v2.12.0

Released 2026-07-02.

Worker isolation, replay integrity, and security-taxonomy mapping.

Features

• Deterministic runs now record whether provider-side context compaction was active for each agent request, folded into the HMAC/Merkle step fingerprint, so a replay that diverges because compaction rewrote what the model actually saw is detected and attributed rather than silent. In deterministic-record and hermetic-replay modes the adapter additionally makes a best-effort request to suppress the CLI's client-side auto-compaction. The fingerprint is the load-bearing guarantee; the suppression is best-effort. (replay integrity)
• Model effort level (low/medium/high/max) is now a first-class routing and replay dimension. The deterministic cascade fills an effort level from task scope, complexity, and retry count when the caller has not pinned one, so trivial tasks stop overpaying, and the effective effort enters the step fingerprint. The journal record is schema-versioned: legacy records without an effort field verify byte-for-byte, and a changed effort is detected as divergence across the local reader, the offline receipt verifier, and the redacted-publish re-anchor. (deterministic scheduler + replay)
• bernstein audit export --standard owasp-asi and --standard owasp-skills produce a control-coverage view mapping the OWASP Top 10 for Agentic Applications (ASI01-ASI10) and Agentic Skills Top 10 (AST01-AST10) onto the mechanisms and audit-event types a run already emits, alongside the existing EU AI Act Article 12 export. Partially-covered controls are reported as partial in the summary (mapped/partial/todo) rather than hidden. (HMAC audit chain)
• bernstein interop a2a conformance verifies an emitted agent card round-trips: JCS canonicalization, detached Ed25519 JWS signature, required fields, expiry, and issuer, each reported pass or fail, so an operator can prove a card verifies offline. (Ed25519 signed identity)

Security

• Spawned workers can no longer silently enable embedded agent-team coordination. The per-adapter environment filter strips the CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS gate (and forward-looking *_AGENT_TEAMS variants) by default even from an operator-widened allowlist and even after the secrets overlay, and the Claude adapter pins the gate off in the merged worker settings file. Enabling it requires an explicit host opt-in (BERNSTEIN_ALLOW_EMBEDDED_AGENT_TEAMS), which records an adapter.embedded_agent_teams_enabled event to the HMAC audit chain so an embedded team is attested rather than invisible. This preserves the one-worker-one-audit-trail invariant. (env isolation + audit chain)
• bernstein doctor now reports when a discovered adapter CLI is below a known-safe version floor, using a data-driven advisory map, so an out-of-date spawned agent surfaces as a supply-chain warning rather than a silent risk. (adapter conformance + doctor)