This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
Affected surfaces
Summary
AI summaryRemoved executor.max_budget_usd from the task contract.
Full changelog
🚢 This patch tightens scope handling, executor result parsing, and task YAML compatibility.
Changes
- Treat
scope.allowed_pathsas the expected implementation scope and review baseline, while keepingscope.forbidden_pathsprotected. - Require valid structured executor result JSON instead of generating fallback completion evidence.
- Define
files_modifiedas the final worktree diff submitted for supervisor review, soscope_expansionscovers retained changes from earlier attempts. - Remove
executor.max_budget_usdfrom the active task contract, runner flags, schemas, skeletons, examples, and docs. - Decode known task YAML fields while ignoring unknown fields at runtime.
- Package Galley plugins as version
0.1.19.
Fixes
- Preserve Codex
--output-last-messageparse errors in executor diagnostics. - Preserve staged deletions during review staging and accepted-task finalization.
Breaking Changes
- Removed `executor.max_budget_usd` from the active task contract, runner flags, schemas, skeletons, examples, and docs.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Galley
Local-first runtime for supervised AI coding tasks: isolated git worktrees, supervisor review against acceptance criteria, retry/escalate loops, on-disk run evidence, and PR handoff. Supports Codex CLI and Claude Code. Go, MIT.
Related context
Related tools
Beta — feedback welcome: [email protected]