v0.18.4 — Loop, scheduler & connector hardening

Two adversarial reviews — of the core agent-loop and of the scheduler + integrations/MCP surfaces — found ten real bugs the tests missed, all fixed and regression-tested (fifth review in the series; 27 bugs across six surfaces so far).

Security

• MCP / OpenAPI tool output now goes through the fence + taint ledger. The untrusted-content defense was name-based (a static FETCH_TOOLS set), but connector tool names come from the remote server — so MCP/REST responses were returned raw, unfenced, and never marked as a fetch (taint escalation silently disabled for the most untrusted content). Connector tools now carry an untrusted_output marker LedgeredTool honors regardless of name.
• Connector tools can no longer silently shadow a builtin (into_tool_registry used replace=True); a name collision is now skipped with a warning.
• Agent-created crons start disabled at the scheduler boundary, not just in the learner.

Fixed

• --gen-tests fail-open. When spec-test generation produced no tests, the verifier returned a passing result that supplanted the Manager review and the coverage checklist — a run could be accepted with zero verification. The verifier now ABSTAINS (VerificationResult.abstained) and the loop falls back to its other gates.
• verify-or-revert could delete untouched user files when the workspace exceeded the snapshot cap (5000). A truncated snapshot now skips the delete pass.
• CommandVerifier no longer crashes the run on a non-timeout OSError.
• MCP tool failures are surfaced as errors (isError=True → error: prefix) instead of reading as a valid answer.
• Cron store is crash-safe (atomic temp+replace) and resilient (skips a single malformed entry instead of aborting the load).
• OpenAPI calls fail fast on a missing required path param instead of hitting a different URL.

Gate: ruff + mypy clean, 1387 passed / 3 skipped. pip install -U chimera-agent