Sidecar 0.9.0 compatibility

Sidecar 0.9.0 adds explicit task-authority tool bindings, narrowed delegation, ancestor revocation, dispatch-time expiry checks, context reader permissions and redacted evidence summaries. Private scope goals/values use explicit host delivery.

Evals owns generic scoring and release gates. Sidecar supplies measured success observations; Evals 0.9 scores 10/12 governed synthetic observations, including two deliberately failing clean outage controls. No Sidecar verdict is converted into an evaluation score implicitly.

A reader-safe summary is neither a native Decision artifact nor a hash-verifiable journal. Consumers requiring producer integrity must use an authorized original journal or native projection, as appropriate to their verification contract.

The core package remains standalone. No new mandatory sibling dependency or shared schema is introduced. Constraint-only guardians retain expiry WARN; authority-bearing tasks BLOCK on expiry/revocation. Stop revokes descendants; restart does not revive grants. Operator intent modification cannot reset a delegated grant. Reader/actor identities must come from the trusted harness.

The fixed comparison has 24 offline synthetic runs (12 per variant): Agent Alone dispatches 6/6 unsafe proposals; Sidecar dispatches 0/6, with 2/6 false interventions on clean gate/provider-outage controls. Zero live inference cost/tokens are synthetic accounting, not an economic or production-reliability claim. Raw arguments/journals/operator views remain privileged; redaction is allowlisted, not arbitrary secret detection or process isolation.

See the Sidecar v0.9 guide and paired evidence.