 single-byte flips, 0 read MATCH; 0 both-name receipts read MATCH. The 20 release_gate files passed (by the progress lines 447 passed and 2 skipped on Linux, 448 passed and 1 skipped on Windows): the 14 of the earlier rounds and the six added after the third review. flywheel gate ended verdict=PASS rewitness=MATCH. The scripted coding request wrote its file.
• Gateway overhead medians in the timing gate: 0.8 to 2.6 ms on Linux and 2.3 to 20.8 ms on Windows, against a 50 ms budget.
• Would-be assets, from the dry-run job's log: the wheel (d29b5419...) and the sdist (73be36a8...), both changed by the fixes; the plugin and skill zips (unchanged); the source tools plugin (named -dev- in a dry run; changed, because a reviewed source file changed); the VS Code extension (unchanged). The key-shape scan of the wheel and the sdist was not repeated on these builds.

Limits a reader should know before upgrading

No task-success figure has been measured. The retired accuracy comparison showed no measured gain. No paid call to a hosted provider was made: replay tests and a local model only. Claude Code and Codex CLI were not run against the gateway; the anthropic and openai Python SDKs were. The desktop app ships for Windows only, and its installer is built and attached separately. A virtual key's budget is an operating limit and not a hard cap on a provider's bill. One gateway process per Flywheel home. The call that meets a ledger write failure has already reached the provider. The fallback from native function calling to the text protocol rests on the wording of a provider's error, which no provider documents.

Checked locally

• release_assets.py check --tag v2.0.0 --release: clean. check_release_digest.py: the notes print the shipped digest. gate-tests lists 20 files.
• test_version_alignment, test_package_manager_manifests, test_release_digest, test_docs_site, test_release_assets, test_release_drafts, test_benchmark_surface, test_migration_tables: passed, one skipped. Claim language, public instructions and check_writing --gate on the notes: clean. Every pull request merged since v1.9.0 from chore: point Homebrew and Scoop at 1.9.0 #418 on (55, to fix(gateway,code): the remaining findings of the independent review of 2.0.0 (D1, D2, D3, A1, A2, N1 to N5) #473) is cited in the changelog by number. plugins: add the Telos Toolkit Claude Code plugin #471 (the Telos Toolkit plugin folder) merged to main between fix(code): on a native turn the calls that run are the provider's tool-call objects (B1) #472 and fix(gateway,code): the remaining findings of the independent review of 2.0.0 (D1, D2, D3, A1, A2, N1 to N5) #473 with no changelog entry; this branch cites it in one entry that says the folder is in the repository and in no release asset.
• On the fix branch before it merged: every tests/test_gateway*.py except two agent MCP files, the coding session files, the 20 gate files against a wheel built from the branch (the two timing files from the source tree), the gate's scripted coding request and flywheel gate from that wheel, and 20 reversions of single fixes in a scratch copy, each of which made its tests fail.
• Not run locally: the full suite (CI ran it on both pull requests), the desktop build, any hosted call.

🤖 Generated with Claude Code