v0.2.0

Added

• Roadmap (D-110, 10 M6): AgentLink on Solana after the EVM chains, direction only with no dates, starting with a design spike (M6-1).
• Docs site: a "Privacy of proofs" concepts page and a "What a proof makes public" section in the user guide (D-109).
• Testnet credits pool alerts (M1-10b-e, S2, 05 §9): the submitter's /v1/health reports per chain whether the gas wallet is ok or low and whether the free test credits are ok, low or paused; a scheduled check fails visibly so the owner tops the wallets up before they run dry. While the faucet cannot cover one grant it answers paused instead of failing part-way.
• A deploy pipeline for the proof relay and the testnet credits faucet (M1-10c, S2, D-28, D-88, release §4.5): every merge deploys staging, a smoke test checks health, a simulated proof on each test network that sends nothing, and that the faucet refuses a mainnet; production at submit.agentlink.4thtech.io (the testnet beta) follows automatically, with a health check, automatic rollback and the deploy freeze. Its keys are set by the owner only, outside GitHub (owner steps: docs/runbooks/submitter-deploy.md).
• First-run page in the local app (M1-11b-1, S2, 08 §1, D-120): protect your approvals with one passkey (Touch ID, Windows Hello or your phone). The page then shows your owner fingerprint, to compare with agentlink doctor, and a backup owner code, folded away, shown only once. The recovery kit can wait ("Later"); the page remembers it for a reminder. The last step tells you what to say to your AI next, with a Copy button. Every failure is explained in plain words, and a computer that is already set up is never set up again. Shared page states (expired link, AgentLink not running, setup unfinished, network, empty, loading and error) now match the design. The page is included in this release but not yet opened or connected by the CLI, so it is not usable end to end yet; it becomes usable from the next release (M1-11b-6, agentlink ui).
• An Activity page in the local app (M1-11c-a1, S2, 08 §1): what happened lately, newest first, in plain words: requests you approved or denied, requests approved by your rules, proofs, senders and contacts you blocked, and rule updates. Nothing on it changes anything. When it is empty, it suggests what to ask your AI. The page is included in this release but not yet opened by the CLI; it becomes usable from the next release (M1-11b-6).
• The core can now answer the local app's read-only pages (M1-11r-a, S2, 07 §2): your agent and owner fingerprints, the agent ID for adding credits, the resolved shared folders, your proofs list, credits per proof network, free test credits on test networks only, the message network list, and an activity feed of approvals, proofs, blocks and rule changes. Nothing secret is returned.
• Core: helpers that prepare the unsigned owner actions the local UI shows before the owner confirms: a rules edit (allowed folders and every other policy setting) as a complete, version-bumped policy.set, and the safety-code check, rename and remove of a contact. They never sign; the owner's confirmation still signs on this machine (M1-11r-b, S2).
• The core can now tell the local UI's Storage page how much of the encrypted drop's weekly allowance this agent has used, and whether your own storage is connected and working, with its last test result (M1-11r-c, S2, 07 §2). It never shares storage addresses, bucket names, credentials or file links.
• The activity list now shows messages and files you sent or received, requests from unknown senders, the contact name on each entry and what each item cost (M1-11r-d).
• The local web app has its first shell (M1-11s-a, S1, D-118): a new React app in apps/local-ui with the sidebar, header and status bar from the design system, the routes for first run and the settings pages, and a "not available yet" state on each page until the page cards land. The agentlink mcp server now holds it, but nothing opens its pages for you yet, so it stays in development.
• The local approval page's server can now host the new local web app (M1-11s-b, S2, 08 §1, D-118): its files are served from the CLI itself under a strict content security policy, its pages open with the same one-time link and session as the approval page, and every change it makes needs your owner code or passkey, checked before anything runs. The app's pages are included in this release but not opened yet.
• Owner setup on the first-run page (M1-11s-c, S2, 04 §2.2, §2.3.1, 08 §1, D-120): the local approval server can now protect your approvals from the setup page with one passkey gesture. A backup owner code is made at the same time and shown once, and your agent's first card is signed in the same step; if anything fails, nothing is saved. Once approvals are protected on this computer, setup is refused. The first-run page that uses it is in the local app (M1-11b-1), but the CLI does not enable this setup or open the page yet (M1-11b-6), so it is not usable end to end yet. Spec text is proposed, owner confirms at merge.
• The AgentLink skill file now covers files and proof (M1-12c, S1, 06 §5, 11 §5.6): sending a file with or without proof (cost first, no network choice), receiving a file safely, checking whether something was received, delivery receipts only when the user asks, exporting proof, and recording a proof of agreement for final terms. A repo test keeps it inside the in-chat vocabulary.
• End-to-end tests for files, proof and proof of agreement (M1-13c, S1, 10 M1-13, 02 J2, J3, J5, J8): a 5 MB file with no storage set up, needs_credits then the faucet route then the recorded proof, the default and per-contact receipt rules (D-109), a third party's agentlink verify on the exported pack and tampered packs failing with their reasons. A deterministic run against the repo's fakes is part of the e2e job; a live testnet run (e2e-live, manual dispatch on main) is opt-in. The proof of agreement itself is still not reachable through the tools (the terms tools refuse notarize); two it.fails tests state it.
• The invite page checks that the inviter's name matches the invite and shows a damaged invite, with no install prompt, when it does not (M1-19-b, S2, 04 §3.6).
• A CI deploy pipeline for the invite page: staging only, on every merge, with a smoke test that compares the served files and headers with the build. The production deploy waits for the trademark check and the domain decision (M1-19-d) (M1-19-b, 08 §4, D-25, D-52).
• The invite host's static how-to-install page is built (M1-19, S1, 04 §3.6, 06 §7.1, 08 §4): it reads the invite from the link in the browser only, checks its size, version, format and expiry, shows who invited you (name under the contact-name rule, labelled Self-declared) and one prompt to copy into your own AI that installs AgentLink and accepts the invite. The prompt holds only the official text and the canonical link. No analytics, no referrer, and the strict content policy of 08 §4. Not deployed yet: the deploy pipeline follows in its own card.
• With files.deleteAfter: receipt, your agent now deletes a sent file from storage (your own or the encrypted drop) once the contact's delivery receipt is on record. A drop file uploaded before a key change is still deleted with the key it was uploaded under. Without a delivery receipt nothing is deleted and the file stays until it expires (M1-1g-h, S2, 04 §4, 06 §3, 07 §5.4). Every key store backend now runs one shared set of key-epoch and drop-request tests.
• Test vectors: the eip712-revocation suite refuses a Revocation under any domain other than the OCC v2 chain domain, including the AgentCard domain, and a keyEpoch spelled -0; 04 §2.4.1 names the Revocation keyEpoch and deadline as JSON integers (M1-1j-b, S2).
• New user-guide page "Negotiating terms", glossary entries for offers, and an FAQ answer on negotiating; the guide's FAQ and glossary no longer say nothing can be installed (M1-25, S1).
• The top-up link in the tools and the CLI (M1-26-e, S1, D-111, D-113), off until the pay page is deployed: the pay host and a live flag come from the shipped chain config (PAY_PAGE, not live yet). When live, needs_credits and agentlink_status give https://{payHost}/#v=1&a=<agent ID>&usd=<suggested amount> (address and amount only in the fragment), and agentlink credits --topup prints it with a terminal QR code and opens the browser for a person at a terminal. Today no link is given and needs_credits says adding credits is not available yet. The server instructions describe agent-assisted funding.
• agentlink init --hook adds an optional start-of-session note to Claude Code: a line or two with unread counts, requests and contact names from agentlink status --brief, never message text. It is off until you ask for it, shows the exact change to ~/.claude/settings.json first, writes it only after you confirm, and runs the installed program by its full path, never npx. Codex, Gemini CLI, OpenCode and Antigravity are documented as not available (M1-29, S1, 06 §7, D-53).
• When you add proof you can ask the contact to confirm delivery; when a contact asks you, your agent tells you and confirms only if you choose "Confirm delivery". Asking never confirms anything by itself, and each confirmation says what it makes public (M1-33d, S2, D-109, 06 §2.4).
• The shared UI package now carries the design tokens: typed values and a CSS file for the light, dark and increased-contrast themes, the Geist fonts served from the package itself (no external fonts or CDNs), and the font and icon licence notices (M1-35a, S1, 11 §11.7).
• The shared UI package now has the review-together view for approvals: one agent's waiting approvals as full cards, each with Approve, Deny or Later and nothing preselected, and one button that names exactly what it applies, such as "Approve 3 and deny 1" (M1-35b-b, S1, brief B-2).
• The shared UI package now has the 31 core components of the design (approval and commitment cards, untrusted content, safety code, secret display, status chips, file and credit cards, app shell and tray menu) with a stylesheet built only from the design tokens; no inline styles, text from other parties always renders as plain text, and every state is checked for accessibility (M1-35b, S1, 11 §8, §9).
• @4thtech-io/ui exports its strings and lintVocabulary (M1-35c-b): the 11 §5.1 never-say list as one shared source, with the Advanced exemption. Pages switch their local checks to it in a follow-up.
• English strings for the local app, chat and terminal in @4thtech-io/ui, audited against the vocabulary rules: the "what a proof makes public" lines, rolling 24-hour and 7-day wording, no network named as a choice, and a lint that fails on any banned word (M1-35c, S1, 11 §5).
• agentlink owner init and agentlink owner add-agent set your agent's first rule in the same owner code entry as its card (M1-36b-2, S2, owner decision D6 of 22 Oct 2026; 04 §2.5, §2.8; 06 §3): an empty AgentLink/Send folder in your home folder that your AI can send files from. It is created (readable only by you) when missing; an existing folder is used only when it is a real, empty folder, so no existing file becomes sendable. Everything else stays at the defaults, and AgentLink signs nothing wider, whatever was prepared. If the rule can't be set, setup still finishes with the defaults and the folder it created is removed; remove the folder from your rules any time with agentlink policy remove-folder <path>. (Proposed, owner confirms at merge: the 04 §2.5 and §2.8 wording that lets the one entry also sign this first policy.set.)
• agentlink init sets up Cursor and Windsurf, showing the exact settings change first and writing only after you confirm; new Cursor and Windsurf pages in the guide (M1-36g, S1, 06 §7).
• Free test credits on your first proof (M1-36i, S2, 05 §9): on a test network, the first proof that needs credits adds free test credits once, and the result says so in one sentence. When free test credits are paused, the result says so plainly. Test networks only; only the public agent ID is sent.
• The agent's key store can now sign the agent's own credit top-ups, withdrawals to its own account and proof payments on the test networks, and refuses anything else, so a later top-up step needs no other signer (M1-4c-b, S2, 07 §6.2, D-123).
• Your AI now tells you when some messages may be missing from a check (M1-5g, S2, 07 §4.2, IR-M1-5d-1 M-1): a server that returns only part of one busy second is counted in the core sync result (incomplete, a count only), and agentlink_inbox, agentlink_status and agentlink status --brief add one fixed line saying the next check looks again. No server name, time or message ID reaches the result or the logs, and the saved sync position still moves on, so a flood cannot stall sync.
• Files: when the storage refuses a file's link before it expires (for example, after own storage was reconnected), the recipient's agent can ask the sender's agent for a fresh link; the sender's agent answers from its own storage when it is online, and the file can then be saved. A fresh link never keeps the file longer than the original expiry, and only the contact the file was sent to gets one (M1-7f-3, S2, 04 §4; proposed, owner confirms at merge).
• Files: a 5 MB send and fetch through own S3 storage, and the fresh-link flow, now run against MinIO in CI (M1-7f-3).
• Proof of agreement through the tools (M1-9d-3, S2, 06 §2.2a, 04 §3.4.2; J8): agentlink_propose_terms with notarize sends a firm offer and records it, and agentlink_respond_to_terms accept with notarize records the acceptance (nothing is charged when the offer already has a proof). Each side's owner approves once, and that one approval covers the terms and the proof fee. With no credits, nothing is sent and the owner is not asked. The other side's one approval adds the Accepted receipt, and the exported proof verifies with the owner's signed approval. A recorded counter-offer or rejection is not available yet.
• Recorded counter-offers (M1-9d-5, S2, 06 §2.2a, 04 §3.4.2; J4, J8): agentlink_respond_to_terms counter with notarize sends the new version as a firm offer and records it, as agentlink_propose_terms with notarize does. The owner approves once, and that one approval covers the new terms and the proof fee. With no credits, nothing is sent and the owner is not asked; a newer version from the contact before it is sent voids the approval. The other side's one approval of an accept adds the Accepted receipt. A recorded rejection is still not available.
• The Claude Desktop extension bundles are signed with the 4thTech certificate from this release (0.2.0) (M1-9f-cert); the public certificate is in the repository so anyone can check a bundle.
• Optional Claude Desktop extension (M1-9f, D-91): every stable release attaches one-click bundles for macOS and Windows to the GitHub Release, with a SHA-256 list and a build provenance attestation, signed with the 4thTech certificate (#517) from this release. Every other AI app keeps using npx -y @4thtech-io/agentlink.
• Owner-signed own storage and recovery-kit export in the core (M1-9i-a, S2, D-115; 04 §2.5.1, 07 §3.4, §5.6): the storage.set, storage.remove and backup.export owner actions, the own_storage store table (schema version 5) with its anti-rollback storage-mark, and a broken own storage that asks you to connect it again instead of ever falling back to the encrypted drop. The agentlink storage and backup commands come with M1-9i.
• The recovery kit format (M1-9i-b, S2, 04 §2.3.3, D-115): one sealed file that holds the owner key and, per agent, its keys and its store, opened only with a new recovery code shown once. Nothing in a kit is read or acted on until the whole kit checks out, and a damaged, cut, reordered or foreign kit is refused with one error. The backup export and backup restore commands that use it come in later cards.
• The binding between your own storage credentials and the owner's signed connect (M1-9i-b2, S2, 04 §2.5.1, D-115): a salted digest of the access key and secret, so a changed or swapped credential stops own storage instead of being used, and the owner-only building blocks for backup export, restore and storage credentials, which no agent tool can reach. The storage connect, backup export and backup restore commands that use them come in later cards.
• Tester runbook for the M1 gate (M1-GATE-a, S1, RB-20): recruitment checklist, per-journey script for J1 to J5 and J8, a testing-log template and how to report issues. G-21 is decided (D-124, owner-confirmed 2026-10-23): every tester under 5:00 from install to first message, counterpart waiting excluded, self-timed with a stopwatch and two local timestamps, with no analytics.
• Groundwork for gasless test-USDC top-ups on Base Sepolia: the agent only signs a USDC top-up under the token's own signing details as read from the network and checked against the token's published fingerprint, never under hard-coded ones, and only in the form that the AgentLink fee vault alone can redeem; a new eip3009 test-vector suite pins this against the real Base Sepolia USDC (M3-4b-t-1, S2, 03 §4.4, 05 §2.5, D-123).
• Groundwork for gasless test-USDC top-ups on Base Sepolia: the agent can prepare a top-up of $5 to $50 that only the AgentLink fee vault can redeem, as its own credits, valid for 15 minutes and approved with the agent's own key; a submitter checks it fully before paying the network cost. Not switched on yet: it waits for the fee vault update and the owner approval step (M3-4b-t-2, S2, 05 §2.5, 07 §7, D-123).
• The submitter can now relay a gasless test-USDC top-up on Base Sepolia and pay the network cost: it checks the top-up fully (only to the AgentLink fee vault, $5 to $50, valid for 15 minutes, approved with the agent's own key, not used before) before sending, sends it once even if asked twice, and allows 5 top-ups per agent per hour. Off until the operator switches it on (M3-4b-t-3, S2, 07 §7, D-123; the 07 §7 note is proposed, owner confirms at merge).
• MCP: while the approval page is open, the tool call waits briefly (up to 45 s, set per harness) for the owner's decision, so the user no longer has to go back and tell their AI "done". The owner still approves on the page, and nothing runs until the agent's next call (M1-36j, S2).
• Storage: when a provider silently ignores the clean-up of unfinished uploads, setting the bucket's expiry rule now succeeds with a clear warning that interrupted uploads will not be cleaned up automatically (M1-6b-d, S1, 07 §5.2).

Changed

• The card counts in docs/process/backlog.md are generated (CHORE-BACKLOG-COUNTS, S0): node tools/docs-status/index.mjs counts the card headings for M0, M1 (M1a, M1b), M2 and M3, and --check (in pnpm lint and CI) fails when they are stale. Authors no longer edit the count rows, so card-adding PRs stop conflicting on them; a merge conflict there is resolved by rerunning the generator.
• CI reruns a flaky failure once by itself (CHORE-CI-AUTORETRY): when a pull request or main run of CI or Security fails on its first attempt only in jobs or test steps known to flake (never lint, typecheck or build), its failed jobs are rerun once, so an approved pull request no longer waits for a human rerun.
• CI spends fewer runner minutes (CHORE-CI-MATRIX-QUEUE-ONLY, S1): the macOS and Windows jobs run only in the merge queue and on main, and a docs-only change skips the heavy test, vector, e2e and matrix jobs. Required checks and the merge queue gate are unchanged.
• The merge queue stops running CI twice per entry (CHORE-CI-QUEUE-DEDUPE, sensitive): ci.yml and the branch secret scan now ignore pushes to gh-readonly-queue/** branches, because the merge_group run already covers the same commit. The required checks are still produced by the merge_group runs; pushes to main and to ordinary branches are unchanged.
• Draft pull requests skip the full CI suite and run it when marked ready for review; non-draft pull requests get a fast stale-precheck that merges the current main and fails early, with the fix command, on a conflict, drifted generated status files or a stale lockfile. The merge queue still runs everything (CHORE-CI-SPEED-1).
• Pull requests get CI results faster (CHORE-CI-SPEED-2, S1): the checks job of a pull request lints, typechecks, builds and tests only the packages it changes, the packages that depend on them, and the packages whose tests read a changed doc (tools/ci/select-affected.mjs). A change to root config, the lockfile, tools/, .github/, test-vectors/ or the shared packages types, crypto and core still runs everything, and the merge queue and main always run the full suite.
• Pull requests start fewer CI jobs (CHORE-CI-SPEED-3, S1): the heavy jobs vectors, keychain, relays-docker, storage-minio, bundle-check and e2e-deterministic run on a pull request only when its change reaches the packages they test (HEAVY_JOBS in tools/ci/select-affected.mjs). A change to .github/, tools/, root config, the lockfile, an unknown path or the shared packages runs them all. The merge queue and main always run every job, and in the queue ci-gate now fails if one of them did not run and pass.
• The hourly deploy reconcile no longer stacks approval requests (CHORE-DEPLOY-RECONCILE-b, S2): while a production run for any commit waits for the owner's approval, it dispatches nothing and the run summary asks the owner to approve or cancel it. When it finds no production deploy in the last 30 finished runs it now raises a warning (log and summary) instead of a notice.
• The deterministic prompt-injection suites for the Talk, file and proof tools (M1-13b, M1-13d) now run in the CI e2e job on every pull request with a code change, with an exact test count per suite (CHORE-E2E-INJECTION).
• Spec (D-109, S2, 04 §3.4, §5, §5.1; 05 §3.1, §3.3, §4, §6; 06 §2.4, §3; 07 §7, §8; 11 §5.6; 12 §4.4): privacy of proofs. Delivery receipts are planned to be off by default (a sender can ask, the recipient or its rules decide), every proof surface says what becomes public, a proof links only to the same agent's earlier proof, the proof service keeps no IP next to an agent, and the Registry publishes no guessable name. Cards M1-33a–c, M2-17a–c and OPS-PRIV-1; per-relationship signing addresses moved from M5 to M2.
• Direction for adding credits (D-111, docs only): one link from the agent opens the pay page, crypto first: use crypto you already have, or send from an exchange to the agent's address with a QR code, with amounts in dollars and no network choice on the default path. The agent explains the one step, watches for the funds and confirms the credits, and never asks for keys or moves funds. Users pay every cost; 4thTech subsidises none (the testnet faucet excepted). Pay by card comes last, after the legal entity is decided. Design brief docs/design/topup-ux.md; spec lines in 06 §2.4, 08 §1 and §2.3, 11 §5.1 and §6.7, 12 §1 and §4.5; new cards M1-26-e, M1-34, M2-18a–d and M3-4c. The card approach and provider, the top-up link format and who pays for receipts (user-paid in any case) are open owner decisions.
• Two owner decisions (D-112, D-113, M1-26-d, docs only): messages and files stay free, and "users pay all costs" covers proofs, receipts and top-ups only; the top-up link is https://{payHost}/#v=1&a=<agent address>&usd=<suggested amount> with everything in the fragment (so it never reaches server logs), no network or token, and usd optional. Spec lines in 08 §1, 06 §2.4 and docs/design/topup-ux.md §5.
• Owner decision (D-114, M1-34, docs only): the sender's proof fee covers up to 3 receipts, deferred posting is the fallback when the submitter is unreachable, and a recipient is never charged without asking. Spec lines in 12 §2 and §11, 07 §7 and docs/design/topup-ux.md §8; the submitter work is the new card M1-34-b.
• Build plan (D-116, docs only): the owner's design (D1 and a first pass of D2, in docs/design/ since 14 Oct 2026) is now the basis for the UI, which no longer waits for D2. Because the design predates later decisions, a design adjustment audit (DESIGN-ADJ-1) comes first; new cards M1-35a–c (tokens and fonts, components, copy audit) and M1-19-c (styled invite page); the design status page gains a screen index, known gaps and copy issues.
• Design decisions (D-117, docs only): backup export in the local UI behind the passkey, restore in the terminal only; the exchange network shown only inside the exchange steps; no "wallet" in labels; a $5 top-up minimum; the UX north star. Own-storage credentials stay in the terminal; the page shows status.
• Local UI direction (D-118, docs only): the local UI becomes a React app in apps/local-ui embedded by the CLI and served through the existing approval server, with owner presence and signing staying server-side. Backlog cards added for the shells, core read APIs, components and pages (spec 08 §1).
• Audit rules (D-118, proposed, owner confirms at merge): apps/local-ui/** is S1 by path.
• Policy loosening (D-119, docs only): an owner-signed policy edit that loosens a rule is allowed with warnings, and the local UI does not sign until every warning is acknowledged. Anything the strict schema forbids stays impossible.
• Backlog: follow-up cards from the 22 October UX audits (M1-36a to M1-36i, M1-37a) and review follow-ups.
• Owner decisions D-120 (app UX: page-first setup, recovery kit later, automatic test credits, seven-item navigation) and D-121 (agent-side install, approval wait, automatic agent names, default send folder), docs only; new cards M1-36b, M1-36j, M1-10b-e, M1-11s-a-b and M1-37b.
• New card M1-11s-c (owner setup route, S2); D-120 records that passkey setup also creates a collapsed backup owner code.
• Owner decisions D-122 (payment model, QR top-up, Withdraw credits, public trust documentation) and D-123 (Chiado QR top-up now; M1-3c and a testnet slice of M3-4b pulled forward); new cards M1-11c-a4c, M3-4b-t, M1-11r-d, M1-11t, M1-36b-2, M1-36i-b, M1-36i-c, M1-36i-d and M1-10b-e-b.
• M1-11c-a4c now adds core owner actions credits.deposit and credits.withdraw (proposed 04 §2.5.1 rows) and depends on M1-4c-b, which is in progress under D-123.
• Backlog fixes: M1-11c-a4c dependencies split by network, DOCS-PAY-TRUST card added, M3-4b-t moved to phase M3, M1-36i-d narrowed, M1-3c carries the testnet allowlist and minDeposit steps.
• The agent instructions now say UI work follows docs/design/README.md (D-116): style from its screens, and build unstyled only where no screen exists (DESIGN-UI-RULE, S1, process).
• Spec wording (DOCS-04-28-WORDING, S1, 04 §2.8): the 64 KiB limit of the headless file KeyStore is the total across all stored items, not a per-item limit, matching the implementation (proposed, owner confirms at merge).
• Spec 06 §2.4 now matches the tools: a paid tool that needs credits returns topUpUrl and agentAddress, not url; topUpUrl is left out while the pay page is not live (DOCS-06-TOPUP, S1, proposed, owner confirms at merge).
• Docs (DOCS, S0): README, docs/status.yaml, the status page, knowledge/, llms.txt and the user guide now say v0.1.2 is the current release, that the proof submitter is live on a testnet and the Chiado contracts passed their smoke test (21 Oct 2026), and separate the merged work for the next release (receipts off by default, privacy notices, proof-mismatch flags, delete on receipt). New backlog cards M1-5g, M1-9zf and M2-19 from review follow-ups.
• Docs (DOCS, S1): README, docs/status.yaml, the status page and knowledge/ now list what merged on 21 Oct 2026 for the next release: firm offers and recorded accepts with proof on the terms tools, the recovery kit file format, the invite contact check, the incomplete-sync notice and the faucet hardening. Chiado joins automatic selection only once the faucet serves it. Backlog cards M1-3j-b, M1-5g, M1-9d-3 and M1-9ze are marked done.
• Owner decisions of 23 Oct 2026 recorded (DOCS-DECISIONS-1023, S1, 00 decision log): D-127 drops the stored per-contact proof flag for M1 (M1-7g-e won't do); D-128 makes owner-signed JSON strict on the received text, refusing duplicate and escaped member names before the signature check (04 §2.5.1, M1-1h-b); D-129 confirms the drop's 100 MB per file and 1 GB per week limits and keeps the drop internal-testers-only until counsel signs off (M1-28). M1-9f is unblocked per D-91; DOCS-G21-b is done (#470).
• Backlog gains nine cards for the 2026-10-23 review follow-ups (DOCS-FOLLOWUPS-1023-b, S1): DOCS-06-TOPUP, M1-6b-d, CONTRACTS-PARITY-b, DOCS-RUNBOOKS-1023-b, DOCS-RUNBOOKS-1023-c, PROC-MECH-MERGE-IR-b, M1-10b-e-c-b, M3-4b-t-T2-c and CHORE-BACKLOG-COUNTS-b.
• The backlog gains cards for the 2026-10-23 afternoon review follow-ups (DOCS-FOLLOWUPS-1023-c): nine follow-up cards in M1 (six of them M1-*) and one M3 card, with the card counts updated by hand.
• Backlog cards for the 2026-10-22 review follow-ups (DOCS-FOLLOWUPS-1023, S0): M1-10b-e-c, M1-36g-b, M1-36g-c, M1-6b-c, M1-11s-c-e, M1-36d-c, M1-27b-e, M1-3c-d, CHORE-CI-PLAYWRIGHT-2, CHORE-DEFLAKE-2-b and CHORE-DEPLOY-RECONCILE.
• Ten more review follow-ups carded in the backlog (DOCS-FOLLOWUPS-1023B, S0): M1-33d-d, M1-36d-d, M1-36i-e, M3-4b-t-T2-b, M3-4b-t-S0-b, M3-4b-t-S0-c, M3-4b-t-T3-c, CHORE-DEPLOY-RECONCILE-b, DOCS-PASS-1023-b and DOCS-G21-b.
• The M2 gate's onboarding timing rule is recorded as D-125 (DOCS-G21-b): median install → first message under 5 minutes, at least 80% of testers under 5 minutes, and no tester over 15 minutes for a cause on our side. Counterpart wait is excluded and timing stays self-reported with no analytics. The M1 gate stays strict (D-124).
• Docs pass 2026-10-23: the status, the credits page and the CLI reference now cover setting up Cursor and Windsurf with init, free test credits claimed once per agent and test network, faucet and gas pool alerts, deploy rollback on cancel or timeout, owner setup hardening and storage hardening. The gasless test top-up is described as in progress only.
• Runbooks match how CI, merging and deploys work today (DOCS-RUNBOOKS-1023, S0): RB-08 tells a flaky failure from a real one, sets the single-rerun policy and covers merge-queue ejection; RB-09 describes the merge queue and the changelog fragments; RB-10 and RB-11 cover superseded deploy runs, catch-up, the hourly reconcile and the automatic rollback on cancel or timeout; RB-19 documents every submitter pool alert state.
• The README Status and Roadmap, the docs-site status page and the knowledge overview now include what merged on 23 Oct 2026 in the evening: the local app shell and Activity page (in development), the Claude Desktop extension bundle (signed with the 4thTech certificate, #517, comes with the next release), receipt retry, file link refresh, multi-identity sync and storage status and warnings (DOCS-STATUS-1023-b).
• Status pages and README name the merged init improvements, Cursor and Windsurf setup, free test credits from the terms tools, and the not-yet-available gasless test top-up (DOCS-STATUS-1023, S0).
• Docs (DOCS, S1): the Networks and contract addresses page and the Contracts page now say the Gnosis Chiado live smoke test passed on 21 Oct 2026 (contracts run 39587157618); Chiado is still not chosen automatically until the faucet serves it (M1-3j-b).
• Backlog (docs only): follow-up cards from the 2026-10-22 afternoon reviews (M1-11b-6 to M1-11b-8, M1-11s-c-b, M1-11s-c-c, M1-11c-a2b, M1-11c-a3b, M1-11c-a4d, M1-11c-shared, M1-11s-a-c, M1-11s-a-d, M1-4c-b-b, M1-3c-b-b, M1-35c-c, CHORE-CI-HARDEN-1b); card counts recounted from the headings.
• Free test credits are now $0.50 (5 proofs) per agent instead of $1 (M1-10b-e, owner decision 2026-10-22); one claim per agent per day, 3 per network address per day and 200 per network per day, as before.
• The local app navigation now has seven items (M1-11s-a-b): Approvals, Activity, Contacts, Files, Proofs & credits, Rules and Settings. Storage lives inside Files, and Backup, Passkeys and Advanced sit under Settings. The old Storage address still works and goes to Files. The status bar no longer says "Connected" before the connection is known. Proposed spec edits to 11 §6.2.1 and 08 §1, owner confirms at merge.
• Quickstart docs for the first session (M1-12d, S1, D-39, D-40, D-48): "Send your first message" now walks from a paired contact to a message, a file through the encrypted drop (no setup for files above about 12 KB), a proof, free test credits, a saved proof file and agentlink verify, with the approval step in your own terminal. The guide pages for files, proof and approvals match what the CLI and tools do today, and the tool list on "How setup works" now names all fifteen tools.
• Your agent now records the files.deleteAfter setting with each file it sends. Delete on receipt only removes a file that was sent under receipt while the policy still says receipt, so switching to receipt later never deletes files sent earlier, and files sent before this update are kept until they expire. The local store moves to schema version 4 (a new column, migrated automatically). The delete-on-receipt pass now resumes after the last envelope it checked, so no sent envelope is skipped when others are deleted between passes (M1-1g-i, S2, 04 §4, 06 §3).
• files.deleteAfter help and spec note (M1-1g-j): the CLI policy review and 06 §3 now say the setting applies only to files sent while it is on and only while it stays on, that the policy is checked once per retention pass, and that the value kept with a file comes from the policy load when the file is prepared for sending.
• The two-Mac dogfood tool caps error text copied into its notes, names the macOS SSH keychain limitation in its preflight, removes a stale invite file on Mac B at start and exit, and makes Mac A tell Mac B to stop on any early exit (M1-23-f, S1).
• The price agentlink_status shows is now the price where the next proof would actually be paid, picked the same way as when adding proof; nothing asks for a network (M1-26-c, S2, 07 §6.3, D-40).
• Encrypted drop deploys (M1-27b-b, S2, release-and-deployment.md §4.5.1): the bucket's 7-day deletion rule is now checked before anything is deployed, so a missing rule stops the deploy with nothing changed. A production deploy that is cancelled or times out after it started now always rolls back to the previous version (or confirms that version is still live) and sets the deploy freeze. The drop's CPU limit per request is 5 s instead of 30 s, based on a measured 0.42 s for the largest commit.
• Spec wording only (M1-30, S2 by path, 04 §4, 06 §2.0): the two old tool names left in the security spec (fetch_file) now read agentlink_fetch_file, and the old-name note in the MCP spec is removed. No rule, threshold or invariant changed.
• Delivery receipts are now off by default (M1-33a, S2, D-109, 06 §3): a delivery receipt shows publicly that a recorded message reached your agent, so your agent no longer signs one on its own unless you turn it on, for everyone or for one contact. If your earlier rules had them on from the old default, agentlink doctor says so, and the next time you sign your rules AgentLink asks whether to keep them on; anything but yes turns them off, and a yes is remembered. Opened, accepted and rejected receipts work as before.
• Proofs say what they make public (M1-33b, S1, D-109, 11 §5.6): your agent explains, before the first proof of a session and on every approval that adds one, that anyone can see that your agent recorded something, when and what kind, and never what it says. Receipts, the proof file and adding credits carry the same plain words, and the user guide's privacy, proof and credits pages quote them.
• The shared proof-result schema now lists the delivery-receipt flags and the Advanced network field that proof results already carry (M1-33d-c, S1, 06 §2.4).
• The shared proof-result schema now accepts the proof results agents actually get: the network only under Advanced, no required txHash or fee-split fields, and the agent address and top-up link when credits are needed; a proof that asks for a delivery receipt says so in a receiptRequested field (M1-33d-d, S1, 06 §2.4; spec lines proposed, owner confirms at merge).
• Receipts on a proof are paid for by the sender's proof fee (M1-34-b, S2, D-114, 07 §7, 12 §2): the 4thTech submitter now accepts up to 3 receipts for each recorded proof even when the recipient has no credits on that network, and refuses any more. If the submitter cannot be reached, the recipient's agent keeps the receipt and sends it on a later sync; the proof stays valid with fewer receipts meanwhile. A recipient is never charged for a receipt: it is never sent from the recipient's own account unless the user asked for that.
• agentlink init is simpler to finish (M1-36b, S2, owner decisions D1 and D5 of 22 Oct 2026; 06 §7): in a terminal you opened, it offers to install AgentLink on this computer, shows the exact npm i -g @4thtech-io/agentlink command and runs it only after a yes; declined or failed, npx stays the fallback, and an agent-run init never installs, it only prints the command. A run for one app names the agent after that app (codex, claude-code, …) unless --agent is given; several apps at once, --harness none or a computer that already has the default agent keep default. Each app's diff is printed once, right above its question, and every command init prints starts with the form that works on this computer. The default send folder (decision D6) is not part of this change. (Proposed, owner confirms at merge: 06 §7 wording for the automatic name and the install offer.)
• agentlink --help and command output only name commands that work (M1-36c, S1, 06 §8): the unavailable contacts --verify and policy set are no longer listed, help is grouped (start here, every day, more) with a one-line purpose, and invite messages say safety-code checks arrive in a later version.
• Tool results always name one plain next action: approvals point to agentlink_get_approval, the folder-not-allowed result gives the exact policy allow-folder step, and pairing and setup results no longer mention commands that do not exist yet (M1-36d, S1).
• agentlink init lists Cursor and Windsurf among the apps it looks for when it finds none (M1-36g-b, S1, 08).
• Your AI no longer sees a network choice when it adds proof (M1-36h): AgentLink always picks the proof network itself, and the instructions it gives your AI use plain words ("add a public proof") and tell it never to ask you to choose a network. Power users can still pick one by adding --advanced to agentlink mcp in their AI app's configuration.
• Free test credits now finish the proof in the same call (M1-36i-c, S2, D-120 (3)): after free test credits are added, your agent waits up to 20 seconds for them to arrive and tries the proof once more. It never claims twice or retries twice; if the credits are slow, it tells you to try again in a minute.
• Plainer credits wording (M1-36f, 11 §5): when there are not enough credits, the agent says what proof costs and how much is missing, in dollars, with one next step; agentlink credits no longer talks about networks or the public record.
• Terms with proof: when a firm offer or an answer with proof needs credits on a test network, AgentLink now adds free test credits once, as it does for proof on messages, and the agent simply sends the same request again a minute later; nothing is sent before then (M1-36i-d, S1).
• Automatic network choice now follows the test-credits faucet (M1-3j-b, S2, 07 §6.3, D-40): AgentLink picks only among test networks where it can top up your credits. Gnosis Chiado will be used by default once the faucet serves it, after its smoke test; until then nothing changes and Base Sepolia stays the only default network.
• Gnosis Chiado is now used automatically beside Base Sepolia (M1-3j-c, S2, 07 §6.3, D-40, D-46): the test-credits faucet serves it, so AgentLink can top up your credits there and picks it when it is funded or cheaper. The proof service serves it after its next deploy, and the CLI and tools choose it from this release. Testnet only; nothing holds real value.
• Spec text from the contracts pre-audit (M1-3m, S1, docs only; proposed, owner confirms at merge): the Notary stores and emits before it charges (05 §3.3), kind and app name are validated by clients (05 §3.1), the Paused event at CREATE3 initialisation (05 §6), EIP-7702-delegated agent keys (04 §5, 07 §6.2) and ERC-7739 signature size (07 §6.2).
• Message sync reports when a relay may hold more messages within one second than it returns, instead of skipping that second silently; the spec states this one-second limit of Nostr paging and what the client does about it (M1-5d, S1, 07 §4.2).
• Sync follow-ups in @4thtech-io/transport-nostr (M1-5e, S1, 07 §3.2, §4.2): a relay that serves wraps only to logged-in recipients now gets one NIP-42 login per own identity; stray relay events cannot move the saved page position; the envelopeSeen hint and markSeen('envelope', …) use the envelopeHash like core's seen rows. The first sync on a new relay after seen pruning is documented as costing work only.
• When a contact's owner revokes that agent, your agent now voids, in the same step that records the revocation, every approval still waiting for the owner and every unfinished part of an agreement with that contact; an agreement the owner already approved stays approved, but nothing more of it is sent or signed. The inbox sync reports how many deliveries, approvals and agreement parts the revocation stopped (M1-7h-b, S2, 04 §3.4.2 rule 3, 07 §3.4).
• Delivery acknowledgements are now queued for the delivery pass instead of being sent while the inbox syncs, so a sync with many new messages no longer waits on relays (M1-7h-b, 07 §3.2).
• Terms with proof: when an offer or an answer with proof needs credits, the result now gives the add-credits link as its own field, as messages with proof already do, so the AI app can show it reliably; no link appears while adding credits is not available (M1-9d-4, S1).
• Decided how own storage and the recovery kit work (M1-9i, D-115): a backup holds your agents, contacts and history under a new recovery code shown once; restoring never overwrites an existing setup; storage keys are reconnected after a restore.
• Spec for own storage and the recovery kit (M1-9i-s, S2, D-115; 04 §2.2, §2.3.3, §2.5, §2.5.1, §2.8; 06 §8; 07 §3, §3.4, §5.2, §5.6, §9.1, §9.4): new owner operations storage.set, storage.remove and backup.export; the CLI recovery kit format ALKK v1, sealed under a fresh recovery code for every export; restore never overwrites and keeps an existing owner only after its own owner code opens it; storage access keys stay out of the kit and are reconnected after a restore; new agentlink storage disconnect command. Spec text only; the build follows in M1-9i-a, M1-9i-b, M1-9i-c and M1-9i.
• Owner code at the wrong prompt (M1-9zd, S1, 04 §2.5, 11 §5.5): every owner command now says, right before the owner code prompt, that the code goes only there, not into a shell command or a chat, and a wrong code gets the same reminder. A command line with something shaped like an owner code in it stops before anything runs, never repeats it, and points to agentlink owner change-code. Troubleshooting explains what to do when the code was typed at the shell prompt or into a chat.
• Fewer false "some messages may be missing" notes (M2-19, S1, 07 §4.2): when one message network server returns only part of a busy second, and another server of your agent's list returned that second in full, your agent now asks the first server once for exactly those messages. If it holds them, the note is dropped. The check is strictly bounded (one short question per busy second, at most 64 messages and 16 questions per check) and logs only a count. A second that no other server covers is still reported.
• The interface package @4thtech-io/occ-v2-abi now carries contracts release v0.1.0-testnet.4 (M3-4b-t-0, S2, D-83, D-89): the Base Sepolia vault accepts the gasless top-up (depositWithAuthorization), Gnosis Chiado does not. The function is relay-only: it is in the new submitter ABI occFeeVaultRelayAbi and never in the client ABI. @4thtech-io/chain pins the release, and a kill switch (GASLESS_TOPUP_ENABLED = false) keeps the gasless top-up off everywhere until the owner-approved top-up flow ships (M3-4b-t-4). No change for users yet.
• Gasless top-up authorizations now last at most 15 minutes, the same limit the relay enforces, and stale comments are cleaned up (M3-4b-t-T2-b, S2, 04 §4).
• A moved PR head that is only a mechanical merge of main (empty remerge-diff, identical own diff, green CI) now needs only a lightweight check, recorded IR-<ID>-<n>: PASS (mechanical); any hand conflict resolution still needs a full independent review (PROC-MECH-MERGE-IR, D-126).
• Process (PROC-ORCH-PLAYBOOK, S1, owner instruction 2026-10-23): new orchestrator playbook (docs/process/orchestrator-playbook.md). The orchestrator never implements and keeps 8–15 workers busy; routing now names four models (Haiku 5.5, Sonnet 5.5, Opus 5.5, Fable 5.1 for security audits); merge-queue, review-recording and builder rules are written down, with tools/orchestrator/record-ir.py and tools/orchestrator/watch-queue.sh.
• MCP: a test now renders every approval and retry hint at its longest case (32-character agent name, port 65535, longest IDs) and fails if one passes 500 code points, so a copy edit cannot turn a pending approval into an error. Over-long link text already falls back to the shorter terminal-only text (M1-36d-c, S1).
• A slow or hanging relay information document no longer delays sending to a relay that works (M1-5b-c): the wait is limited to 3 seconds and 64 KiB, and the relay is then used with default limits. Messages stuck because fewer than 2 relays can take them now say why, relay health names relays without their address path, and retries are spread out so queued messages do not all retry at once.
• Files: when a file's link expires, the sender deletes the stored copy (own storage or the encrypted drop) and both agents delete their copy of the file key, under files.deleteAfter: expiry and also under receipt when no delivery receipt arrived. Nothing is deleted before the link expires (M1-7f-2, S2, 04 §4, D-98).
• Files: a received file's key is now kept in its own sealed local record instead of the stored message, so it can be deleted on its own; after retention the file can no longer be opened from this agent (M1-7f-2, S2).
• Files: a delete on receipt now also deletes the sender's file key (M1-7f-2, S2).
• Store: the local database now overwrites deleted data with zeros (SQLite secure_delete), and a received file's key is kept at most 7 days after arrival (M1-7f-2, S2).

Fixed

• CI no longer stalls on a slow package mirror or loses the e2e keyring mid-run (CHORE-CI-HARDEN-1): Playwright browsers are cached by version, their install is time-bounded with one retry, and the e2e keyring is supervised and restarted at once, with a clear "runner keychain unavailable" message if it still fails.
• CI no longer waits on apt for the Playwright browsers when the runner already has their libraries (CHORE-CI-PLAYWRIGHT-2): browser downloads come from the version-keyed cache (or the Playwright CDN), and system packages are installed only if a library check finds one missing, with a time limit and one retry.
• CI's "Install Playwright browsers" step no longer runs into its 12-minute limit when the Ubuntu mirror is slow (CHORE-CI-PLAYWRIGHT-3): WebKit's system packages now come from a cache (each file checked against apt's signed index before apt uses it), every network sub-step shares one time budget inside the limit, and only a push to main saves the caches.
• Production can no longer stay behind main because a commit's CI flaked and the following merges did not touch the submitter or drop (CHORE-DEPLOY-RECONCILE): an hourly reconcile compares what production runs with main's newest commit and, when a deploy-relevant change is missing and that commit's CI is green, starts the normal deploy for it. It does nothing while DEPLOY_FREEZE is set, and the started deploy passes every gate as before (green CI, the staging smoke test, the production approval, the head-of-main check).
• Verify: a proof pack whose record the chain does not hold now fails with "record not found" instead of "chain unavailable"; it still never verifies (CHORE-SUBMITTER-WRANGLER-DEV follow-ups, IR #338 L3, S2, 07 §8).
• Submitter: only the exact "record not found" answer from the chain counts as a new record; anything else stays a chain error (IR #338 L1, S2).
• Submitter: local wrangler dev starts again; the deployed Worker behaves the same (CHORE-SUBMITTER-WRANGLER-DEV, S2).
• Deploys and releases no longer fail when a newer merge supersedes a commit's CI before it runs (CHORE-CI-SUPERSEDED): the run ends as skipped with a notice, and the submitter and drop deploys start a catch-up run for the newest commit on main, which still needs its own green CI, the staging smoke test and every production gate.
• A flaky check no longer fails at random (CHORE-DEFLAKE-1, test-only): the submitter rate-limit tests no longer break when a run crosses the top of the hour.
• A submitter or drop deploy run that skips production because a newer commit landed on main no longer ends silently green (CHORE-DEPLOY-CATCHUP): it warns and its run summary names the newer commit and the run that deploys it. The catch-up run also starts after a commit's CI fails (for example a flaky test) and no longer counts a failed run as covering main's newest commit, so production follows the newest green commit instead of stalling. Every production gate (the commit's own green CI, the staging smoke test, the production approval, DEPLOY_FREEZE) is unchanged.
• The activity log no longer hides too much text after an apostrophe, and now hides upload links completely (M0-8c).
• Testnet faucet (M1-10b-d, S2, 05 §9): two free-credit claims made within a few seconds of each other no longer get "try again later"; the faucet waits briefly for its previous top-up to be confirmed. A top-up that is really stuck still gets "try again later", and nothing is sent.
• The scheduled faucet and gas pool alert now treats a chain whose faucet is off (faucet: null in the submitter health answer) as a finding, faucet off, instead of a quiet pool: ok, so missing or invalid faucet settings on the testnet submitter can no longer hide (M1-10b-e-b, S2, D-120 (3)). The fake e2e faucet now gives the same 50 cents as the real one.
• The scheduled pool alert now explains each state it can report (ok, low, paused, off, unknown) and prints a matching hint instead of always saying to top up the wallet (M1-10b-e-c, S1, 07 §5).
• Drop deploys: only a DNS, connection, timeout or TLS handshake failure (curl exit 6, 7, 28 or 35) gets the 15-minute first-deploy wait, as the deployment doc now says; any other error fails after 10 attempts. A rollback is reported as impossible only for Cloudflare's binding-change refusal, so other refusals show as a failed rollback (M1-27b-d, S2, release-and-deployment.md §4.5).
• Asking for a delivery confirmation on a message that already had proof now says that no request was added, so your agent never tells you it asked when it didn't; two confirmations at the same moment record only one; the guide says the recipient confirms only if they choose to (M1-33d-b, S2, 06 §2.4, 11 §5.6).
• A receipt no longer fails for good when the network node the recipient's agent reads from is a few seconds behind (M1-34-c, S2, 07 §7): if the proof is not visible yet, the agent waits 3 seconds and tries the same receipt once more before giving up. Nothing is signed again and nobody is charged.
• Commands AgentLink tells you to run now work on a fresh install (M1-36a-b, S2, 06 §2.5, 11 §5): init, doctor, the owner commands, the not-set-up message, the approval page and the owner setup steps name npx -y @4thtech-io/agentlink … unless AgentLink is installed on your computer, and the approval page no longer points to the missing agentlink ui. On a computer with no owner yet, your AI now tells you to run owner init (not owner add-agent).
• Commands shown to the user work after the documented npx install, and the first-status text names the right owner step in plain words (M1-36a, S1, 06 §2.5): the approve command and the contact commands start with npx -y @4thtech-io/agentlink unless AgentLink is installed globally, and a new machine is told to run owner init instead of the jargon "card" and owner add-agent. The approval link text is shortened slightly so the longer command fits the 500-character limit (proposed, owner confirms at merge: 06 §2.5 wording).
• An agent with a long name now still gets the approval link when it accepts an invite, and the file tools' folder hint shows the exact command with the optional agent name (M1-36d-b, S1, 06 §2.5).
• Plain words everywhere, and commands that work (M1-36e, S2, 11 §5): the remaining "run this" lines in the terminal, the error messages and the hints your AI reads name npx -y @4thtech-io/agentlink … unless AgentLink is installed on your computer; doctor and status speak of the message network, not relays; the user guide drops "wallet", "relay", "policy" and similar words. A vocabulary check over terminal text, tool hints, the approval page and the guide now fails on any banned word, with each exception listed with its reason.
• agentlink init: for Windsurf with $XDG_CONFIG_HOME (macOS, Linux) or %APPDATA% (Windows) set, the confirmation code now binds the file that is shown and written, and that path is resolved once; a code shown with one environment no longer confirms a write under another (M1-36g-c, S1, 06 §7).
• The automatic free test credits claim is bounded and calmer: it reads only a short part of a limit answer, honours the service's wait time (at least 5 minutes), and stops retrying every day when the service refuses the request for good (M1-36i-b, S1, 07 §5, D-120).
• A proof that first waits for free test credits no longer risks your AI app timing out (M1-36i-e): that wait now counts against the short wait for your approval, so the whole call stays within the time your AI app allows. If the time is used up, your agent shares the approval link right away.
• Proof checks read "no such record" only from the proof contract's exact not-found answer; anything else stays "could not be reached" (M1-4d-g, S2, 07 §8).
• Proof checks report a record with no signer as unreadable instead of missing (M1-4c-e, S1, 07 §8).
• Proof requests read "no such record" only from the proof contract's exact not-found answer, so a faulty network answer can't trigger a replacement proof (M1-4d-h, S2, 07 §6.2).
• Storage no longer leaves a half-finished upload behind when the storage service's answer is lost, reports a failing file stream as a plain storage error, and applies the 30-day cleanup rule only after checking that the bucket's other rules were not changed in between (M1-6b-b, S1, 07 §5.2). Reading the rule back on Cloudflare R2 still waits for the owner step M1-28.
• An approved accept or confirm now reports what happened to its receipt in that call: recorded once it is on-chain, submitted once signed but not landed, waiting_for_record only while the record has not arrived (M1-7g-f, S2, 06 §2.2a). Before, it said waiting_for_record even after signing.
• A proof envelope waiting for its message whose envelope was refused releases its place in the waiting pool at once instead of holding it for 7 days; 04 §3.4 now names the per-contact share of both proof pools (M1-7g-f, S2, 04 §3.4; proposed, owner confirms at merge).
• A status check no longer counts a contact's message as unread once it is known to be an acknowledgement or another non-message type, and a key store that cannot list the agent's own keys now fails only the fetch, not the whole inbox sync (M1-7h-b, 06 §2.0).
• agentlink credits --topup no longer prints an empty "( each)" when no price is known; agentlink verify shows a plain sentence for a content problem it has no wording for; agentlink verify and the MCP proof check now share one verifier, so they always agree (M1-9h-b, S1, 06 §8).
• Submitter: the Worker reached no RPC endpoint, so /v1/health reported Base Sepolia unavailable with no gas balance. Its RPC requests used a redirect mode the Workers runtime refuses; they now use one it accepts and still never follow a redirect (M1-10c, S2).
• Submitter: notarizing a new record answered 503 unavailable, because the Notary reports an unknown record with an error the submitter took for a chain failure. The submitter now treats that answer as "not recorded yet" and simulates the record as usual (M1-10c, S2).
• Storage: after setting the bucket's expiry rule, the check now compares the whole of each rule instead of only its name, so a change made at the same moment by another tool is reported instead of going unnoticed (M1-6b-c, S1, 07 §5.2).

Security

• Submitter: a held item stops retrying 24 hours after intake (M1-10a-c, S2, 07 §7), or at its own deadline if sooner, and is then reported failed with unavailable, so a far-off deadline cannot keep it in the queue for good.
• Testnet faucet hardening (M1-10b-b, S2, 05 §9): a claim is charged before anything is sent, so a storage failure cannot credit an agent twice; a retry after a lost answer returns the earlier transaction; the credit's gas limit comes from a simulation; staging and production must use different faucet wallets.
• Testnet faucet robustness (M1-10b-c, S2, 05 §9): a faucet top-up stuck waiting to be confirmed no longer blocks every later claim; such claims get the usual "try again later" answer and nothing is sent. Every faucet gas limit is capped, so a bad simulation result cannot spend the faucet's testnet funds. The submitter runbook explains what rolling the faucet back to an older version does to its claim records.
• Owner setup on the first-run page checks that the held owner key is the one the page showed before it saves anything, and a new test checks that neither the owner key nor the passkey output appears in any log, event, response or error (M1-11s-c-b). Security spec 04 §2.2 now names the two cases where setup keeps what it wrote: an unconfirmed card and a keychain that refuses the clean-up (proposed, owner confirms at merge).
• The boundary guards (deps-check and the ESLint config) now scan e2e/: primitive libraries, the keystore entry, Node crypto and crypto.subtle are refused there, and the test seam stays allowed (M1-1g-c, S1, 04 §3.1.1).
• Owner decisions, policies and revocations, messages, agent cards and proof packs are now verified from the exact text received: a field name that appears twice or is spelled with an escape sequence is refused as malformed before the signature check, so no two parsers can read one signed text differently (M1-1h-b, S2, 04 §2.5.1, D-128).
• A proof only links to the agent's own earlier proof, never to the other side's, so a proof never publicly ties two agents together without a receipt; a received proof that links to someone else's is dropped and gets no receipt (flagging the contact follows in M1-7g-c) (M1-33c, S2, D-109, 04 §5.1).
• Submitter: a chain read of a record counts as "not recorded" only when the Notary says the record does not exist. Any other answer that is not a stored record, such as a zeroed record, now makes the submitter answer unavailable rather than decide on it (M1-4c-c, S2).
• A proof is never resubmitted or replaced on a chain answer that does not add up (M1-4c-d, S2, 04 §5): only the contract's own "record not found" means a record is missing, so a misbehaving chain endpoint cannot cause a duplicate record or a second fee.
• When another agent sends a proof that does not match what is on-chain, including one that links to someone else's proof, that contact is now flagged and the proof is refused, and one contact can no longer fill the queue of proofs waiting for a network check (M1-7g-c, S2, 04 §3.4).
• When you confirm that the other side accepted your terms, your agent now signs the matching receipt on their proof, once, under the one approval you gave (M1-7g-d, S2, 04 §3.4.2).
• One contact can no longer fill the queue of proofs that arrive before their message: each contact gets at most 32 of the 256 places (M1-7g-d, S2, 04 §3.4).
• Logs keep only the fixed codes a component lists; any other value in a code field stays hidden (M1-7g-d, S2, I-7).
• Spec 04 §2.8 now states the same-user residuals of the headless key file and its unlock (proposed, owner confirms at merge): restoring an older copy can roll items back, a hard link keeps old ciphertext, unlock has no retry limit and no setup guards by design (M1-8f, AUDIT-FABLE-M1-8f-1, S2).
• Accepting an invite refuses, with nothing saved, when the contact it would add is not the one the invite names (M1-9ze, S2, 04 §3.6).
• Accepting an invite refuses, with nothing saved, when the contact it would add has the right id but a different owner or a different card from the one the invite carried (M1-9zf, S2, 04 §3.6).
• The gasless top-up relay is harder to misuse before it is switched on (M3-4b-t-T3-b, S2, 07 §7; the 07 §7 note is proposed, owner confirms at merge): it sends nothing while one of its own transactions is stuck, caps top-up requests per hour across everyone, never counts a failed send against an agent's hourly limit, records each top-up before sending it so a crash cannot send it twice, and answers every refusal in the same {status: "failed", error} form.
• The proof relay, the testnet credits faucet and the encrypted drop keep no logs (OPS-PRIV-1, S2, 07 §7, D-109): every deploy now also fails if streaming log consumers or log and trace export are switched on, a test checks that the relay never logs or counts an IP, address, record ID, salt, signature or transaction hash, and the owner's runbook lists the account-level logging settings to check.