adeelahmad · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -25,6 +25,8 @@ tag in lockstep. Tag releases as `vMAJOR.MINOR.PATCH`.
 ### Added
 - Brand kit and repo front page: `docs/brand/` holds the mark (an **a** whose bowl is a red-to-green loop passing a gold gate, with a 16 px cut), lockups, light and dark README banners, favicons, app icons, the site's OG card and the GitHub social preview, all generated by `docs/brand/gen_brand.py` from one palette with WCAG checks (rules in `docs/brand/README.md`). The README leads with the mission layer, the agent principles and the door rule, the supported hosts and the measured demo runs; the site carries the favicon and Open Graph/Twitter card metadata; `SECURITY.md` and bug/feature issue forms are new.
 - The mission layer's six fixed roles (ROADMAP §4.12, M9.9): `market-researcher`, `product-tester`, `state-assessor`, `evaluator`, `mission-planner` and `ethics-reviewer`, each a persona with a four-case eval suite, a model route (the four that judge on the planning route, the two that measure on the worker route), hook matchers on Claude Code, Codex and OpenCode, and Codex/OpenCode agents from `aloop install` (which also renders the mission skill for OpenCode as `aloop-mission` once it ships). `plugin/mission/roles.json` names the paths each role writes. `gate-mission-scope` (PreToolUse) is the role path guard: a mission role never writes source, mission.json or another role's dir, never commits and never runs a human's approval; a builder never writes `docs/agents/mission/` or runs a writing `mission` command; the supervisor never hand-writes a role's artifact. No one hand-writes `docs/agents/mission/ledger.jsonl` or the captured prompts a grant reads (`<run data>/transcripts/`), runs a hook's `transcripts prompt|record|…`, or starts a host session from a tool call where a mission is set (its prompt would count as the human's words, M9.17), and no dispatched agent runs `mission baseline restore`, `events authority` or an `events emit` of a human event. `gate-mission-artifact` records what exists when a role starts and, at its stop, requires an artifact in its own paths that passes the core contract and its area's check, refuses a deleted artifact, a change to another role's or a ledger that no longer verifies, and records `artifact.created|updated` as provenance. A mission write never arms the sprint lock. The scope gate reads a Bash command as the shell would (`_shellread.py`: quotes, comments, line continuations, heredocs, wrappers such as `timeout` and `env`, `bash -c`, `eval`, a script run by an interpreter, variables and `$(mktemp)`). Each area's check runs once per artifact with its id or subject, an ethics hard line is the reviewer's finding, not a defect, and a derived goal whose only blocks are its pending ethics review waits on the Ethics Reviewer, not on the planner. Test: `mission-roles.test.py` (32 checks, with each role run through the real journeys, baseline, assess, evaluate and ethics, goal, research and judge areas), `mission-scope-bash.test.py` (220 commands), `opencode-plugin.test.mjs`.
+- The mission loop end to end, offline (ROADMAP §4.12, M9.13): `mission-e2e.test.py` drives `mission tick` from a new mission through research, a journey, a confirmed baseline, a gap list, a goal, its intents and one Aladdin sprint per intent to GOAL MET and the next raise of the bar, with zero tokens and each step done through the CLI the way its role or the human does it. A fresh clone hands out the same action. Ethics reviews and hard lines are now ledger rows (M9.24), so a clone no longer asks for every review again or forgets a hard line; the ledger row wins over its run-log copy, and a broken ledger makes every ethics verdict `broken`. Tests: `mission-e2e.test.py`, `mission-ethics.test.py`.
+- A mission baseline binds the mission's direction (ROADMAP §4.12, M9.25): `direction_sha256` covers the mission id, statement, mode and constraints, so raising a budget cap or changing the cadence (and approving it) keeps the confirmed baseline, while a new direction still asks for a new version. Reason: M9.8's budget test, a raised cap asked for a new baseline though "best" had not changed. Test: `mission-baseline.test.py`.
 - Mission approvals are the human's own words (ROADMAP §4.12, M9.17): `mission approve`, `baseline confirm|restore`, `journeys approve`, `mission ethics consent` and `mission telemetry consent` record only when a prompt the `UserPromptSubmit` hook captured has a line such as `approve msn_… 3f2a9c1b` (the verb and the first 8 hex of the content's sha
65CD
256); until then they ask (exit 3) with that line. `--by` alone, a negated line, another code, a line older than a later decision about the subject (for a baseline, any version's confirmation) and a hand-appended ledger row without such a line grant nothing. Reason: an approval was only as strong as `--by`, so a role could approve its own mission change. Tests: `mission-core.test.py`, `mission-baseline.test.py`.
 - Mission goals and the Aladdin handoff (ROADMAP §4.12, M9.11): `aloop mission goal derive` turns the Evaluator's gaps (in its own priority order) into a goal (autonomous: the top N; spoon-fed: the gaps the human picks with `--pick … --by`, which is the goal's approval) that names its targets and is bound to the mission's content, the eval, the principles block for the mission's mode and the Aladdin autonomy it maps to; `goal check` holds every intent until the goal is the content `derive` recorded, the mission is unchanged and approved and the mission's and the goal's ethics pass; `goal intents` writes one Intent Contract per gap (`intent new --source mission --goal --gap`, filled without a model, and refused for a goal that fails its check); `goal next` normalizes them one sprint at a time; `goal close` marks an active goal met once an evaluation of it says so; goals come only from the latest recorded evaluation, whose state `mission assess` measured, and `events emit` can no longer forge the state, eval or intent records; a gap a hard line fixed is held out of every later goal; `events trace` walks a commit back through intent → goal → eval → ethics → mission → its approver. Test: `mission-goal.test.py`.
 - Mission layer hardening (ROADMAP §4.12, a second adversarial review of M9.0/M9.2/M9.3/M9.10, 31 unique findings, each now a test): gates decide from ledger records, not files. Frozen journeys, replacements and retirements, states (`state.assessed`) and the active goal (`goal.derived`) are read from the ledger, so a hidden or edited file changes nothing. Nothing decides from a broken ledger or an edited current baseline, and a restore cannot be undone by a re-apply. The runner pins every project file it runs and refuses links, inline code and scripts outside the project. A judged metric pins its rubric by sha256. A veto binds the content in any order. An unknown flag exits 64. Text is UTF-8 in any locale. GA4's reserved names are one list, and `ethics.*` and `goal.*` decisions are ledger rows. Tests: `mission-{core,journeys,baseline,evaluate}.test.py`.