0.55.0 — the approval card asks the safe way, and a turn can stop on its plan

The approval card had the fail-safe backwards

In the desktop app, "Allow this once" was drawn first and styled as the primary button — and because the card mounts inside a dialog whose focus trap takes the first focusable element, the caret landed on it. Answering with Enter, without reading, approved. The terminal UI and the REPL already refused by default and had written down why; the desktop shipped the exact inverse. Refuse comes first now. The same card also never rendered the risk level the API sends, so "delete a file" and "read a file" were drawn identically — the level is shown.

A coding turn can stop on its plan

Opt-in per turn: the agent proposes a tool-free plan and waits before anything is touched. It is an extra stop, never a permission — the per-action gate underneath is unchanged and stays on, because a model can approve a plan and then deviate from it. Off by default, because it costs a model call and a wait on the surface you use most, and a safety feature that makes the app feel slow is one that gets switched off for good.

Security

• Six of the eight open dependency alerts are closed, including the critical one and all three highs. Every fix is a lockfile resolution, so no interface changed. The two that remain are written into CI beside the audits with their reasons: one cannot be bumped without a Tauri upgrade of its own and affects the Linux backend only; the other has no patched version in existence and is reachable only through opt-in extras.
• An allowlist that keeps code_interpreter is not a boundary, and now says so. A permission scoped to one command that can run anything reads as a restriction and is not. Audited across this tree, the defect came back absent everywhere it could have lived — what was missing is the case where a list is in force and bounds nothing. That now warns, and writes its audit entry even when the list excluded nothing, because a warning lives in a log nobody keeps.
• The secret scanner is pinned to a version we chose rather than inherited from the action's hard-coded default, and two destructive denylist rules were hardened so the spelling of a flag no longer decides whether they fire.

Fixed

The spec-test generator stopped eating fences. A generated test containing a fenced docstring had every fence deleted, wherever it sat, and what survived was not the file the model wrote. An unclosed opener is now reported rather than repaired — silently trimming it is how a boundary failure gets recorded as a content failure.

And what we measured and did not ship

Five results came back negative and are published as such rather than dropped:

• a lexical false-success detector reproduces the published AUROC band only where it can learn which task it is — 0.93 on a random split, 0.60 held out;
• comparing what the agent said against what it changed is the only leak-free signal either bench found, and is still not good enough to build on;
• our fusion panel's three models carry about one and a half independent votes, so "all three agreed" is not three confirmations;
• adding two spaces to an action turned a BLOCK into a REVIEW in the governance judge, which is the paraphrase floor our own protocol had required and never measured;
• and one task in our own benchmark could not have passed, because the grading environment had no pytest. Re-graded, the agent passes it 19 times in 24 — and no published effect moves by more than 0.001. A preflight now checks every grader's own dependencies before a run is paid for.

The full account of each, with the numbers and what was retracted, is in CHANGELOG.md.

Caveats

Installers are unsigned outside the updater path and will warn on first run. The plan gate does nothing until you turn it on. Cancellation is cooperative: it stops before the next model call, and calls already in flight finish and are billed.