Integrate Codewhale 0.9.13 contributor fixes and release verification

CHANGELOG.md

@@ -17,6 +17,10 @@ with an accessibility-first pointer.
 
 ### Fixed
 
+- Bottom-chrome effort is omitted when the route cannot prove an effective
+  tier; `/status` retains the full explanation. Cost remains visible when
+  known, and `cost: unknown` remains on metered routes lacking a reading (#5950).
+
 - Pasting multiline text is one paste again. 0.9.12 gated the
   paste-burst heuristic off whenever bracketed paste was *requested*, but
   a terminal can accept `EnableBracketedPaste` and still deliver a paste
@@ -173,6 +177,14 @@ with an accessibility-first pointer.
 
 ### Added
 
+- `[tui].posture_bar` and `[tui].metrics_line` accept `full`, `compact`, or
+  `hidden`, also available through `/config`. Compact preserves the existing
+  rows' essential fields; hidden returns their space to the transcript (#5973).
+- Optional model-bound tool-output redaction opt-out, with two explicit startup
+  confirmations and a receipt bound to the readable config contents and
+  modification time. Unconfirmed requests keep masking enabled; routing and
+  stored goal summaries remain redacted (#5982, thanks @SparkofSpike).
+
 - The `rusty-alloc` cargo feature on `codewhale-tui` and `codewhale-cli`
   opts the binaries into the `rusty_alloc` global allocator (the mimalloc
   v2.4.5 architecture remade in pure Rust — no C compiler or build script
@@ -225,29 +237,6 @@ with an accessibility-first pointer.
   three explicitly. `--use` saves the new secret as this machine's local
   `codewhale` provider credential in the same secret store `codewhale auth`
   uses; nothing is uploaded.
-- `sandbox_backend = "shannon"`: shell commands run as signed ShannonNet
-  capability invocations (`cap://sandbox/exec`) on a worker that may live on
-  another tailnet node. Codewhale opens a Task World per session for its
-  durable `codewhale` Agent and every command leaves a receipt in
-  `shannon trace`. New keys `sandbox_shannon_home` and
-  `sandbox_shannon_capability`; tool metadata now reports the actual
-  external backend kind instead of always `opensandbox`.
-- `/shannon [world|trace|children]` inspects the session's ShannonNet
-  World: agent, projected capabilities, children, and receipts.
-- ShannonNet sub-agents get compiled context: the session's native-memory
-  hits are imported with provenance and the child's projected World decides
-  what it sees (confidential notes never cross); the session World is
-  checkpointed and closed when the backend drops.
-- Sub-agents under delegated authority: with the ShannonNet backend the
-  `agent` tool spawns a child identity with a World projected from the
-  session World, the child's shell commands are signed as that child, and a
-  join receipt is recorded when it finishes. `SandboxBackend::for_child` /
-  `child_joined` default to sharing the parent backend for other backends.
-- Workspace sync for the ShannonNet backend (`sandbox_shannon_sync`, default
-  on): the session's non-ignored files are shipped into the worker's
-  per-World session container before each command — full tree first, then
-  only changes and deletions — so remote builds and tests run on the files
-  just edited locally and their outputs persist across commands.
 - `Git` grows a `commit_plan` action: a propose-only planner that splits the
   working tree into ordered atomic commits (#3999). It groups whole files —
   lock files ride with their manifest, tests ride with the source they name —

config.example.toml

@@ -206,6 +206,33 @@ memory_path = "~/.codewhale/memory.md"
 # max_reprompts = 2
 # reprompt_message = "So, what's up ? Keep running !"
 
+# ───────────────────────────────────────────────────────────────────────────
+# Model-bound key redaction ([redaction])
+# ───────────────────────────────────────────────────────────────────────────
+# Codewhale masks credential-looking values in tool output before it reaches
+# the model (the "model boundary"), so a file that contains a configured API
+# key, a bare provider token, or a credential-shaped opaque string never leaks
+# those bytes to the model. Leave this enabled unless the model must read and
+# edit files that contain real credentials.
+#
+# Disabling is a security decision, so it is never a plain flag:
+#   * Set model_bound = "disabled" here, restart Codewhale, and the startup
+#     gate asks twice - a first confirmation, then a red "are you really
+#     sure?" stage. Only the second confirmation takes effect, and it applies
+#     on later launches while model_bound stays "disabled".
+#   * Going back to "enabled" - or rewriting config.toml after the
+#     confirmation - invalidates it: requesting "disabled" again always
+#     asks for a fresh confirmation.
+#   * Until a confirmation exists - including in non-interactive/headless
+#     runs, which never confirm anything - masking stays on regardless of
+#     this key. Choosing "keep masking on" on the gate leaves the key
+#     untouched, so the next launch asks again.
+#   * The value is forgiving: false/"off" mean "disabled"; true/"on" mean
+#     "enabled".
+# [redaction]
+# model_bound = "enabled"    # mask keys before they reach the model (default)
+# model_bound = "disabled"   # request the opt-out (restart + confirm required)
+
 # Native tool catalog controls (#2076). By default only the core tool surface
 # is loaded into the model context; less common native tools are discoverable
 # through ToolSearch and loaded on first use.
@@ -424,26 +451,6 @@ sandbox_mode = "workspace-write" # read-only | workspace-write | danger-full-acc
 # The backend uses a 30-second HTTP timeout. Background, interactive, and
 # TTY modes are not supported with external backends — all commands run
 # synchronously via HTTP.
-#
-# ShannonNet backend: each shell command becomes a signed capability
-# invocation on a ShannonNet worker (which may run on another tailnet node).
-# At session start Codewhale resolves its durable `codewhale` Agent, creates
-# a Task World named after the workspace, and attaches the capability; every
-# command then leaves a signed receipt (`shannon trace`). Requires the
-# `shannon` CLI on PATH (or `$SHANNON`) and an admitted provider for the
-# capability (`shannon cap advertise`).
-#
-#   sandbox_backend = "shannon"
-#   sandbox_shannon_home = "~/.shannon"           # default: $SHANNON_HOME or ~/.shannon
-#   sandbox_shannon_capability = "cap://sandbox/exec"  # default
-#   sandbox_shannon_sync = true                   # default: ship the workspace's
-#       # non-ignored files into the worker's per-World session container before
-#       # each command (a full archive first, then only changes), so remote builds
-#       # and tests run on the files just edited here. false runs each command in
-#       # a throwaway container against the worker's own read-only checkout.
-#
-# Env-var overrides: CODEWHALE_SANDBOX_SHANNON_HOME, CODEWHALE_SANDBOX_SHANNON_CAPABILITY,
-# CODEWHALE_SANDBOX_SHANNON_SYNC.
 # ─────────────────────────────────────────────────────────────────────────────────
 # Bubblewrap (Linux only, additional filesystem isolation)
 # ─────────────────────────────────────────────────────────────────────────────────
@@ -1126,6 +1133,17 @@ osc8_links = true            # emit OSC 8 escapes around URLs (Cmd+click in iTer
 # git_branch, last_tool_elapsed, rate_limit — they drove nothing. Old files
 # keep loading; the retired keys are ignored.
 # status_items = ["mode", "model", "context_percent", "cost", "tokens"]
+# Size presets for the two rows themselves (#5950) — composition stays in
+# status_items; these only decide how much of a row paints:
+# posture_bar = "full"          # full | compact | hidden (default full)
+#                               # compact keeps the posture chips (and the cap
+#                               # warning) and drops the clocks, counts and hint;
+#                               # hidden gives the row to the transcript.
+# metrics_line = "full"         # full | compact | hidden (default full)
+#                               # compact keeps the route, context reading, cost
+#                               # and balance and drops the telemetry and the
+#                               # help hint; hidden gives the row to the transcript.
+#                               # Also settable at runtime: /config posture_bar compact
 # notification_condition = "unfocused" # unfocused | always | never
 #                                    "unfocused" = notify only after this terminal has been
 #                                    in the background for two seconds (default);
@@ -1195,6 +1213,21 @@ initial_delay = 1.0
 max_delay = 60.0
 exponential_base = 2.0
 
+# ─────────────────────────────────────────────────────────────────────────────────
+# Goal loop (`[goal]`) — operate-mode persistent goals
+# ─────────────────────────────────────────────────────────────────────────────────
+# Operate-mode goals run to their completion gate with no default token, time,
+# or continuation ceiling. Token/time budgets, when supplied, are telemetry
+# only and do not stop a goal. The keys below are the opt-in circuit breakers.
+# [goal]
+# Optional safety backstop on automatic goal continuation passes.
+# Default: 0 (unlimited). Set a positive value to opt into a ceiling.
+# max_continuations = 100
+# Optional cancellable quiet period between successful turns, useful for
+# coordinator goals that poll on a cadence instead of keeping one provider
+# turn open. Default: 0 (continue immediately). Cap: 86400 (24h).
+# continuation_delay_seconds = 300
+
 # ─────────────────────────────────────────────────────────────────────────────────
 # Context Compaction
 # ─────────────────────────────────────────────────────────────────────────────────

crates/config/src/lib.rs

@@ -14,6 +14,7 @@ pub mod provider;
 mod provider_defaults;
 mod provider_kind;
 pub mod provider_templates;
+pub mod redaction;
 pub mod resolve;
 pub mod route;
 pub mod settings_schema;
@@ -920,10 +921,29 @@ pub struct ConfigToml {
     /// [`WorkflowConfigToml::default`].
     #[serde(default)]
     pub workflow: Option<WorkflowConfigToml>,
+    /// Model-bound credential redaction policy (`[redaction]`). When absent,
+    /// masking is enabled — the shipped security default.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub redaction: Option<crate::redaction::RedactionToml>,
     #[serde(flatten)]
     pub extras: BTreeMap<String, toml::Value>,
 }
 
+impl ConfigToml {
+    /// The requested model-bound masking mode, defaulting to enabled.
+    ///
+    /// The request only takes effect once the interactive TUI has recorded a
+    /// confirmation on its startup gate; see
+    /// [`crate::redaction::effective_masking`].
+    #[must_use]
+    pub fn redaction_model_bound_masking(&self) -> crate::redaction::ModelBoundMasking {
+        self.redaction
+            .as_ref()
+            .map(crate::redaction::RedactionToml::model_bound_masking)
+            .unwrap_or_default()
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum ProviderConfigField {
     ApiKey,