Changelog

Generated from Conventional Commits by python-semantic-release.

Rendered from CHANGELOG.md in the repository.

v0.62.0 (2026-09-20)#

v0.61.2 (2026-09-20)#

Testing#

• 024: Check in the text an interpreter actually sends (b1a96b2)

v0.61.1 (2026-09-20)#

Bug Fixes#

• 024: Gather the interpreter's facts where the access is (af188b0)

Documentation#

• 025: Record the open questions in the spec, not the checklist (0eb0e91)

v0.61.0 (2026-09-20)#

Features#

• 024: A CLI channel, and it is the default (147b49d)

v0.60.0 (2026-09-14)#

Features#

• 024: Complete the feature — channel choice, policy changes, and the last guards (215562b)

v0.59.0 (2026-09-14)#

Features#

• 024: Digest, silence, the ledger, and the interpret command surface (9214672)

• 024: The interpreter's decision logic, and it resists its own inputs (382e199)

• 024: The Slack edge and the delivery loop (af01a6d)

v0.58.0 (2026-09-14)#

Bug Fixes#

• 024: Act on the review — four defects, and two claims that were false (8cee042)

• 024: Excluding the task no longer leaks it through the log stream (3d4adb8)

• 024: Make the log cap bound DISK, not only what is exported (5e69cb7)

• 024: Second review round — and retract a fix that fixed nothing (70f761d)

• 024: The large-backlog test only ran on macOS (e2f185e)

• 024: Third review round — bounded posts, honest claims, and a self-inflicted trap (d23224c)

• entrypoint: Host metrics have never worked; the sampler died on tick one (6238820)

Code Style#

• 024: Formatting the previous commit should have carried (c84c792)

Documentation#

• 024: Document the agent output stream as a third payload class (c636387)

• 024: Record where the implementation actually stands (11b9676)

Features#

• 024: Read back out of the stack, with unreachable distinct from empty (93e964d)

• 024: The interpret command group, and a guard that proves it cannot act (70df4e0)

Testing#

• 024: Pin kill-switch coverage and the channel-id validation (c211d50)

• 024: Widen the acceptance guard on the inventory's field set (f40eb39)

v0.57.0 (2026-09-14)#

Chores#

• claude: Enable the karpathy-guidelines plugin (d5f410d)

Documentation#

• 024: Specify the interpreting control plane, through to tasks (1178c03)

• constitution: Add Principle X, Surgical Change (2.6.0) (deea791)

• constitution: Restore the amendment history deea791 deleted (6b554a8)

Features#

• 024: Add the interpreter role and the agent-log export switches (6518ed8)

• 024: Export the agent's output, so the logs outlive the container (34982f7)

• 024: State what an interpreter holds, before it exists (bae89ba)

• 024: Wire --role interpreter through up, with its admit set required (0bc1a72)

v0.56.0 (2026-09-10)#

Testing#

• forge: Tell "the forge said no" apart from "we could not ask" (58e9b81)

• telemetry-stack: Break the store deterministically, and prove it broke (b0e46ad)

v0.55.0 (2026-09-06)#

Bug Fixes#

• telemetry: Codex and pi session export now actually fires (15650e7)

• telemetry-stack: Name the data volume, and stop claiming an unbacked discard (87e015f)

• telemetry-stack: Observe the host address; compare retention by value (51a89e5)

• telemetry-stack: Remote hosts, where three things were wrong (ee6e270)

Chores#

• Sync uv.lock to the released version (c6808ee)

Documentation#

• 023: Clarify namespace, restart, exposure, readiness and retention (197f911)

• 023: Close the analyze findings before implementing (1e168a2)

• 023: Decompose the telemetry stack into 57 tasks (ea8aae1)

• 023: Plan the telemetry stack container (ba24413)

• 023: Second clarify pass — egress, retention, and writing config (c3bb76e)

• 023: Specify the telemetry stack container (67bf64e)

Features#

• telemetry: Ship codex/pi session transcripts (UNVERIFIED end-to-end) (d4d1a94)

• telemetry-stack: up — readiness, restart, retention, both addresses (9ef4dc9)

• telemetry-stack: Naming, ports and the compose model (aa4848d)

• telemetry-stack: Polish, and a retention claim that was false (cef6db5)

• telemetry-stack: Real-agent validation passes, and panic can see stacks (61e120c)

• telemetry-stack: The dashboards, and a second readiness question (90f7f1e)

• telemetry-stack: The kind, its named defaults, and the two addresses (19f74cf)

• telemetry-stack: Url, ls, remove, dashboards (ecf9824)

Testing#

• telemetry: Assert the pi extension where pi actually looks for it (49c0331)

v0.54.0 (2026-09-04)#

Bug Fixes#

• telemetry: Register the pi extension through pi's own installer (f2336e7)

• telemetry: The codex block was invalid, and read-only config broke codex (50659c1)

v0.53.0 (2026-09-03)#

Features#

• telemetry: Export host metrics for the container itself (ec7c86d)

v0.52.0 (2026-09-03)#

Bug Fixes#

• tests: Keep the PR branch when the test fails (2531a7b)

v0.51.0 (2026-09-03)#

v0.50.1 (2026-09-03)#

Bug Fixes#

• creds: An unreachable runtime is undetermined, not empty (e57e39a)

v0.50.0 (2026-09-02)#

Bug Fixes#

• egress: Choose the compose gate per runtime, because the runtimes differ (e68c545)

• egress: Enforce the boundary gate in the agent, not via a runtime healthcheck (e825ade)

• egress: The TOOL waits for the boundary, instead of asking the runtime to (2bce516)

Testing#

• acceptance: Record the runtime's view when a CLI times out (b0e10aa)

v0.49.3 (2026-09-01)#

Bug Fixes#

• credentials: A start wait must not borrow the build budget (2ea867e)

Continuous Integration#

• Make the podman leg diagnosable — per-test timeout and unbuffered output (b9a8076)

v0.49.2 (2026-09-01)#

v0.49.1 (2026-09-01)#

v0.49.0 (2026-09-01)#

Bug Fixes#

• credentials: Three regressions the acceptance tier caught that the gate cannot (4679b1e)

• host: Register a host in the RUNTIME's terms, not always docker's (01d6dbe)

Continuous Integration#

• Bound the acceptance job at 45 minutes (017a25e)

• Bound the acceptance step, not the job, so an advisory leg can be absorbed (e3f1c1f)

• Install podman on BOTH matrix legs, not only the podman one (bb368ee)

• Keep the podman leg advisory until the suite actually passes under it (caabc74)

• Run the acceptance tier under BOTH runtimes, not whichever one is default (1503299)

Documentation#

• egress: Record that the podman DNS path is now verified, not just written (64dbea1)

Features#

• entrypoint: Pre-answer codex's workspace trust, and settle the other agents (24de3ee)

Performance Improvements#

• quality-gate: Run the checks concurrently — 184s to ~48s (191745c)

v0.48.0 (2026-08-31)#

v0.47.3 (2026-08-31)#

v0.47.2 (2026-08-31)#

Bug Fixes#

• panic: Settle the verification instead of sampling it once (cc8a876)

• samples: Restore the placeholder repo in 02, so the README is true again (4e7352b)

Documentation#

• Lead with the problem, not the category (7f860ef)

v0.47.1 (2026-08-31)#

Bug Fixes#

• pages: Chain the release leg off workflow_run — release: never fired (54385c4)

Documentation#

• contributing: A commit message must not contain a skip-workflow marker (43bdf8e)

v0.47.0 (2026-08-31)#

v0.46.0 (2026-08-31)#

Documentation#

• spec: Specify a scaffold command for new agent projects (022) (63e9033)

v0.45.0 (2026-08-30)#

v0.44.0 (2026-08-30)#

Documentation#

• samples: Runnable real-agent scenarios, one per directory (325bf24)

Features#

• cli: -v/--verbose on every command, in every position (90c33cf)

v0.43.0 (2026-08-30)#

Documentation#

• spec: Specify agent configuration templates (021) (2213a40)

Features#

• claude: Support CLAUDE_CODE_OAUTH_TOKEN, chosen by settings.yaml (3d70b82)

v0.42.0 (2026-08-30)#

Chores#

• deps: Resync uv.lock onto 0.41.1 (dd6991b)

Features#

• layout: Own overrides for state and data, and one ROOT for all three (4e3ad69)

Testing#

• acceptance: Have the agents write a working AVL tree, tests and a TUI (b95d744)

v0.41.1 (2026-08-30)#

Bug Fixes#

• credentials: Stop counting image build time against the delivery deadline (a1f1815)

Chores#

• deps: Resync uv.lock onto 0.41.0 (03fba02)

v0.41.0 (2026-08-29)#

Bug Fixes#

• egress: Resolve DNS under podman, where three faults hid behind one symptom (a03116e)

• headless: Read the agent's exit code from the container, not from compose (4cb9726)

• mount: Own the mode field, so a caller's :ro is not doubled (35e6434)

• pi: Make pi usable at all — four defects found by running it end to end (a5d0581)

• redeploy: Remove containers before recreating them (ae4954c)

• tests: Make the neutral cwd outlive the test that first needed it (c09ac75)

• tests: Probe the runtime with a template BOTH runtimes answer (8c95b3d)

• tests: Read the task from the LAST argument, not from $2 (37f190a)

• workspace: Mount host binds read-only, which is what they always were (f6f64e3)

Features#

• headless: Give Claude Code a permission mode, and push the evidence (657e11d)

Testing#

• acceptance: A REAL agent committing in a repository cloned on start (4a5dc7a)

• acceptance: A REAL agent reaching its API through the egress boundary (08a65d8)

• acceptance: Assert contracts, not a daemon's prose (c231efa)

• acceptance: Run a REAL agent against a REAL model, and stop reading the repo (eb37f69)

• headless: Repin claude's invocation, and answer the question it asks (6eb7ff8)

v0.40.0 (2026-08-25)#

v0.39.1 (2026-08-25)#

Bug Fixes#

• keys: Answer the third absence, and make --json answer at all (a34d051)

Chores#

• deps: Resync uv.lock onto 0.39.0 (ee9f854)

Documentation#

• keys: Delete the union claim from the three places it survived (b8a1388)

v0.39.0 (2026-08-24)#

Bug Fixes#

• credentials: Deliver secrets over the container's own sshd (#020, 04e2aae)

• credentials: Rotation, config refresh, and compose interpolation (93143b5)

Documentation#

• Credentials persist — restate FR-012, add Principle IX's persistence clause (78de32a)

• creds: Flag cleartext runtime endpoints, and refresh 020's stale artifacts (31cab95)

• keys: Record that credentials must PERSIST, reversing my ephemerality argument (c7d264c)

• keys: The SSH delivery path is verified on podman too (#020, 9d43fdd)

Features#

• credentials: Persist each credential on its own volume (75c302f)

• creds: Revoke credentials through the CLI, not the runtime (c0a9917)

Refactoring#

• credentials: Let the container decide where secrets belong (8fa954b)

v0.38.0 (2026-08-24)#

Documentation#

• Bring CLAUDE.md back under 2000 tokens (33af795)

v0.37.0 (2026-08-23)#

Bug Fixes#

• compose: Inline the admit set instead of referencing a staged path (#020, 67b67be)

Code Style#

• compose: Let ruff collapse the inlined config dict (#020, 5132bbf)

Documentation#

• keys: Close the remaining analyze findings for 020 (#020, 7c20349)

• keys: Close the second analyze round for 020 (#020, 6fc5418)

• keys: Correct a task I marked done that was not (#020, 5a85651)

• keys: Document the collection and reconcile the threat model (#020, 5780a8b)

• keys: Resolve the readability item by relocating mechanism (#020, 184a228)

Features#

• keys: Keys becomes a group; grants are recreate-scoped (#020, 51a90f4)

• keys: Replace the authorized_keys union with a managed region (#020, c21ea83)

• keys: Resolve a public-key collection at the CLI surface (#020, 66da9ce)

Testing#

• keys: Invert the last union assertion, and pin C20 (#020, 9feadc1)

• keys: Prove the collection end to end, and fix a misplaced call (#020, fc292d1)

v0.36.0 (2026-08-23)#

Documentation#

• keys: Break 020 into 50 tasks across seven phases (#020, 0eff872)

• keys: Honour a declared-empty collection, and warn about it (#020, f1a89cd)

• keys: Put the admit-set query in a keys subgroup (#020, 9cc446d)

• keys: Restore numeric order in the 020 requirement lists (#020, 4ba24b1)

v0.35.0 (2026-08-23)#

Documentation#

• keys: Make the post-deploy admit-set query observe, not re-resolve (#020, ebb7e06)

• keys: Plan the public-key collection (#020, 70071dc)

• keys: Specify what start does with a drifted collection (#020, b502134)

• keys: Tool-created grants become revocable by the collection (#020, 6ca257c)

v0.34.1 (2026-08-22)#

Bug Fixes#

• 001: Attach read hosts.conf directly, so hosts.json never superseded it (#001, 6d5adb7)

• ci: The release pipeline went red after every successful release (9fc05d7)

Documentation#

• 020: Specify the public-key collection, auto-injected (#020, 0ab138b)

• threat-model: Add the 020 maintenance row (#020, e6ad0f8)

v0.34.0 (2026-08-22)#

Documentation#

• 017: Correct C17's window, document the blind spot, fix image drift (#017, f85065c)

Features#

• observability: Attribute logs and attach, the last unattributed actions (#017, 48adf1e)

Testing#

• Cover the PODMAN driver path, the tool's default runtime (#017, 9fe4ed3)

v0.33.0 (2026-08-22)#

Bug Fixes#

• 017: Two product gaps the acceptance re-run exposed (#017, a3c97c8)

• compose: The deploy path built images with NO build args (#017, 4013300)

• control-plane: Remove the stale version pin the 0.32.0 release exposed (#017, 9c31b48)

• control-plane: The base image could not run the package it installs (#017, 1cda58e)

• control-plane: The image could not manage the tool's DEFAULT runtime (#017, 26f1eaf)

• control-plane: The image had no container runtime client, so it could manage nothing (#017, 50716bd)

• control-plane: Wire the control plane's own name, and stop redeploy losing the role (#017, 373a32f)

• test: A shadowed helper silently regressed three Feature 016 tests (#017, d260c1b)

• test: Probe container-to-host REACHABILITY, not name resolution (#017, 8a79dec)

• test: The collector tests assumed a Docker-Desktop-only hostname (#017, 282bbe7)

Documentation#

• 017: Record where the passphrase keygen actually landed (#017, 3d65f54)

• 017: The control plane, the dual stack, and CLAUDE.md displacement (#017, 7a7e58b)

• constitution: Ratify Principle VIII — Defaults Belong at the Surface (2.3.0) (9d8e9e8)

• threat-model: Reconcile Feature 017 -- a sixth trust boundary (#017, 81405ac)

Features#

• control-plane: Declared scope, and an out-of-scope action that fails visibly (#017, 288edbf)

• control-plane: Inject the host registry as non-secret configuration (#017, 767a2a4)

• control-plane: Narrow rendering and named unreachable hosts (#017, d7af470)

• control-plane: Revoke -- withdraw a standing key fleet-wide (#017, eb33644)

• control-plane: The semver rule and panic self-exclusion (#017, 7685ef9)

• observability: Attribute READ-ONLY actions, closing FR-009a's gap (#017, 11d4d5d)

• observability: Attribution on management actions (#017, 1d5f365)

• observability: Telemetry collect and retry (#017, 47c2005)

• observability: Telemetry reconcile -- do the two legs agree? (#017, ccd9d77)

• observability: The OTLP export path -- curl, write-time, fail-open (#017, 8c451b8)

Refactoring#

• Defaults belong at the surface, not in implementations (#017, 3714fce)

Testing#

• 017: Close S20 and record the T080 gates — 80/80 (#017, dffe424)

• 017: In-container acceptance was measuring the RELEASED CLI, not this tree (#017, 2f45c74)

• 017: The 80-column check was also measuring the released CLI (#017, 111ef49)

• 017: The acceptance tier -- absences, a refusing collector, and a SIGKILL (#017, 084fcb0)

• 017: The full tier's 8 failures were one leak and three wrong assumptions (#017, b6fab86)

• 017: The last acceptance scenarios -- US1 end to end, revoke, and locking (#017, 76a9aef)

• 017: The reconciliation acceptance scenario S19 was missing (#017, ad040af)

• 017: Three acceptance failures, three different wrong assumptions (#017, d1062ab)

v0.32.0 (2026-08-21)#

Chores#

• specs: Point the speckit cursor at 017 (0df5212)

Documentation#

• Trim CLAUDE.md under its 2000-token budget, measured properly (58cbac4)

• 017: Split the export-dependency clause from endpoint resolution, and cite R8 (#017, 5c29576)

• 017: Stop naming the whole trail after one of its three classes (#017, a948728)

• specs: A per-record export state that claims only what the client can see (#017, b33236e)

• specs: Attribute every control-plane action, drained off the hosts (#017, 1647fc8)

• specs: Both observability legs carry the same payload, defined once (#017, b66c544)

• specs: Close 013 — the acceptance tier is green with no selector (#013, abfcb70)

• specs: Collected records land in the operator's durable store (#017, f0370e6)

• specs: Confirm 013 ships as feat/MINOR (#013, b650239)

• specs: Define SC-020's window and scope SC-022 to completed exports (#017, 2481688)

• specs: Export fires at write time, per record (#017, 86ab717)

• specs: FR-016 becomes a semver rule with a direction (#017, 5a3bac1)

• specs: Generate tasks for 017 — 65 tasks, census before second image (#017, 6a56667)

• specs: Make trail retrieval unconditional, not the no-endpoint path (#017, 89cfad4)

• specs: Name the file, not a range, wherever scope was hardcoded (#017, 01dc269)

• specs: Nesting is supported deliberately, and inherits no reach (#017, f6714e3)

• specs: OTLP as the export protocol, plus a command to collect logs (#017, e878daf)

• specs: Plan 017 — three of its pieces do not exist yet (#017, a171f93)

• specs: Re-plan 017 against the current spec, carrying R2 and R3 verbatim (#017, c9f26f5)

• specs: Re-sync task citations after the re-plan (#017, 52fb1c7)

• specs: Regenerate the observability phase for the dual stack (#017, 71aaa11)

• specs: Split correlation out of the task-text clause (#017, 3dfc25b)

• specs: State that a task is not a credential channel, and export it (#017, 0b06a9c)

• specs: The attribution trail needs a destination the control plane can't rewrite (#017, b2214f0)

• specs: The control plane queries hosts live; it does not sync an inventory (#017, 737ce65)

• specs: The OTLP endpoint is declared at either config level (#017, 991c773)

• specs: Widen telemetry export to all containers, never the task text (#017, df2b1a9)

Features#

• control-plane: --role control-plane, the one-shot passphrase, and provenance (#017, fab2416)

• control-plane: The second image, and a census that can actually see it (#017, 5dc2cfc)

Testing#

• doctor: Assert non-invocation instead of watching for a dialog (#013, 3d95269)

v0.31.0 (2026-08-17)#

Documentation#

• specs: Close every analyze finding for 013 (#013, 2889c61)

• specs: Generate tasks for 013 — 61 tasks, gate before checks (#013, d51cb5b)

• specs: Narrow FR-011's exit range and define the unknown case (#013, 37a9765)

Features#

• doctor: Machine-level checks, scope reporting, and the docs (#013, 21a2e3f)

• doctor: Read-only preflight validation (#013, 8e96045)

v0.30.0 (2026-08-17)#

v0.29.0 (2026-08-17)#

Features#

• redeploy: Inherit the clone URL unless told otherwise (#019, 3215bd4)

Breaking Changes#

• redeploy: redeploy no longer drops the clone-on-start URL when --repo is omitted. A script relying on the old reset must now pass --no-repo. Note the asymmetry this leaves, and it is deliberate rather than overlooked: --mode, --agent and --workspace still fall back to their defaults when omitted. Only the clone URL is carried over, because only it was asked for — widening the rule to the rest is a separate decision with its own surprises.

v0.28.1 (2026-08-16)#

v0.28.0 (2026-08-16)#

Bug Fixes#

• ssh-key: Carry the agent's public key on the list --json row (#019, 0a06fa8)

• ssh-key: Make the clone DECIDE before the deploy reports on it (#019, 43a4040)

• ssh-key: The pending-clone recovery names a command that works (#019, defdcf6)

Documentation#

• specs: A deferred clone exits non-zero, and must say what NOT to do (#019, 82b5e07)

• specs: Close every analyze finding for 019, and document the exit codes (#019, 286e305)

• specs: Re-plan 019 after four clarifications (#019, 04864bc)

• specs: Regenerate tasks for 019 after the re-plan (#019, 2953409)

• specs: The probe targets the --repo host, or nothing at all (#019, 3f5711f)

• specs: Write ~/.ssh/config once; make rotation an explicit command (#019, 1d8454f)

• ssh-key: Reconcile the docs with a feature that is mostly a deletion (#019, d0f05d7)

Features#

• ssh: The agent generates its own SSH key pair (#019, c2610a2)

Testing#

• ssh-key: The hermetic and acceptance tiers for the agent key pair (#019, 394c0a4)

Breaking Changes#

• ssh: up --push-key, redeploy --push-key, the SSH_PUSH_KEY_B64 env-file variable and target: push_key in a project spec are all removed. Each now fails with a message saying the agent generates its own key and the operator registers the PUBLIC half. --known-hosts and PUSH_KNOWN_HOSTS STAY — they verify the forge, which is the opposite direction and public data.

v0.27.0 (2026-08-16)#

Documentation#

• specs: Generate tasks for Feature 019 — PREMISE UNDER REVIEW (#019, 7fe1210)

• specs: It is the AGENT SSH KEY PAIR, not a "push key" (#019, a51b591)

• specs: Plan Feature 019 container-generated push key (#019, e7a39ed)

v0.26.0 (2026-08-16)#

Bug Fixes#

• tests: A host-key refusal must be refused for the RIGHT reason (#018, 6198c0a)

Documentation#

• specs: Close out 015 — full acceptance tier and quickstart verified (#015, 555cadc)

• specs: Generate tasks for Feature 015 kill switch (#015, f815d68)

• specs: Name the per-host timeout — 30s, and say why not less (#015, cd12a1d)

• specs: Plan Feature 015 kill switch (#015, 3c51a44)

• specs: Repeating the action never turns "we cannot tell" into success (#015, e7867a5)

• specs: Resolve every analyze finding for Feature 015 (#015, b3e345c)

• specs: Scope filters on stored inventory fields only (#015, 5d38cb8)

• specs: The destroying form has PURGE reach, not wipe (#015, 78f777a)

• specs: Unreadable refuses, absent succeeds — ratified, not assumed (#015, b722f84)

Features#

• panic: A kill switch that tells the truth about what it could not reach (#015, 58fd42a)

• panic: The honest edges — interruption, parallelism, and the threat model (#015, 7e12b53)

v0.25.0 (2026-08-15)#

Documentation#

• specs: Specify Feature 019 — the push key is generated in the container (#019, a3ec51e)

Features#

• inventory: Reconcile the record against reality, fail-closed (#014, 7971ea3)

• inventory: Remember every environment the tool created (#014, 895b619)

v0.24.0 (2026-08-15)#

Bug Fixes#

• tests: Repair two checks that only failed on Linux (#018, fd37a92)

Documentation#

• specs: Add SC-009 so US3 is measurable, and cite FR-002 (#014, 1c9b399)

• specs: An absent pin ASKS, a mismatch never does (#018, 0504cf2)

• specs: Close out 018's task list (#018, 236c786)

• specs: FR-002 names the inventory a TENANT, not a new location (#014, e119abe)

• specs: FR-014 covers THREE memories, not two (#014, cb164ca)

• specs: Generate tasks for Feature 014 host inventory (#014, 449bd58)

• specs: Generate tasks for Feature 018 (#018, ee9bf1c)

• specs: Name 014's backstop cap — 5000 entries, count only (#014, d78c091)

• specs: Plan Feature 014 host inventory, and qualify 016's SC-008 (#014) (#016, 83830d6)

• specs: Plan Feature 018 verified attach (#018, ab2510d)

• specs: Resolve the remaining analyze findings for 018 (#018, 3e34bfc)

• specs: Specify Feature 018 — verified attach, no private host key on disk (#018, 097e37c)

• specs: The inventory begins at install and is not backfilled (#014, 89c5eec)

Features#

• attach: Capture at every deploy, and ASK when nothing is pinned (#018, aea0a45)

• attach: Pin the container's host PUBLIC key and verify against it (#018, 5bcfaeb)

• credentials: Remove every private-host-key channel (#018, 07e14a3)

Testing#

• attach: Prove the pin actually refuses, against real containers (#018, ca7fc5d)

Breaking Changes#

• credentials: up --host-key, keys --host-key, redeploy --host-key, the SSH_HOST_ED25519_KEY_B64 env-file variable, and target: host_key in a project's .agent-container/ spec are all removed. Each now fails with a message saying host identity is CAPTURED, not supplied -- a bare "no such option" would be a regression rather than a removal, because the operator who used the flag had a reason and it is now served without the cost.

v0.23.0 (2026-08-10)#

v0.22.0 (2026-08-10)#

Bug Fixes#

• observability: Open the run record before anything slow, and stop the test demanding one before the run starts (#016, 78357e5)

Documentation#

• specs: Generate tasks for Feature 016 (#016, 58ca540)

• specs: Record HOW ingestion reads the volume (#016, 8bddd06)

• specs: Resolve every analyze finding for Feature 016 (#016, 88c4607)

Features#

• observability: Give every run a durable record that outlives its container (#016, 7a92d2b)

v0.21.1 (2026-08-09)#

Bug Fixes#

• egress: Say nothing is enforced when nothing is, and stop the pty probe guessing (#012, 32dab44)

Chores#

• specs: Untrack the active-feature pointer (8102989)

Code Style#

• Build the inspect template by concatenation (#012, 2f4c9e9)

Documentation#

• specs: Clarify Feature 013 doctor-preflight (#013, 0b4237a)

• specs: Clarify Feature 015 kill-switch (#015, 65522a9)

• specs: Finish reconciling 012, and mark T138 partial rather than done (745c67f)

• specs: Outcomes, retention, identity and reconciliation (#014, 57fc6d2)

• specs: Reconcile 012's task list with the tree (b17b726)

• specs: Run records are a separate store from the inventory (#016, a6fc7fc)

• specs: Self-exclusion, a narrower image, and no passphrase recovery (#017, 58c149e)

• specs: Specify Feature 013 doctor-preflight (#013, 61bacca)

• specs: Specify Feature 014 host-inventory (#014, 77c8b33)

• specs: Specify Feature 015 kill-switch (#015, b44092a)

• specs: Specify Feature 016 run-observability (#016, 3886e8f)

• specs: Specify Feature 017 control-plane (#017, 39bcce6)

• specs: The control plane mints its own key (#017, 9e66b26)

• specs: Two stores, and the inventory needs its own home (#014, 8c989af)

• specs: Who writes the record, and how it learns what changed (#016, c562db2)

Testing#

• egress: Push for real over a declared SSH endpoint, with a control (#012, 17a0d7d)

v0.21.0 (2026-08-07)#

Bug Fixes#

• egress: Bind the boundary resolver to loopback and own its pidfile dir (#012, b75df0c)

• egress: Close an unrestricted egress channel and make declared ports work (#012, 5ed4bfa)

• egress: Constrain the proxy's PORT and close two holes in the fail-open fix (#012, 5125646)

• egress: Let ssl_bump decide the intercept path, not http_access (#012, 7fe0583)

• egress: Refuse rather than deploy unrestricted when a declaration is unreadable (#012, 766086a)

• egress: Run the port-owner migration in both directions (#012, f1ed831)

• egress: Stop the healthcheck polluting the refusal record, and make boundary membership drift (#012, 7d8defd)

• egress: Wait for the boundary to serve before starting the agent (#012, f68e830)

• image: Meet FR-020a by dropping port 53, not redirecting it (#012, cb94139)

Documentation#

• Record that the last two tier failures were a cold image build (#012, e25066f)

• Record the remaining adversarial-review findings as tasks (#012, d261806)

• specs: Prove the Phase B mechanism before building on it (#012, 817e57f)

Features#

• Join the agent to the egress namespace, with no capability (#012, 47b0e82)

• Make the DNS allowlist real rather than advisory (#012, 2a52a53)

• One typed egress.allow list driving three surfaces (#012, 7a16ef8)

• Put operator sidecars inside the egress boundary (#012, 3511294)

• Refuse a sidecar that could dismantle the boundary it sits in (#012, 8a6811b)

• Report WHICH enforcement an environment got, not whether (#012, fa4a021)

• 012: Finish Phase B remaining tasks and reconcile the docs (#012, edf8a67)

• 012: Land T145-T151 with measured limits (#012, 7d7803c)

• egress: State at deploy time that a ported rule pins its addresses (#012, 7345411)

• egress: Tell the operator which mechanism they actually got (#012, 16cf2e7)

• egress: Warn when default-deny would break git push over SSH (#012, 397d25f)

• image: Build the Phase B egress boundary (#012, f004537)

Testing#

• Assert the port is CLOSED, not that the connection was dropped (#012, c021f66)

• Pin the three egress renderings and their disagreements (#012, ac923d6)

v0.20.0 (2026-08-04)#

Bug Fixes#

• Deliver the allowlist by content, and stop stranding the proxy (#012, 1b392ea)

• Make plan/status --json actually emit something (#009, c3dbb18)

• Name the environment in credential failures, never the declaration (#012, 3fa500f)

• image: Use apk's canonical fuzzy-version syntax (#012, 3abcaaf)

• specs: Packet filtering is a scope decision, not an impossibility (#012, 1ecfc91)

• specs: Refuse any operator NO_PROXY rather than comparing (#012, d5f3362)

• specs: Scope SC-002 to what the proxy can actually guarantee (#012, c550d42)

Documentation#

• Add a threat model, and require it be kept current (#012, 46dbe3c)

• Document egress control, and correct a false claim in CLAUDE.md (#012, 3cce53a)

• specs: Add US4/US5 — enforcement the agent cannot switch off (#012, 4a02451)

• specs: Choose the egress proxy by running four of them (#012, 8f00e70)

• specs: Clarify Feature 012 egress-provider-control (#012, eabc412)

• specs: Clarify US4/US5 — one destination list, and DNS as a third enforcement surface (#012, e7fce2e)

• specs: Close the remaining Feature 012 analysis findings (#012, feea858)

• specs: Close the US4/US5 clarification — sidecars are inside the boundary (#012, 519b964)

• specs: Correct FR-007's delivery route in Feature 012 (#012, b1ac59f)

• specs: One typed egress.allow list, replacing two keys (#012, 32f2522)

• specs: Plan Feature 012 egress-provider-control (#012, 7e8da72)

• specs: Plan Phase B — transparent egress enforcement (#012, 92983ef)

• specs: Record FR-010's real dependency in Feature 012 (#012, 133ef3f)

• specs: Specify Feature 012 egress-provider-control (#012, 438e800)

• specs: Task Feature 012 egress-provider-control (#012, 678e87b)

• specs: Task Phase B — transparent egress enforcement (#012, 14f7747)

• specs: The egress declaration governs ALL egress (#012, 5cbf5e6)

Features#

• Anchor the egress allowlist and stop parsing YAML with regex (#012, f026cc6)

• Declare permitted model providers per environment (#012, 4f20221)

• Disclose an operator override of the egress proxy (#012, 0221832)

• Disclose the built-in default provider, honestly (#012, 642110d)

• Enforce the egress declaration, and refuse to break git push (#012, 52f4098)

• Expose the egress facts through --json (#012, 0f45366)

• Make an edited egress declaration trigger a redeploy (#012, 698e8d0)

• Refuse an operator NO_PROXY that would silently disable egress (#012, d827bdb)

• specs: Let Feature 012 declare indirect provider endpoints (#012, 763a166)

Testing#

• Gate the threat model, and close the US4/US5 analysis findings (#012, 1f7988f)

• Verify egress against real containers; identity unchanged (#012, 87ed5b1)

• specs: Give SC-007 a verifying task in Feature 012 (#012, e13b579)

v0.19.0 (2026-08-04)#

Bug Fixes#

• spec: Identify .agent-container/ YAML by kind, not by glob (#011, def97fb)

v0.18.1 (2026-07-29)#

Bug Fixes#

• build: Name the image/ move when standing in a pre-011 checkout (97b1e1c)

Testing#

• guards: Prove every structural drift guard can actually fail (a71aa65)

v0.18.0 (2026-07-28)#

Bug Fixes#

• cli: Widen build_compose_model's env_file annotation (#011, bd63e84)

Code Style#

• specs: Format the python excerpt in 011 research (#011, b503d73)

Documentation#

• One authoritative layout map, and retire "project directory" (#011, b51d07d)

• specs: Clarify Feature 011 filesystem-layout (#011, ea65a19)

• specs: Drop the bare ./.env from env resolution (#011, fb53a9c)

• specs: Fix the remaining analyze findings for Feature 011 (#011, 0400c1e)

• specs: Keep plaintext credentials out of the project config dir (#011, 5bc4eaa)

• specs: Name .agent-container for what it holds, not what it marks (#011, 9da6d6a)

• specs: Plan Feature 011 filesystem-layout (#011, 016b908)

• specs: Repeatable -e/--env-file, stacking in order (#011, 6269754)

• specs: Settle project root vs project marker vocabulary (#011, cb4a336)

• specs: State FR-011 as derived from identity, not promised separately (#011, faad955)

• specs: Task list for Feature 011 filesystem-layout (#011, 977771d)

• specs: User configuration, not host configuration (#011, 608c8a5)

Features#

• build: Move the image sources into image/ (#011, 4871d19)

• cli: -e/--env-file is repeatable and stacks in order (#011, 4273204)

• cli: Refuse the pre-011 layout instead of ignoring it (#011, 0dc72a5)

• cli: Resolve per-environment files from .agent-container/ (#011, 803cf3e)

• container: Rename the shell-env directory to ~/.agent-env (#011, f6a84b7)

Testing#

• acceptance: Cover the new layout against real containers (#011, b0ff950)

• cli: Enforce that every short flag has a long form (8d5228b)

Breaking Changes#

• Completes Feature 011. Projects on the pre-011 layout are refused with every file that must move named; there is no compatibility mode. Container names, ports and volume names are unchanged, so environments already running stay findable and tear down cleanly -- only file locations moved.

• container: The persistent shell environment mounts at /home/dev/.agent-env instead of /home/dev/.agent-container. Shell snippets referring to the old path by name need updating; the file itself is not lost.

v0.17.1 (2026-07-27)#

Bug Fixes#

• completions: Zsh --agent completed nothing; test by executing (#010, 04c0f8b)

v0.17.0 (2026-07-27)#

Documentation#

• Prune CLAUDE.md back under its token budget (#010, bf28c8f)

v0.16.0 (2026-07-26)#

Bug Fixes#

• cli: Stop turning an in-progress teardown into a fatal port error (ab190e5)

• test: Update the list --json acceptance to the versioned envelope (#009, 5c79814)

Chores#

• Sync uv.lock to released version (29781a2)

Documentation#

• specs: Clarify Feature 009 agent-operable-cli (#009, 126ab30)

• specs: Plan Feature 009 agent-operable-cli (#009, a8cf78e)

• specs: Remediate analyze findings for Feature 009 (#009, 210419e)

• specs: Second clarify pass on Feature 009 agent-operable-cli (#009, 107fa9f)

• specs: Specify Feature 009 agent-operable-cli (#009, 0a4fc33)

• specs: Task list for Feature 009 agent-operable-cli (#009, 6baf17b)

• specs: The skill enforces --json on every invocation (#009, 596dbb6)

Features#

• cli: Agent-operable CLI — versioned JSON, coded failures, context, skill (#009, d610998)

Breaking Changes#

• cli: list --json, host ls --json and host show --json now wrap their payload in the versioned envelope; the record moves under data and carries schema/ok. Read .data to get the previous shape.

v0.15.0 (2026-07-25)#

Bug Fixes#

• build: Stop shipping operator secrets in the docker build context (7e8e2bf)

Chores#

• Sync uv.lock to released version (#008, 707fcc8)

Documentation#

• specs: Add credentials requirements-quality checklist for Feature 008 (#008, 05daf6d)

• specs: Clarify Feature 008 credential-managers (#008, c71dda1)

• specs: Plan Feature 008 credential-managers (#008, 51cf28b)

• specs: Remediate analyze findings for Feature 008 credential-managers (#008, c8ba535)

• specs: Resolve all 9 checklist findings for Feature 008 (#008, 2c0e634)

• specs: Specify Feature 008 credential-managers (#008, d0cea0a)

• specs: Task list for Feature 008 credential-managers (#008, 9695530)

• specs: Work through the 008 credentials requirements checklist (#008, eb02706)

Features#

• cli: Credential managers as first-class sources (#008, b613b5b)

Breaking Changes#

• cli: The encrypted credential source (age/sops decrypting a committed ciphertext) has been REMOVED — secrets must not live in the git remote, even as ciphertext. A spec still declaring source: encrypted is refused by any command that loads it, with a message naming the migration: move the secret into a manager (source: onepassword | bitwarden | command), the OS keychain (source: keychain), or a file outside the project / untracked (source: file). See docs/agent-as-code.md for the migration recipe.

v0.14.0 (2026-07-24)#

v0.13.0 (2026-07-23)#

Chores#

• Sync uv.lock to released version 0.11.1 (#006, 0ddaaa3)

Features#

• cli: Declarative host provisioning + SSH-key credential routing for agent-as-code (#006, 9396f8f)

v0.12.0 (2026-07-23)#

Features#

• cli: Field-level drift, convergence, and scoped destroy for agent-as-code (#006, ae70bee)

v0.11.1 (2026-07-23)#

Bug Fixes#

• cli: Raise wait_port_released ceiling to 30s (3d4d84d)

Continuous Integration#

• Run push CI only on main; never cancel main runs (8784da1)

v0.11.0 (2026-07-23)#

Bug Fixes#

• aac: Address US2 adversarial-verification findings (#006, aac5373)

Chores#

• deps: Sync uv.lock to 0.9.0 (#006, 5d4e85b)

Documentation#

• aac: Clarify the source=file FR-015 detection boundary (#006, 4faeb73)

• specs: Align US2 task text with resolve_credential_value (#006, 724483a)

Features#

• aac: US2 — resolve declared credential references at apply (#006, e5f5346)

v0.10.0 (2026-07-22)#

Bug Fixes#

• aac: Address adversarial-verification findings (#006, 5cc457e)

Chores#

• deps: Lock PyYAML for agent-as-code (#006, 38956d1)

Continuous Integration#

• Add pyyaml pin to the pytest jobs for agent-as-code (#006, baad2ca)

Documentation#

• aac: Document the declarative agent-as-code model (#006, 90ad959)

• specs: Address analyze findings for Feature 006 (#006, 5eaefa1)

• specs: Clarify Feature 006 agent-as-code (#006, 1db95eb)

• specs: Mark 006 clarification checklist item complete (#006, fe41e58)

• specs: Pin Feature 006 spec format to YAML/PyYAML (#006, 7c05bb9)

• specs: Plan Feature 006 agent-as-code + spec-integrity FR-020 (#006, 7a49e9a)

• specs: Task list for Feature 006 agent-as-code (#006, 3393961)

Features#

• aac: Declarative .agent-container project — apply/plan/status/destroy (#006, fd09368)

v0.9.0 (2026-07-22)#

Bug Fixes#

• shell: Strip ssh:// passwords + reconcile --endpoint + docs (#005, 2ec843d)

Chores#

• deps: Sync uv.lock to released 0.8.0 (#005, 340413c)

Documentation#

• specs: Address analyze findings for Feature 005 (#005, de9fdda)

• specs: Clarify Feature 005 shell-integration (#005, 4f85d8b)

• specs: Plan Feature 005 shell-integration (#005, 8bae3cd)

• specs: Task list for Feature 005 + add PowerShell dialect (#005, 32b8014)

Features#

• shell: Print/emit surface — attach --print + host env (#005, 3f2d081)

v0.8.0 (2026-07-22)#

Bug Fixes#

• execution: Clarify clone-on-start HTTPS credential log (#004, 889ebb7)

Documentation#

• execution: Correct the task-delivery guarantee wording (#004, 8a64683)

• specs: Apply analyze remediation H1/M1/M2/M3 for Feature 004 (#004, 3789a07)

• specs: Fold in --foreground guard and headless re-up semantics (#004, 33ee5cd)

• specs: Note headless-foreground sidecar caveat for M1 (#004, 210641d)

• specs: Plan Feature 004 agent-execution (#004, f0ef779)

• specs: Task list for Feature 004 agent-execution (#004, b8f586b)

Features#

• execution: Agent execution modes, sessions & workspaces (#004, 4ea731a)

v0.7.0 (2026-07-16)#

Chores#

• Sync uv.lock package version to 0.6.0 (#003, 599512a)

Continuous Integration#

• Add vulture/xenon/refurb to the quality gate + self-healing ty cache (a07e721)

• Pin vulture/xenon/refurb versions to stop local↔CI drift (#003, a844ea8)

• Test stdout only in run_check_nonempty so uv's install line isn't a finding (e0c6c40)

Documentation#

• Credentialing model + 003 polish (specs/003, #003) (b83391f)

• specs: Address 003 analyze findings — ephemeral API creds + coverage/convention (#003, 00d2832)

• specs: Plan Feature 003 agent-credentialing (#003, e4121d2)

• specs: Task list for Feature 003 agent-credentialing (#003, 8b53468)

Features#

• Model/API creds, canonical config, rotation (specs/003 US2/US3/US4, #003) (68c1c0f)

• Outbound SSH push credential, ephemeral (specs/003 US1 MVP, #003) (82325e9)

Refactoring#

• Simplify chained None-identity check per refurb FURB124 (#003, 225cab0)

v0.6.0 (2026-07-14)#

Bug Fixes#

• Harden the US3 live-reconcile against dead hosts (specs/002 US3, #002) (440bbe3)

Chores#

• Sync uv.lock package version to 0.5.0 (#002, 15b7576)

Continuous Integration#

• Probe ty's own resolution when validating the ty cache (7cb7a6c)

Documentation#

• Document the lifecycle verbs, live-reconcile, and sidecars (specs/002 polish, #002) (e4fd456)

• specs: Plan Feature 002 container-lifecycle (net-new scope) (28ce646)

• specs: Resolve 002 analyze finding I1 — redeploy is non-idempotent (#002, fdf42cf)

• specs: Task list for Feature 002 container-lifecycle (#002, 9526262)

Features#

• Container lifecycle verbs — stop/start/redeploy/wipe + lock (specs/002 US2, #002) (ca0fe82)

• Live-reconcile list against each host + fail-closed host_ps_rows (specs/002 US3, #002) (a822ffe)

• Sidecar helper services sharing the deployment lifecycle (specs/002 US4, #002) (6668425)

v0.5.0 (2026-07-13)#

Bug Fixes#

• Make the US3 safe-teardown guard fail-closed (adversarial review) (1764cd1)

Continuous Integration#

• Self-heal a broken ty cache in the quality gate (7a4bc30)

Documentation#

• Record US3 safe-teardown (tasks, README, CLAUDE) (3e0124d)

• specs: Reconcile 001 artifacts with the shipped US2 implementation (4018caa)

Features#

• Add host show / rm / rm --destroy with the safe-teardown guard (specs/001 US3) (e4e8c37)

v0.4.0 (2026-07-12)#

Bug Fixes#

• Apply adversarial-review fixes to the Hetzner provisioner (specs/001 US2) (d35f5b7)

• Authenticate provisioned-host docker over an ssh socket-forward (5a463c6)

• Authorize Hetzner root via the ssh_keys API, not cloud-init (specs/001 US2) (81491f9)

• Surface why the Hetzner docker-over-ssh readiness probe fails (c5f81fe)

Continuous Integration#

• Annotate pytest failures inline via pytest-github-actions plugin (192da84)

• Full-fetch the base ref for the conventional-commits check (ea16a7d)

Documentation#

• Add shell-integration specification (specs/005) (de6d759)

• specs: Add Feature 006 agent-as-code declarative spec (524f110)

• specs: Update provisioner contract for the socket-forward automation key (4089bef)

Features#

• Add Hetzner provisioner and host add --provider (specs/001 US2) (8adfb05)

• Make Hetzner readiness timeouts env-tunable (specs/001 US2) (f6fdf65)

Testing#

• Add opt-in tokened Hetzner provisioning acceptance (specs/001 US2, T026) (21dee6c)

• Guard the billable Hetzner provisioning test out of CI (96926c9)

• Make the Hetzner acceptance test env-configurable (specs/001 US2) (5753e80)

v0.3.0 (2026-07-10)#

Bug Fixes#

• Deliver injected SSH host key via compose config, not secret (49ce1bc)

• Pin compose volume names to preserve the identity contract (e3af85e)

• Stage injected SSH host key 0644 so the container's dev can read it (fe1b719)

Chores#

• Add host add/ls commands (specs/001 US1, held pre-release) (f03fe70)

• Add multi-host foundational engine (specs/001 phases 1-2) (678be55)

Continuous Integration#

• Grant contents:read to the manual publish job so checkout works (c97b79d)

• Rename release.yml back to publish.yml to match the PyPI publisher (fd236f0)

Documentation#

• Add agent execution & session management specification (specs/004) (2d67a8a)

• Add agent provisioning & credentialing specification (specs/003) (8d39f30)

• Add container lifecycle engine specification (specs/002) (801113f)

• Add implementation plan for multi-host deployment (specs/001) (5063f74)

• Add multi-host deployment specification (specs/001) (891f15f)

• Add task breakdown for multi-host deployment (specs/001) (09b871d)

• Document multi-host hosts/--host and the compose run mechanism (specs/001) (db60061)

• Record CLI grammar rationale for multi-host (specs/001) (3ab86f4)

Features#

• Complete host/--host shell completions and per-host state (specs/001 US1) (032d57a)

• Compose-based deploy path with --host (specs/001 US1) (0709756)

v0.2.0 (2026-07-09)#

Bug Fixes#

• Stage SSH-injection files 0644 so the container user can read them (cda2143)

• Wait for the published port to release on down before returning (d58325a)

• orchestration: Bring compose + Quadlet templates to six-volume parity (4f62c11)

• security: Scope git credential helper to https://github.com (e28cc7e)

Build System#

• Require Python 3.14 and add ty + bandit to the quality gate (df49c6b)

Chores#

• Add spec-kit (.specify) scaffolding (dde2915)

• Track .claude/settings.json to share the quality-gate Stop hook (4b4ce1c)

Code Style#

• Adopt ruff format + enforce ruff format --check in CI (c5d1773)

Continuous Integration#

• Add shared quality gate (Stop hook + CI job, one source of truth) (4bbf096)

• Bump actions to Node 24 majors to clear deprecation warning (#1, 71e9aa4)

• Enforce Conventional Commits (local hook + CI + ruleset) (9423053)

• Make ty and the acceptance job resolve/run under Python 3.14 (7d3215f)

• Phase 1 quality gates — ruff lint, Python matrix, CLI --version (10f1826)

• Phase 2 — release-please scaffolding (automated semver Release PR) (b610c0f)

• Pin setup-uv to v7 (no floating v8 major tag exists) (#1, 2550bce)

• Point ty at the deps venv explicitly (--python) so it resolves imports (188168b)

• Replace release-please with python-semantic-release (Continuous Deployment) (d67515e)

Documentation#

• Amend constitution to v1.1.0 (accuracy + compat clause + Principle VI) (da2f066)

• Amend constitution to v2.0.0 (redefine Principle I as Ephemerality) (2042d84)

• Amend constitution to v2.1.0 (add Principle VII — Continuous Deployment) (e3b8a8d)

• Broaden Principle III to Least Exposure (dual of Least Privilege) (56f252f)

• Raise Principle II to invariant altitude (Least Privilege, Immutable Runtime) (acf2ace)

• Raise Principle IV to invariant altitude (Deterministic Identity) (6230e5b)

• Ratify agent-container constitution v1.0.0 (881b901)

• Reframe Principle V as Durable Spec, Disposable Code (8760318)

• Reframe Principle VI to Least Dependencies (completes the Least-X trilogy) (67ce090)

• Refresh intro triad + fix stale Principle I cross-reference (Bite 8) (32adb35)

• Remove orphaned rationale left by the Principle VI reframe (de4af24)

• Trim Development Workflow section to policy; relocate mechanics to CLAUDE.md (0cc4614)

Features#

• cli: Keys subcommand for live SSH-key injection (no recreate) (36ea6fe)

• cli: Up --host-key / --authorized-key SSH injection flags (57d900e)

• rootless: Rootless container + persisted, injectable SSH identity (5676fd8)

Testing#

• Dump container status + logs when acceptance sshd never comes up (31242dd)

• Migrate suite toward Principle V (inverted pyramid, validation-first) (dce3e4b)

• ci: Run shell suites in CI + cover entrypoint credential/require_env (2ee0660)

Breaking Changes#

• The agent-container CLI now requires Python >= 3.14 to install and run; Python 3.11-3.13 are no longer supported.

v0.1.0 (2026-07-06)#

• Initial Release