# Decepticon 2.0.0 qualification

Status: released. [Decepticon 2.0.0](https://github.com/BitterSecurity/Decepticon/releases/tag/v2.0.0)
was published at **2026-10-26 00:22:53 UTC** after candidate acceptance.
The immutable release tag remains on the qualified source; this record is post-tag documentation.

- Immutable source: `dd5b43c01bbc6ac09615a98444afcd2a4664480e` (`v2.0.0`).
- Source tree: `66c901e51c16a93f561f5a2b5fb5572e552b05a4`.
- [Final source CI](https://github.com/BitterSecurity/Decepticon/actions/runs/40216521507)
  and [security](https://github.com/BitterSecurity/Decepticon/actions/runs/40216521526) passed.
- [Release workflow](https://github.com/BitterSecurity/Decepticon/actions/runs/40218325854).

## Version and upgrade contract

This is a major release because the previously advertised `/resume [message]`
pause-feedback contract is replaced by saved-session selection and explicit
thread restoration. `/resume` opens the picker even while paused; select a saved
conversation, then send input to continue. `/resume <thread-id>` restores an
explicit conversation. Send feedback directly in the composer to continue a
paused run; `/answer` returns to a pending structured question.

Engagement/conversation/database formats are retained; no reset or migration is
required. The optional runtime-owned search-turn checkpoint field is omitted
from graph input and preserves existing scope and workflow pins. Python legacy
import aliases remain available and deprecated. Source version fields retain
the `0.0.0` sentinel; the immutable tag stamps distributions. SaaS versions are
independent. Use `decepticon update --channel latest`, then restart the OSS CLI.

## Included changes

- [#1095](https://github.com/BitterSecurity/Decepticon/pull/1095): classify wrapped
  upstream policy refusals without misleading authentication fallback advice.
- [#1096](https://github.com/BitterSecurity/Decepticon/pull/1096): refresh trusted
  approval per bound run, expose canonical OPPLAN schema and stop replaying
  generation failures as summarization failures.
- [#1097](https://github.com/BitterSecurity/Decepticon/pull/1097): fullscreen mouse
  interaction, saved-session picker, readable footer and neutral Go/Ink styling.
- [#1098](https://github.com/BitterSecurity/Decepticon/pull/1098): isolate two
  credential tests from configured developer environments.
- [#1099](https://github.com/BitterSecurity/Decepticon/pull/1099): stop runtime
  search-closure directives from converting greetings/status/questions into
  unsolicited assessment work; retain receipt/review/budget and resume gates.

## Executed source checks

| Boundary | Observed result |
| --- | --- |
| Final-source CI Python coverage | 6,179 passed, 48 expected skips, 74.72% coverage; 60% gate passed |
| Search lifecycle graph regressions | 40 passed, including sync/async greeting, pending status, operator question, explicit search/Autohunt, tool checkpoint resume and receipt preservation/rollover |
| CLI | 286 tests, typecheck and production build passed |
| Go launcher | Full tests passed; macOS fixture corrected and repeated 20 times; affected PR's Linux/macOS/Windows CI passed |
| Web / Worker | 75 Web and 51 Worker tests; lint/typecheck, npm audit and production/dry-run builds passed |
| Python lint/type audit | Ruff passed; zero type errors, existing 820-warning audit baseline retained |
| Real Docker port failure | Occupied 7474 moved to 7476, HTTP 200, saved port unchanged on restart; existing owner retained |
| Actual source product | WSL Go launcher → engagement → service startup → compiled CLI → real `auth/gpt-5.6-sol` responses passed |
| Source same-volume restart | Both threads, all 21 messages, three workspace files and host ports preserved |

The initial combined local release command failed two no-credential fixture
assumptions. #1098 corrected the isolation; the complete Python coverage suite
and all remaining release-gate components were rerun successfully. The final
source CI then reran the full suite after the search lifecycle fix. Conditional
CI skips are not counted as executed tests; unchanged client/platform boundaries
are covered by the affected PR CI and local checks above. Expected Python skips
include unavailable optional/live/native components and an existing SDK-mock
benchmark case; no failed gate was waived.

## Actual behavior and root cause

The real model initially answered `hi` normally, then the old search middleware
injected an internal human message demanding OPPLAN/review_search and resumed
work. The owned QA run was interrupted after plan bootstrap; its checkpoint and
workspace were retained separately. The corrected source image matched the
middleware file checksum and passed the actual product flow: two greetings
without tool calls or OPPLAN creation, stale `authorization_confirmed=false`
refreshed to current trusted true, saved-session selection without dispatch,
and subsequent input returning `INTERACTIVE-RESUME-OK` with exit zero.

Real 120×40 WSL PTY checks cover footer click, session selection, Korean caret
placement with coalesced input, external-editor return, mouse opt-out, inline
mode and normal/SIGTERM cleanup. Tested conversation RGB colors were all
achromatic; first-launch Go star/onboarding prompts were achromatic and
`NO_COLOR` emitted no color styles. The compiled candidate CLI image also passed
the isolated mouse/input protocol fixture without dispatching a model run.

## Candidate and publication gates

The downloaded Linux launcher and versioned CLI/backend images passed the actual
product flow: two greetings without tools or OPPLAN creation; a deliberately
stale false approval refreshed from trusted launch context; `/resume` selection
without a model turn; subsequent input returning `INTERACTIVE-RESUME-OK`; exit 0.
Before any candidate input, all three prior threads, 27 messages, four workspace
file hashes and host ports matched the source baseline exactly. Runtime Python
package metadata for decepticon/core/sdk was `2.0.0`.

The first candidate harness selected an existing thread by its recently patched
`updated_at` timestamp instead of the newly created thread. Its greeting still
completed without tools; the owned run was stopped and the harness changed to
track IDs absent from the pre-launch thread set. The complete candidate flow
above then passed. The unusually long evidence-directory path also exceeded
the optional infra-control Unix-socket path limit, producing a startup warning;
infra-control specialist operations are outside this conversation acceptance.

The candidate Web image was healthy on host ports 23126/23426 with terminal
port 3003 inside the container. A real WebSocket/PTY connection using the selected
host origin reached `/doctor` machine-scope readiness; the old localhost:3000
origin was rejected with code 1008. This is protocol/terminal verification,
not native browser visual acceptance.

Distribution verification checked all six launcher assets/checksums, the three
PyPI wheel/sdist pairs and exact sibling pins, config/skill checksum manifests,
and eight versioned image manifests/digests and CycloneDX SBOM artifacts.
All images except REA have linux/amd64 and linux/arm64; REA is linux/amd64.
All eight keyless image signatures independently verified against this workflow
and `refs/tags/v2.0.0`. All image build/signing/SBOM jobs passed before publication.

## Public release and installation

The release workflow completed successfully. The public GitHub release has 18
assets; their hashes match the independently verified candidates, including a
freshly downloaded Linux launcher and digest-pinned eight-image manifest. All
eight `latest` image digests match `2.0.0`; all eight pre-release `stable` digests
are unchanged. Three Python packages are published at 2.0.0. Publication time is
2026-10-26 00:22:53 UTC, not the earlier candidate build time.

The real WSL installation was updated with `decepticon update --channel latest`.
Independent checks confirmed `Decepticon 2.0.0`, version stamp `2.0.0`, Linux
binary SHA-256 `55a3f96a66990b31753041192b03d07beb6c84646405e8404f40e227bd85bce4`,
and release-matched compose/LiteLLM config checksums. The operator `.env` hash
is unchanged, preserving credentials/settings/ports. Installed core/CLI/Web image
digests match the release; optional specialist images are not required by this
flow. The already-running operator CLI was retained. Reopen it to use the new
UI and start services from the installed release; no operator session was
forcibly restarted.

The local evidence directory retains distribution/signature/publication JSON,
source-to-candidate message/file hashes, real-model PTY transcripts, WebSocket
origin results and installation checks. Private QA credential copies are removed
after the isolated stack is stopped. No provider credential values are included
in this repository record.

## Limits

The renderer mounts visible rows, but retained history and cache can grow.
Custom drag selection, clipboard ownership and automatic URL opening are not
implemented; `/mouse off` and `/tui inline` remain available. Native Windows/macOS
product acceptance is not established by WSL or cross-platform CI. All eight image keyless signatures and CycloneDX SBOM artifacts were checked.
The Sandbox SBOM exceeds Rekor’s entry size cap and has an OCI attestation
without transparency-log upload; its image signature verifies normally.
Optional REA and C2 images passed distribution verification, but their specialist
operations are not exercised by greeting acceptance. Provider policy/access
remains upstream-controlled; the error fix does not provision cybersecurity
access. Existing passive discovery remains best-effort when external CT sources
are unavailable.

See the [terminal research](../research/2026-10-26-terminal-interactions.md) and
[conversation/search verification](../verification/2026-10-26-conversation-search-boundary.md).