Release 0.2.18: explicit continuation consent and retained Bridge outcomes

[ancongui]

Changes

Signed source-control continuation requires separate administrator consent bound to the original execution identity, current repository mapping, component scope, plan and WAL. Studio guides that review in three steps and retrieves the original receipt after a lost response. The SDK, CLI and MCP expose the same operations.

Ambiguous Bridge responses and cancellations retain the original intent and block generic resume, handoff and replacement retries. Invocation-local tracking survives native agent graph cancellation. Bridge requests also disable HTTP redirect following independently of SDK retries: a 307/308 response causes one inference request and an unknown-outcome hold instead of forwarding a second POST.

The factory opens in overview mode, stage focus is explicit, and compact consent reviews remain readable in short or zoomed viewports. Updated walkthroughs include the consent and recovery layouts.

Validation

• Historical native backend qualification: 2,465 passing cases plus 51 passing subtests in the full run; its one SDK fixture failure was corrected and passed separately in the same retained environment. This composite is not a fresh full-suite run of the final source.
• Final redirect correction: 70 focused host cases passed, including eight new regression cases. The final source also passed 13 native Linux cases with the real SDK, covering redirects, cancellation and retained execution outcomes. These cohorts overlap; they are not summed into a full-suite count.
• Studio: 263 unit tests and configured static checks passed. Layout evidence includes 20 consent cases, 12 freshly passing neighboring cases and 36 freshly passing canonical capture cases. All 392 documented screenshots are bound to their producers and current frontend inputs.
• Documentation: strict builds, discovery and Pages-path checks, JavaScript lint/format, 10 scene tests and 21 Python tests passed. The diagram correction passed 94 documentation browser cases and five Pages-path cases without reducing the minimum readable text size.
• Final wheel and source builds passed source, metadata, Studio and release-content checks. Final artifact-origin qualification passed in retained Linux: the exact 145-tool MCP envelope, 222 native prompt resources, 15 actual FunctionModel schemas, six default grants, CLI, SDK, fonts, 446 runtime payload files and 28 Studio assets were checked. The ordinary installed version was preserved.

Exact-head CI passed: 2,423 Python cases passed with 51 explicit skips and four warnings; 263 Studio unit cases and 551 browser cases passed. Documentation, container and installed-wheel verification gates also passed. No cloud runtime deployment or live provider inference is part of this change. Existing unknown outcomes remain held; recovering a remote completion into a running agent is outside this release.