Release v0.9.1

[slowdini]

Release notes

Highlights

• Windows is a working platform. Prior releases shipped a Windows binary that
  could not spawn a shell for harness lint --probe or multi-turn dispatch, wrote
  malformed paths into every generated artifact, and refused legitimate writes
  through the sandbox guard. This release fixes the platform end to end — path
  rendering, shell discovery, command quoting, long paths, working-directory
  spelling, and the jq pipelines the shipped recipes depend on — and the test
  suite now runs on windows-latest in CI so it stays fixed.

• Generated artifacts are a wire format, spelled the same way everywhere.
  dispatch.json, conditions.json, judge-tasks.json, dispatch-manifest.md,
  RUNBOOK.md, the guard's deny reasons, and the shadow report now render every
  path with forward slashes regardless of which host produced them. On Windows
  these fields previously mixed separators within a single value
  (/work/cond\run.json). Linux and macOS output is byte-identical to 0.9.0.

• The POSIX shell and jq requirement is stated instead of assumed. run
  preflights for both and warns up front, rather than handing you a correctly
  prepared workspace full of commands your host cannot execute. The requirement
  names jq alongside the shell because the parallel-dispatch and judge recipes
  are jq pipelines, and Git for Windows bundles sh, xargs, tr, and wc
  but not jq.

Behavior changes to know about

• Platform support is now explicit. Linux and macOS are supported. Windows
  through Git Bash works but is deprecated. Preparing a workspace on Windows and
  dispatching it from WSL is unsupported and fails quietly: recipes carry the
  absolute paths of the preparing host, and WSL resolves its own filesystem
  namespace where a C:\... path names nothing. Earlier guidance suggested that
  split; it no longer does.
• EVAL_MAGIC_SH overrides shell discovery. Without it, sh is resolved from
  PATH, then a Git for Windows install, then /bin/sh. bash is never
  accepted, because System32\bash.exe is the WSL launcher and resolves a
  different filesystem namespace.
• run prints a preflight warning when no POSIX shell or jq is present. It
  warns and continues rather than failing — run never dispatches, so preparing
  on a host that cannot dispatch stays valid.
• Path fields in generated artifacts change spelling on Windows as described
  above. Anything parsing those fields on a native separator should read forward
  slashes. Unix output is unchanged.
• Contributors: .gitattributes now checks out every text file as LF, not
  just tests/golden/**. A Windows checkout with the default core.autocrlf=true
  previously produced a CRLF working tree, and since harness descriptors and
  profiles are embedded verbatim in generated artifacts, that silently changed
  program output.

Fixes

• harness lint --probe and multi-turn dispatch could not start on Windows at all
  — /bin/sh was hardcoded in both production paths. They now resolve a real
  shell; the shipped POSIX exec_templates run unmodified.
• An eval author's quoted command_check silently arrived at the child split at
  its spaces on Windows. Command::arg escapes embedded quotes as \", which
  cmd.exe does not understand; the command line is now handed over verbatim.
• The write guard denied legitimate writes on Windows. Two independent causes:
  agents spell paths POSIX-style on every host, and std::path::absolute grafted
  the process drive onto them, so /dev/null became C:\dev\null and
  cmd >/dev/null was refused as a file write. Separately, a single directory can
  have several valid Windows spellings (8.3 short name, junction, subst drive),
  and nothing forced the two sides of the guard's comparison onto one — so a write
  relative to a long-form cwd under a short-form root was denied. A genuine escape
  was always still denied; the guard was falsely strict, never weaker.
• The judge recipe reported 0/N verdicts present and parallel dispatch handed
  every task a corrupted eval_root, dispatch_prompt_path, and outputs_dir on
  Windows. jq's native Windows build opens stdout in text mode, so every \n
  arrived as \r\n and the carriage return rode on the end of each path.
• A run under a deep workspace could commit a baseline that did not contain the
  skill under test. Staged .claude/skills/<slug>/SKILL.md crosses Windows'
  260-character limit, and the task repository's deliberate config isolation
  discarded any global core.longpaths. The loud form aborted with
  Filename too long; a few characters deeper, git add warned, exited zero, and
  committed silently — so every later diff would have been measured against a
  baseline missing its subject.
• skipped_prompt_unread stayed 0 on Windows, recording a dispatch that never
  received its instructions as valid data. The check searched serialized JSON for
  a raw path, and serialization escapes every \ separator. It now walks the
  args' string leaves and compares with separators normalized — which also matters
  off Windows, since the dispatch path is wire format while the transcript echoes
  the agent's own spelling.
• A stray-write report could come back clean for an arm that read the live skill
  source, presenting a contaminated arm as comparable data.
• The staged-source collision check let a refutation through on exactly the
  collision it exists to block, having found no basename to compare.
• harness lint --probe reported false failures for {guard_args} in codex's
  parallel and judge command templates. The placeholder had no render-only
  stand-in, though the real dispatch path resolves it fine.

Internal changes

• CI runs the test suite on ubuntu-latest and windows-latest with
  fail-fast: false; clippy runs on both, since the #[cfg(windows)] arms are
  lint-invisible on Ubuntu.
• Tests are gated on capabilities rather than on the OS. #[cfg(unix)] hid tests
  from compilation and clippy on the other host and hid the coverage gap with
  them; report_skip prints why a test skipped, and
  EVAL_MAGIC_REQUIRE_POSIX_TOOLS=1 — set on both runners — turns any skip into a
  failure.
• A hidden __fixture subcommand supplies the predictable child process the suite
  needs, in one invocation that sh -c and cmd /C parse identically, replacing
  two divergent dialects of shell stub.
• Ten guard tests were passing through a fail-open path while appearing to cover
  the guard: they built marker and manifest JSON with format!, and an
  interpolated Windows path embeds invalid JSON escapes. They now serialize with
  serde_json, as the production installer does.
• core::fs gains artifact_path and normalize_separators, the rendering and
  comparison halves of the wire-format work.
• The prompt-read guard moves out of record_runs.rs into
  record_runs/prompt_read.rs, bringing the module back under the size threshold.
• The long-path tests canonicalize their base before padding: a runner's %TEMP%
  can be an 8.3 short name that git expands before measuring, which moved the
  deepest test across a ceiling and read as a Windows-only product failure.
• docs/developer_overview.md records the platform support tiers; contributor
  docs updated for the third gated capability.