# VCO Release v4.0.0

- Date: 2026-07-17
- Commit(base): c1665ba7
- Published tag: `v4.0.0` at `9cf0dcbf7c6e377806c00b2e0d2ffe75cb612d35`

## Highlights

- Replaced retired native and delegated execution lanes with an explicit Agent-owned module handoff. Approved plans now produce `agent-execution-handoff.json`; the current Agent executes the assigned work and returns one `module-execution.json` through canonical `vibe` re-entry.
- Made module completion the delivery truth. Required modules move through `pending`, `working`, and `completed`, `failed`, or `blocked`; incomplete required work cannot enter successful cleanup or completion language.
- Removed legacy wrapper and execution surfaces instead of maintaining parallel authorities. The public runtime entry is now `vibe`; the old want/how/do/upgrade entry names and retired specialist runner paths are no longer release surfaces.
- Hardened task fidelity across launch, planning, and re-entry so the exact user task survives host boundaries and non-code research, document, data, and retrieval tasks do not acquire coding or TDD requirements from generic wording.
- Added explicit execution-safety and forbidden-MCP policy. The runtime does not install or recommend `chrome`, `chrome-devtools`, `playwright`, `context7`, or `claude-flow` MCPs.
- Refreshed release, package, distribution, installation, upgrade, and verification guidance around the host-neutral `vibe-skills-4.0.0-public.zip` package.

## Why This Is A Major Release

v4 changes the public execution and migration boundary. It removes legacy entry names and internal execution owners, then makes the Agent handoff plus canonical module-result re-entry the only supported completion path. Replace an existing v3 installation with a fresh v4 install.

## Installation And Upgrade

- Download `vibe-skills-4.0.0-public.zip` from the [GitHub Releases page](https://github.com/foryourhealth111-pixel/Vibe-Skills/releases).
- For a shared user-level install, run `install` or `update` against `~/.agents/skills`.
- For a Codex-only install, target `~/.codex/skills` explicitly.
- Replace an existing v3 install by deleting its `vibe` folder, then install v4.
- The installer owns only receipt-listed files under `<SkillsDir>/vibe`; it preserves user-added files and refuses unowned path conflicts.
- A repository checkout remains a developer/internal source. Public users should install from the published release zip.

## Validation Notes

- Stable runtime proof before the release metadata cut: full repository `1436 passed, 6 skipped`; focused runtime and handoff regression `209 passed`; final focused PR verification `91 passed`.
- Five real dialogue closure scenarios passed the core contract audit, including the expected missing-input failure without fabricated output.
- Release-focused tests passed: `56 passed` across the v4 release surface, distribution build, release-cut operator, CLI commands, and simplified installer.
- Version consistency passed `10/10`; version packaging passed `9/9`; release-notes quality, release-truth consistency, release/install/runtime coherence, and distribution-manifest gates all passed.
- The public bundle build produced the expected `vibe-skills-4.0.0-public.zip` asset.
- Both real Windows Skill roots were updated to v4 with `272` receipt-owned files and package digest `e2c6790e6403b44ca04904e3a6d8f0575734855e3e1c08c4210d3fafba2a77b1`; both checks report zero missing and zero drifted files.
- PR #248 GitHub checks `host-boundary`, `python-validation`, and `CodeRabbit` passed on the validated runtime tree.

## Migration Notes

- Replace calls to `vibe-what-do-i-want`, `vibe-how-do-we-do`, `vibe-do-it`, or `vibe-upgrade` with `vibe` and the current governed stage flow.
- Do not expect Vibe to execute a hidden native specialist lane after planning. The Agent named in the handoff owns the module work and must return the declared module result.
- Do not infer success from artifact presence alone. Required failed, blocked, or incomplete modules keep delivery acceptance closed.
- Keep additional domain Skills in the shared skills directory or configured local skill roots; the public v4 package installs the runtime, not a separate bundled skill catalog.
- The governed `v4.0.0` surface is published: the GitHub tag, release object, and downloadable asset all point to the release commit above.