What shipped, and when.
Skep was daily-driven through roughly a hundred internal versions before the public launch. The public repository opens at v1.0.1 — because that is what the code was when it was published. The full engineering record lives in the version history.
The v106 audit round. External coding engines get a writable .toolchain/ home inside the sandboxed workspace — Claude Code's own tooling and npm install now survive a run; the worker heartbeats through long commands instead of reading as dead. Re-verification stops saying "could not re-verify" when it ran and failed — the unconfirmed verdict is on the approval card before you say yes. Tool results pair by call id, Discord approval buttons ack inside the 3-second deadline, card timeouts measure operator absence, and skep doctor names poisoned and dead repo registrations.
The road to launch
Milestones from the internal version history — each one field-tested, fixed, and landed with its own evidence before the next began.
The v106 audit round goes public
Thirteen fixes from the 2026-07-29 full audit, ported commit-by-commit onto the public tree: workspace toolchain homes for external engines, worker heartbeats under long commands, honest re-verification wording on every approval surface, tool-call-id pairing with a store migration, deferred Discord interaction acks, operator-absence card timeouts, and doctor advisories for poisoned registrations. CI unit tests now run under pytest-xdist on both platforms.
Public launch
The repository goes public, the package lands on PyPI, and skep.anmolnoor.com goes live. Local release gates: lint, types, unit, smoke, reliability, sandbox smoke, hygiene scan, docs link check, wheel and container smokes.
Invariant hardening and coding engines
G10 re-verifies with the project's pinned verify command instead of the worker's own nomination; project setup infers that pin from the repo's entry point by default. Claude Code, Codex, and Aider become first-class coding engines (ADR 0047) — forced into sandbox execution with doctor probes per binary. Every mutating verb gains an operator face, enforced by a surface-parity test (ADR 0050).
Agent Skills shelves and session approvals
External Agent Skills shelves register with instruction packs loading zero-grant; script-shipping packs draft onto the promotion ladder and activate only through an explicit promote (ADR 0045). A session approval tier joins the once/remember pair (ADR 0046).
The Queen learns; daily-driver era begins
Operator policy layer, pinned prompt assembly, observer ticker, cron chaining, per-chat context management, the full git/PR surface with carded mutations, Discord/Telegram/Slack approval cards, and the Streamable HTTP MCP runner. Skep becomes the operator's daily driver on 2026-07-17.
The command deck
Chat messages starting with / parse client-side and map onto existing verbs — the model never sees them. Mutations become audited operator-command actions with the same confirmation cards.
The roadmap and the field-test arc
Six roadmap versions landed in one unattended run, then two rounds of field-test friction fixes: deterministic baselines, policy that actually applies, scheduler blind spots, and the landing/policy arc that produced the patch-as-approval rule.
Contract v0.2, castes, and per-domain network
The worker contract becomes an open caste registry with per-task domain allowlists ([] means deny all). The nightly dependency/audit bot proves the spine offline and deterministically.
Sandbox and re-verification
Workers run under macOS Seatbelt with escape tests proving the boundary. A completed claim is no longer trusted: the supervisor re-applies the patch to a clean worktree and re-runs the recorded verification itself (ADR 0006). Suspend/resume, auto-approval rules, and usage accounting land in the same push.
The spine
One worker, one lifecycle, proven end-to-end: worktree → contract task → sandboxed worker → events and evidence → durable audit record → teardown. Including the death path: hung workers killed on heartbeat loss, crashed workers get a synthesized terminal event, orphaned worktrees swept.
First public baseline
The launch feature set frozen: sandboxed execution, independent re-verification, patch approval, durable audit evidence, learned approval templates, and a Claude Code adapter.