Skip to content

Hollow

v5.5.5 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

auth breaking_upgrade rce_ssrf

Summary

AI summary

Goals now run within atomic transactions that roll back on failure, and capability deployments enforce semantic validation contracts.

Full changelog

What's new in 5.5.5

Feedback loop integrity

The core insight of this release: agents need an accurate picture of their environment to act coherently. A tool that runs cleanly but returns garbage is worse than a failed deployment — it gives the agent a false map. Several systems now report truth instead of mechanical success.

  • Semantic validation in synthesize_capability — after a tool is deployed, the system calls it and asks Ollama whether the return value matches what the description promised. Description is now a contract. Mismatch = deployment rejected with specific error.
  • check_claude_status now returns ok: False for rejected and not_found requests. These are failure signals, not informational responses. Agents that check a rejected request will have the goal step fail — triggering eventual goal abandonment instead of infinite loops.
  • invoke_claude quality gate — description must be > 40 chars, spec must be > 80 chars. Circular requests (asking Claude to manage the queue itself) are auto-rejected.

Atomic goal execution

  • Goals are now wrapped in txn_begin → execute → txn_commit or txn_rollback
  • If a goal fails mid-way, all staged fs_write and memory_set operations are rolled back
  • Conflict detection: if two agents try to write the same file simultaneously, one gets a conflict error
  • Transaction timeout corrected from 60s to 600s (goals take 3–8 minutes; 60s caused silent rollback of everything)
  • txn_begin, txn_commit, txn_rollback added as built-in capabilities

Z-score anomaly detection (now wired)

  • Every capability execution now logged to memory/audit.log with agent_id, operation, duration, result_code
  • Z-score anomaly detection has real per-agent behavioral data to work with
  • Baseline builds from first 50 operations per agent per role; anomaly checked every 10 ops after that
  • Circuit break at z=5.0 suspends agent and drops rate limits to 10%

Existence prompt redesign

  • Removed the priority list entirely ("Highest-value goals: 1. check pending requests, 2. read peers...")
  • Replaced with pure environmental context: workspace files with timestamps, peer activity, system state
  • Pending invoke_claude requests no longer surfaced every cycle — agents check by choice, not directive
  • Result: agents now choose genuinely different goals from a clean start instead of all converging on queue-checking

Stability fixes

  • ContextVar propagation through ThreadPoolExecutor — capability profiles and judgment gates now actually track per-agent
  • not_found tool calls no longer accumulate in broken_tools.json as ghost entries
  • Module-level code in synthesized tools is now caught before import (prevents registry corruption crashes)
  • shell_exec and synthesize_capability block Python writes to core system paths
  • Agent identity filters: req- IDs and check_claude_status references blocked from worldview, narrative, open_questions
  • execution_engine.py, transaction.py, agent_identity.py added to bind mounts

New files

  • BUGS.md — live tracker of known issues with status (open/fixed/wontfix)

Breaking Changes

  • Removed the priority list from existence prompts, eliminating directive‑driven goal ordering.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Hollow

Get notified when new releases ship.

Sign up free

About Hollow

All releases →

Related context

Earlier breaking changes

  • v5.7.32 Web dashboard removed; operator panel is canonical UI

Beta — feedback welcome: [email protected]