chore: promote verified dev to main for v1.0.42

.github/actions/record-verification/action.yml

@@ -0,0 +1,40 @@
+name: Record successful verification
+description: Save evidence after every verification step in the caller has succeeded
+inputs:
+  key:
+    description: Exact evidence key from verified-content
+    required: true
+  path:
+    description: Evidence path from verified-content
+    required: true
+  job-name:
+    description: Exact GitHub job name used to locate the authoritative result
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Record tested product content
+      shell: bash
+      env:
+        EVIDENCE: ${{ inputs.path }}
+      run: node script/ci-evidence.mjs proof
+    - name: Upload immutable verification proof
+      id: proof
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: ci-verification-${{ github.job }}-${{ runner.os }}-${{ runner.arch }}-${{ github.run_attempt }}
+        path: ${{ inputs.path }}.artifact/verification.json
+        retention-days: 2
+        if-no-files-found: error
+    - name: Record verification source
+      shell: bash
+      env:
+        EVIDENCE: ${{ inputs.path }}
+        CHECK_JOB: ${{ inputs.job-name }}
+        ARTIFACT_ID: ${{ steps.proof.outputs.artifact-id }}
+      run: node script/ci-evidence.mjs record
+    - name: Save successful verification
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}

.github/actions/verified-content/action.yml

@@ -0,0 +1,57 @@
+name: Previously verified content
+description: Restore exact successful verification evidence, excluding only the SpecGit delivery record
+inputs:
+  check:
+    description: Stable job identifier, separate for every verification suite
+    required: true
+  job-name:
+    description: Exact GitHub job name whose successful conclusion must be confirmed
+    required: true
+  runner-label:
+    description: Runner label which must appear in the source job's platform evidence
+    required: true
+outputs:
+  reused:
+    value: ${{ steps.verify.outputs.reused }}
+    description: Whether this exact content has already passed this suite today
+  key:
+    value: ${{ steps.key.outputs.value }}
+    description: Exact evidence key
+  path:
+    value: ${{ steps.key.outputs.path }}
+    description: Evidence file path
+runs:
+  using: composite
+  steps:
+    - name: Fingerprint verification inputs
+      id: content
+      shell: bash
+      run: node script/ci-fingerprint.mjs
+    - name: Identify verification evidence
+      id: key
+      shell: bash
+      env:
+        CHECK: ${{ inputs.check }}
+        FINGERPRINT: ${{ steps.content.outputs.fingerprint }}
+        DAY: ${{ steps.content.outputs.day }}
+      run: |
+        echo "value=verified-v4-${RUNNER_OS}-${RUNNER_ARCH}-${DAY}-${CHECK}-${FINGERPRINT}" >> "$GITHUB_OUTPUT"
+        echo "path=${RUNNER_TEMP}/verified-${CHECK}.txt" >> "$GITHUB_OUTPUT"
+    - name: Restore successful verification
+      id: restore
+      if: github.event_name != 'workflow_dispatch'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.key.outputs.path }}
+        key: ${{ steps.key.outputs.value }}
+    - name: Verify the source job and product content
+      id: verify
+      if: steps.restore.outputs.cache-hit == 'true'
+      shell: bash
+      env:
+        EVIDENCE: ${{ steps.key.outputs.path }}
+        CHECK_JOB: ${{ inputs.job-name }}
+        CHECK_RUNNER: ${{ inputs.runner-label }}
+        PRODUCT_FINGERPRINT: ${{ steps.content.outputs.fingerprint }}
+        GH_TOKEN: ${{ github.token }}
+      run: node script/ci-evidence.mjs verify

.github/releases/v1.0.42-branch-audit.md

@@ -0,0 +1,133 @@
+# v1.0.42 branch reconciliation
+
+Snapshot: 2026-09-07, before creating the release preparation branches. Scope: all 100 local branches and seven `origin` branches of `LeXwDeX/OpenCode-GraphAgent`. Upstream development branches belong to the upstream project and are outside this fork release.
+
+The original main worktree contains uncommitted local documentation and SpecGit maintenance changes. Those were preserved and are not treated as branch commits. No branch or worktree was deleted.
+
+## Required integration
+
+- `origin/dev` was `345e5c13e7bdce2c739bace6327a896ebed88075`, 17 commits behind `origin/main` (`b37b3368accb2d0cc6aecc4f576581f97900d97b`). The main history includes accepted Hooks fixes and v1.0.40/v1.0.41 release records.
+- Goal source `9a651339b1df92e0739a9653e7f08f4c807f7a58` adds the Goal runtime, concurrency, command, budget, reconnect, and PTY regression repairs tracked by PR #573.
+- Candidate PR #577 preserves that source commit as an ancestor, includes the main history, and retains all seven Goal issue closing references plus #576 and the requested CI optimization #578. Product content after the integration merge is identical to the verified Goal source; subsequent candidate changes add release documentation and exact-content CI evidence reuse for SpecGit record updates.
+
+## Historical differences
+
+- `c417e1ee374c31d210dd101a973115f65ce61630` occurs on six stale test-created `opencode/*` branches. Main already contains replacement `0c46896bfe`; teardown implementation and regression tests are byte-identical. The replacement additionally asserts DAG graph revision. Reapplying the old commit would add no missing behavior.
+- `ci/519-auto-close-linked`, `feat/475-sdk-openapi-race`, `fix/440-assemble-google-key`, and `origin/feat/473-git-head-watcher` have only old `.specgit.yaml` binding commits outside main. Their implementation ancestors are already contained.
+- `docs/460-release-notes-v1-0-35` has one old commit untracking the delivery record. Current main explicitly carries delivery records for CI and already ignores local assets; this superseded metadata policy is not reapplied.
+
+## Full inventory
+
+| Branch | Outside dev | Outside main | Disposition |
+| --- | ---: | ---: | --- |
+| `chore/476-sync-main-to-dev-before-repair-wave` | 0 | 0 | Already contained in dev and main |
+| `chore/517-sync-v1-0-39` | 0 | 0 | Already contained in dev and main |
+| `chore/543-stable-release` | 3 | 0 | Contained in main; restored to dev through main ancestry |
+| `chore/554-dag-release` | 7 | 0 | Contained in main; restored to dev through main ancestry |
+| `chore/refresh-specgit-harness` | 0 | 0 | Already contained in dev and main |
+| `chore/sync-main-to-dev` | 0 | 0 | Already contained in dev and main |
+| `chore/sync-main-to-dev-before-repair-wave` | 0 | 0 | Already contained in dev and main |
+| `ci/519-auto-close-linked` | 1 | 1 | Historical binding only; no missing implementation |
+| `codex/dag-audit-base` | 0 | 0 | Already contained in dev and main |
+| `codex/dag-release-staging` | 0 | 0 | Already contained in dev and main |
+| `codex/hooks-runtime-reliability` | 4 | 0 | Contained in main; restored to dev through main ancestry |
+| `dev` | 0 | 0 | Already contained in dev and main |
+| `docs/460-release-notes-v1-0-35` | 1 | 1 | Superseded delivery-record tracking policy |
+| `docs/470-release-v1-0-37-notes` | 0 | 0 | Already contained in dev and main |
+| `docs/477-remove-legacy-artifacts` | 0 | 0 | Already contained in dev and main |
+| `docs/510-release-notes-v1-0-38` | 0 | 0 | Already contained in dev and main |
+| `docs/release-notes-v1.0.34` | 0 | 0 | Already contained in dev and main |
+| `docs/release-notes-v1.0.35` | 0 | 0 | Already contained in dev and main |
+| `feat/433-issue433` | 0 | 0 | Already contained in dev and main |
+| `feat/433-shell-silence-guard` | 0 | 0 | Already contained in dev and main |
+| `feat/435-dag-project-discovery` | 0 | 0 | Already contained in dev and main |
+| `feat/458-giant-summary-guard` | 0 | 0 | Already contained in dev and main |
+| `feat/468-replan-topology-refresh` | 0 | 0 | Already contained in dev and main |
+| `feat/472-issue472` | 0 | 0 | Already contained in dev and main |
+| `feat/475-sdk-openapi-race` | 1 | 1 | Historical binding only; no missing implementation |
+| `feat/477-issue477` | 0 | 0 | Already contained in dev and main |
+| `feat/498-macos-integrity-boundary` | 0 | 0 | Already contained in dev and main |
+| `feat/519-auto-close-linked` | 0 | 0 | Already contained in dev and main |
+| `feat/521-specgit-bootstrap-wrapper` | 0 | 0 | Already contained in dev and main |
+| `feat/524-event-retention-reclamation` | 0 | 0 | Already contained in dev and main |
+| `feat/528-specgit-pr-base-dev` | 0 | 0 | Already contained in dev and main |
+| `feat/529-specgit-branch-type-preflight` | 0 | 0 | Already contained in dev and main |
+| `feat/530-specgit-bootstrap-rollback` | 0 | 0 | Already contained in dev and main |
+| `feat/541-preserve-npm-lock` | 0 | 0 | Already contained in dev and main |
+| `feat/dag-project-discovery` | 0 | 0 | Already contained in dev and main |
+| `feat/shell-silence-guard` | 0 | 0 | Already contained in dev and main |
+| `feat/sync-upstream` | 0 | 0 | Already contained in dev and main |
+| `feat/sync-upstream-dev` | 0 | 0 | Already contained in dev and main |
+| `fix/440-assemble-google-key` | 2 | 2 | Historical binding only; no missing implementation |
+| `fix/465-tui-crashes-on` | 0 | 0 | Already contained in dev and main |
+| `fix/474-stabilize-dirty-worktree` | 0 | 0 | Already contained in dev and main |
+| `fix/475-sdk-openapi-race` | 0 | 0 | Already contained in dev and main |
+| `fix/500-hook-command-grandchildren` | 0 | 0 | Already contained in dev and main |
+| `fix/506-accept-builtin-spec` | 0 | 0 | Already contained in dev and main |
+| `fix/538-native-tool-settlement` | 0 | 0 | Already contained in dev and main |
+| `fix/545-dag-audit-reliability` | 0 | 0 | Already contained in dev and main |
+| `fix/557-hooks-runtime-reliability` | 14 | 0 | Contained in main; restored to dev through main ancestry |
+| `fix/568-goal-reliability` | 22 | 5 | Integrate Goal source and its main ancestry |
+| `fix/dirty-worktree-classify` | 0 | 0 | Already contained in dev and main |
+| `fix/goal-reliability` | 17 | 0 | Contained in main; restored to dev through main ancestry |
+| `fix/httpapi-composite-exit` | 0 | 0 | Already contained in dev and main |
+| `fix/sdk-openapi-race` | 0 | 0 | Already contained in dev and main |
+| `fix/specgit-harness-assets` | 0 | 0 | Already contained in dev and main |
+| `fix/tui-jsx-runtime` | 0 | 0 | Already contained in dev and main |
+| `main` | 4 | 0 | Contained in main; restored to dev through main ancestry |
+| `merge-scratch/probe-upstream-dev` | 0 | 0 | Already contained in dev and main |
+| `opencode/brave-panda` | 0 | 0 | Already contained in dev and main |
+| `opencode/calm-falcon` | 0 | 0 | Already contained in dev and main |
+| `opencode/calm-island` | 0 | 0 | Already contained in dev and main |
+| `opencode/cosmic-eagle` | 3 | 3 | HttpAPI fix already integrated as 0c46896bfe; old binding only |
+| `opencode/crisp-comet` | 0 | 0 | Already contained in dev and main |
+| `opencode/eager-orchid` | 0 | 0 | Already contained in dev and main |
+| `opencode/gentle-wizard` | 0 | 0 | Already contained in dev and main |
+| `opencode/glowing-meadow` | 0 | 0 | Already contained in dev and main |
+| `opencode/happy-engine` | 0 | 0 | Already contained in dev and main |
+| `opencode/happy-otter` | 0 | 0 | Already contained in dev and main |
+| `opencode/hidden-engine` | 0 | 0 | Already contained in dev and main |
+| `opencode/hidden-garden` | 0 | 0 | Already contained in dev and main |
+| `opencode/hidden-river` | 0 | 0 | Already contained in dev and main |
+| `opencode/kind-mountain` | 0 | 0 | Already contained in dev and main |
+| `opencode/kind-pixel` | 0 | 0 | Already contained in dev and main |
+| `opencode/misty-moon` | 3 | 3 | HttpAPI fix already integrated as 0c46896bfe; old binding only |
+| `opencode/neon-garden` | 0 | 0 | Already contained in dev and main |
+| `opencode/neon-moon` | 0 | 0 | Already contained in dev and main |
+| `opencode/nimble-otter` | 0 | 0 | Already contained in dev and main |
+| `opencode/nimble-panda` | 0 | 0 | Already contained in dev and main |
+| `opencode/playful-knight` | 3 | 3 | HttpAPI fix already integrated as 0c46896bfe; old binding only |
+| `opencode/playful-nebula` | 0 | 0 | Already contained in dev and main |
+| `opencode/playful-planet` | 0 | 0 | Already contained in dev and main |
+| `opencode/proud-cabin` | 0 | 0 | Already contained in dev and main |
+| `opencode/proud-pixel` | 0 | 0 | Already contained in dev and main |
+| `opencode/quick-canyon` | 0 | 0 | Already contained in dev and main |
+| `opencode/quiet-panda` | 0 | 0 | Already contained in dev and main |
+| `opencode/quiet-pixel` | 3 | 3 | HttpAPI fix already integrated as 0c46896bfe; old binding only |
+| `opencode/quiet-river` | 0 | 0 | Already contained in dev and main |
+| `opencode/silent-otter` | 0 | 0 | Already contained in dev and main |
+| `opencode/silent-tiger` | 0 | 0 | Already contained in dev and main |
+| `opencode/stellar-circuit` | 3 | 3 | HttpAPI fix already integrated as 0c46896bfe; old binding only |
+| `opencode/sunny-canyon` | 3 | 3 | HttpAPI fix already integrated as 0c46896bfe; old binding only |
+| `opencode/sunny-comet` | 0 | 0 | Already contained in dev and main |
+| `opencode/sunny-garden` | 0 | 0 | Already contained in dev and main |
+| `opencode/swift-forest` | 0 | 0 | Already contained in dev and main |
+| `opencode/swift-island` | 0 | 0 | Already contained in dev and main |
+| `opencode/swift-otter` | 0 | 0 | Already contained in dev and main |
+| `opencode/tidy-panda` | 0 | 0 | Already contained in dev and main |
+| `opencode/witty-forest` | 0 | 0 | Already contained in dev and main |
+| `test/512-leftover-hardening` | 0 | 0 | Already contained in dev and main |
+| `test/git-head-watcher` | 0 | 0 | Already contained in dev and main |
+| `tmp/lane-473-base-pointer` | 0 | 0 | Already contained in dev and main |
+| `origin` | 17 | 0 | Contained in main; restored to dev through main ancestry |
+| `origin/dev` | 0 | 0 | Already contained in dev and main |
+| `origin/feat/473-git-head-watcher` | 2 | 2 | Historical binding only; no missing implementation |
+| `origin/feat/475-sdk-openapi-race` | 0 | 0 | Already contained in dev and main |
+| `origin/fix/423-open-security-alerts` | 0 | 0 | Already contained in dev and main |
+| `origin/fix/440-assemble-google-key` | 2 | 2 | Historical binding only; no missing implementation |
+| `origin/fix/568-goal-reliability` | 21 | 4 | Integrate Goal source and its main ancestry |
+| `origin/main` | 17 | 0 | Contained in main; restored to dev through main ancestry |
+
+## Verification
+
+Before merging, verify candidate ancestry for `9a651339b1`, `b37b3368ac`, `b56d931b28`, and `0c46896bfe`; require current-head CI and SpecGit acceptance. After dev integration and main promotion, verify those same required commits are ancestors of both remote branches. The actual published tag and assets are verified after the official release workflow finishes.

.github/releases/v1.0.42.md

@@ -0,0 +1,54 @@
+## opencode {VERSION}
+
+{Prerelease/Stable} release from `{branch}` branch. Goal execution now preserves user intent across concurrent turns, and Hooks enforce their execution, decision, and cancellation contracts.
+
+---
+
+### 🎯 Features
+
+- **Goal turn budgets**: use `/goal --max-turns N <objective>` to set a total budget and `/goal resume --max-turns N` to increase it while preserving turns already used ([#572](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/572)).
+
+---
+
+### 🐛 Bug Fixes
+
+- **Goal verdict races**: serialize judgment commits with user, loop, shell, and control-command admission; recheck the current message boundary, Goal revision, and automation lease before accepting a delayed result ([#568](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/568)).
+- **Uninterrupted Goal progress**: autonomous questions return without waiting for interactive input; ordinary user turns keep normal questions. Repeated status queries and subgoal edits no longer replace work boundaries, consume extra turns, or strand a continuation ([#569](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/569), [#570](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/570)).
+- **Production Goal commands and reconnects**: explicitly provide Goal to the production prompt runtime. Preserve the last known Goal after a reconnect error, clearing it only on a confirmed 404 ([#571](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/571), [#575](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/575)).
+- **Hooks enforcement and feedback**: honor prompt stop/block and permission denials, retain valid siblings after malformed configuration, preserve feedback from failed tools and MCP calls, and claim one-shot hooks atomically ([PR #567](https://github.com/LeXwDeX/OpenCode-GraphAgent/pull/567)).
+- **Hooks lifecycle**: constrain inspection commands to validated read-only operations, propagate timeout/cancellation to child work, preserve interrupted Bash output, and carry file-change events and asynchronous rewake across runtime boundaries ([PR #567](https://github.com/LeXwDeX/OpenCode-GraphAgent/pull/567)).
+
+---
+
+### ⚙️ CI / Engineering
+
+- **SpecGit record updates**: reuse successful verification for identical product content, suite, platform, runner label, and UTC day. Only the root `.specgit.yaml` record is excluded; source, policy, workflow, dependency, and documentation changes remain inputs. Cache misses and manual runs execute the full checks ([#578](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/578)).
+
+- **PTY environment verification**: wait for the output assertion before allowing the shell to exit, removing the fixed five-second connection window. A six-second delayed connection passes with the new handshake ([#574](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/574)).
+- **Branch reconciliation**: review all 100 existing local branches and seven origin branches. Restore the 17 main-only commits to dev alongside the Goal delivery. Remaining historical differences are obsolete delivery metadata or an already-integrated HttpAPI fix; see the candidate branch audit ([#576](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/576)).
+
+---
+
+### 🧪 Test Summary
+
+```
+opencode suite:      4571 pass, 0 fail, 23 existing skips, 1 existing todo
+other workspaces:    1760 pass, 0 fail
+Goal TUI reconnect:     6 pass, 0 fail
+DAG coverage gate:    820 pass, all existing per-file floors met
+typecheck:          29/29 packages green
+lint:               4842 warnings, 0 errors, unchanged 4850 cap
+HttpAPI composite: 3 x 230 pass, 0 fail, 0 skip, 0 missing
+```
+
+---
+
+### 🔍 Verification
+
+Local verification used Bun 1.3.14. Real AppRuntime and SessionPrompt/GoalLoop integration tests cover production dependency wiring, delayed done/blocked/continue verdicts, 25 consecutive status queries, subgoal edits, concurrent user/loop/shell admission, and both autonomous and interactive questions. The final dependency grouping was separately rechecked with 88 passing production/prompt tests and the workspace typechecks. Standards and Spec reviews found no remaining blockers.
+
+The release candidate includes the already-accepted Hooks delivery from [PR #567](https://github.com/LeXwDeX/OpenCode-GraphAgent/pull/567). Each integration and promotion is gated by current-head CI and SpecGit acceptance. The official release workflow validates the reference templates against the releasing runtime, builds Linux/macOS/Windows archives, verifies macOS installation behavior, and publishes SHA256SUMS with the release assets. Live external model providers and MCP services are not claimed as validated.
+
+---
+
+**Full changelog:** [`{previous_tag}`...`{current_tag}`](https://github.com/LeXwDeX/OpenCode-GraphAgent/compare/{previous_tag}...{current_tag})