Added

• Model catalog and provenance. Current Codex/Gemini/Claude IDs, lifecycle/pricing metadata,
  requested-versus-served model IDs, CLI versions, effort, and mismatch state are persisted with
  each run; exact pins fail closed unless substitution is explicitly enabled.

• Per-stage and mixed-provider routing. --stage-runner, --stage-model, and Claude-only
  --stage-effort support deterministic user overrides while preserving shared guardrails.

• Offline screening/planning. argo screen, argo plan, argo show-routing, and credential-free
  argo profiles provide explainable fingerprints, objective plans, and pre-run routing review.

• Benchmark evidence and adaptive routing. Repeated trials now separate invalid runs, preserve
  target/model/catalog provenance, and expose cost/latency statistics. Evidence-aware planner hints,
  budget-bounded opt-in adaptive escalation, and a validated frozen corpus are included.

• Shared API/UI controls. The FastAPI service and vanilla SPA expose the same screening, planning,
  catalog, routing, and profile behavior as the CLI.

• Recon ablation comparison. pipeline --no-vuln-index isolates the curated index input, while
  compare-recon checks commit/input/backend comparability and emits bounded structural diffs of
  existing recon artifacts. It is offline and deliberately does not turn proxy counts into a
  precision or recall claim.

• Backend/account attribution. Each LLM call now records a redaction-safe backend/account
  label in llm_log.jsonl, making fallback and multi-account behavior auditable without exposing
  credential paths or API keys.

Fixed

• Normalize Windows-shaped account directories on every host before deriving redaction-safe
  backend labels, so CI and local logs never leak the configured path.

Added

• Revision-bound target memory with source-revision checks.
• Incremental review that prioritizes changed code while retaining full-repository coverage.
• Evidence-gated attack paths based only on exact, supported relationships.
• Private context packs and provenance-backed review questions.

Added\n- Deterministic claim/evidence normalization immediately before reporting.\n- Proof-aware reports and drafts with open obligations and consistency warnings.\n- Separate current-run maintainer disposition from technical proof.\n\n## Changed\n- Runtime/live proof now requires explicit interpretation and a captured observation; expectation fallback cannot promote proof.\n- Resuming older runs regenerates evidence and reports.\n\nSee CHANGELOG.md for the full release notes.

Added

• argo corroborate --only ID,ID for targeted re-corroboration that preserves every other
  survivor's existing verdict; deep-verify now prints the exact follow-up command when a finding
  splits into new children.

• Deterministic, zero-LLM grounding metadata now flags conservative "possible composite finding"
  signals for human review in logs and REPORT.md, without changing verdict or severity.

• Explicit API keys for the Claude and Codex backends (--claude-api-key/--claude-api-keys,
  --codex-api-key/--codex-api-keys), matching what Gemini already had. Claude needs only a bare
  ANTHROPIC_API_KEY (coexists additively with --claude-accounts); Codex does not accept a bare
  env var — Argo bootstraps a dedicated, cached CODEX_HOME for it via codex login --with-api-key (key piped over stdin only, never argv; cached under
  ~/.argo/codex_homes/<sha256-of-key>, never the literal key in a path). Both are real secrets —
  redacted in runs/<id>/config.json, type="password" in the web UI, never echoed back over the
  HTTP API. argo resume gained --claude-api-key/--codex-api-key (alongside the pre-existing,
  now-actually-working --gemini-api-key) to re-supply a redacted key on resume.

Fixed

• Citation grounding now detects numeric affected line citations beyond the actual file length,
  downgrading confidence and warning the validator without auto-dropping the finding.
• pipeline_config_from_dict never de-redacted a secret on load. A config.json written by a
  Gemini run stored the literal string "<redacted>" for gemini_api_key; loading it back (argo resume/argo chat) set the field to that literal string — truthy, so it was injected as the
  actual GEMINI_API_KEY, clobbering any real ambient key and silently breaking auth. Found and
  fixed while adding the Claude/Codex key fields (which would have tripled the blast radius);
  redacted secrets now come back None/[] on load, never resurrected as the sentinel string.
• argo resume --gemini-api-key didn't actually exist as a CLI option despite docs/backends.md
  documenting it — resume now genuinely accepts it (and the new Claude/Codex equivalents).
• corroborate mixed repo content and network access in one session, contradicting its own
  documented guarantee. Now runs two isolated passes per finding: an offline docs/VCS-history pass
  (repo-mounted, no network) and a separate OSINT pass (networked, no repo mount, no source
  excerpts in its prompt) — closing the gap without losing the OSINT capability.
• A full self-audit pass (Argo audited its own codebase, then a dedicated pass over the new
  API-key code) surfaced and fixed dozens more real issues: git clone/checkout hardened against
  option and ext:: transport injection, guardrail scope/host/redirect checks tightened, secrets
  redacted consistently across config/logs/failure diagnostics, several path-containment and
  permission gaps closed, and Codex credential-bootstrap directory validation hardened.
• A guardrail's audit-prompt check required one exact safety-instruction phrasing; a model that
  paraphrases it equivalently no longer fails the check.
• runtime.py was missing an import that would crash any real run with Docker actually available
  (a live-Docker-only code path, so untested by CI).
• report.py could leave a stale submission draft behind for a finding a later stage went on to
  refute — drafts are now cleaned up to match the current survivor set on every regeneration.
• Two spots (argo/stages/second_opinion.py, the test suite's own cleanup helper) restored write
  permission on the wrong path when removing a hardened repo copy — POSIX needs it on the parent
  directory to delete anything inside, not the entry itself; this passed on every prior CI run
  purely because nothing had exercised a hardened directory tree deeply enough to hit it before.

Added

• Web UI: Gemini as a full runner option. New Run's runner selector and Settings' default-runner
  picker now offer Gemini alongside Claude/Codex/Mock (Settings previously only offered Mock/Claude —
  Codex was missing there too). A Gemini model picker (populated from GET /models) + API-key field
  appear when Gemini is selected, mirroring the existing Codex row. The backend (RunConfig.gemini_model/
  gemini_api_key, GET /models' gemini entry) already supported this since v0.4.0; the webapp
  never wired it up until now.
• Web UI: cross-backend benchmark + refusal-probe cards on the Benchmarks page — reads the
  already-existing GET /benchmark/cross / GET /refusal-probe endpoints (added in v0.5.0, never
  surfaced in the UI), rendering per-backend cost/latency/precision/recall/F1 and refusal-flag/
  recovery rates when a report exists.

Fixed

• Settings' runner selector was missing Codex entirely (only Mock/Claude) — an independent,
  pre-existing gap now fixed alongside the Gemini addition.
• The "danger" (real-spend) styling on the runner selector only ever applied to Claude — Codex was
  silently unflagged. seg() now takes an explicit danger set so every real backend gets it.
• A New-Run submit-error fallback had inverted logic (runner === "headless" ? real : free), which
  would have mislabeled the Start button after a failed Codex/Gemini run. Now checks for "mock".

Added

• Cross-backend benchmark: argo bench-cross --backends headless,codex,gemini [--tier cheap|top] runs the same labeled corpus once per backend and reports cost/latency/precision/recall/F1 side by side — a genuinely N-way comparison, distinct from bench --ab-audit-model's same-backend, two-model A/B.
• Refusal-rate probe: argo refusal-probe --backends headless,codex,gemini measures how often each backend's own safety classifier false-positives on a legitimate, authorized security-audit prompt, and how often a same-backend neutral-register retry recovers it. Deliberately not jailbreak/adversarial testing.
• Per-LLM-call duration_ms + failure_kind now persisted in the ledger and per-run logs.
• Fixed a latent bug: PipelineConfig.calibrated()'s Codex branch was a no-op — --tier top now actually affects Codex.
• Benchmark corpus grown from 1 to 5 real, independently re-verified cases spanning C/JavaScript/Java.

See benchmarks/README.md and docs/backends.md for details.

Full Changelog: v0.4.0...v0.5.0

Added

• Gemini CLI backend (--runner gemini): a third swappable engine alongside Claude Code and Codex, tiered per stage like Claude (gemini-3.1-pro / gemini-3.5-flash / gemini-3.1-flash-lite), fully composable into the existing fallback chain and multi-account resilience machinery. Guardrails map onto Gemini's Policy Engine (a named-tool denylist, the same dialect Claude uses) rather than --sandbox, which was found to have a hard, unreliable Docker/Podman dependency during empirical verification against a real gemini CLI install. --gemini-model, --gemini-api-key, --gemini-accounts CLI flags; matching RunConfig fields on the HTTP API.

See docs/backends.md for the full design writeup, including an honest report of the real end-to-end validation run.

Full Changelog: v0.3.0...v0.4.0

Added

• argo verify is now resumable by default: re-running it on a run that already has some
  deep-verify verdicts skips findings that got a real answer and only re-attempts unverified or
  infra-failure (inconclusive) ones — safe to re-invoke after a backend runs out of credits, a
  rate limit, or a crash without re-spending on already-completed sessions.
• argo verify --only ID,ID — force specific findings to (re-)verify regardless of their current
  state, leaving every other survivor untouched (mirrors fix --only).

First formally tracked release. Argo has been under active development since 2026-06-18 (99 commits) without a real version/release process; rather than reconstruct that history after the fact, this entry is a snapshot of what the pipeline can do today, and the changelog is precise from here forward.

Added

• Core pipeline: ingest → recon → audit → validate → report.
• Opt-in stages: deep verification (deep_verify), corroboration, second-opinion reconciliation across independent audit passes, dependency/SCA scanning, sandboxed runtime verification (loopback-only, --network=none), live authorized-target probing, mechanical fix generation + re-audit, and sandboxed AddressSanitizer/UBSan PoC generation for C/C++ memory-safety findings.
• Multi-backend support (Claude Code, Codex, local open-source models) with cross-backend fallback, failure-kind-aware retry/backoff, and a neutral-register recovery path for moderation-flagged sessions.
• HTTP API (server/) and a no-build web UI (webapp/) for run lifecycle, live status, and history.
• 388 tests, zero-token by default via a mock runner; a Docker-gated real end-to-end proof for the sandboxed stages.

See CHANGELOG.md and docs/releasing.md for the versioning convention going forward.