v0.9.0 — Workspace, fresh-install provisioning, and the multi-source skills library

v0.9.0

Released: 2026-08-17
Tag: v0.9.0  ·  Diff: v0.8.5...v0.9.0

499 commits · 1,367 files (+220k/−38k) · 155 public + 62 private-tracker issues (+21 enterprise PRs closed at merge; see the commit-reconciled addendum) · enterprise submodule e898cef → 65182c1.

Freeze plan and coherence review: v0.9.0-freeze-plan.md.

Highlights

• Workspace — the client surface, now in every build. The client portal moved
  from an entitled module into OSS core (trinity-enterprise#356) and became
  Workspace: one click from the platform (ent#357), the Session tab absorbed
  into it (ent#358), an agent page per agent (ent#360), sidebar IA with agents,
  starred and dated chats (ent#359), chats with one or more agents and @mention
  to bring an agent in mid-chat (ent#361/#362, rooms-engine, entitlement-gated),
  a / playbooks + @ agents composer typeahead (ent#392), skill hints in chat
  (ent#380), streaming turns (ent#286), sliding session renewal (ent#375),
  client sign-out and re-entry blocking (ent#281), per-client rate limits
  (ent#287), delegated identity via token exchange (ent#163), the Sessions page
  retired (ent#381) — plus a sweep of roster, load-time, layout, readability,
  voice-mode, timeout and sign-out fixes (#2196/#2198/#2211–#2214/#2258).
• Fresh-install provisioning (trinity-enterprise#122 slice): the agent
  catalog now resolves through a remote template registry (ent#14), a
  GitHub-repo import wizard with fork / copy / clone-own intents (ent#15),
  install a system from a manifest in the UI (ent#126), guided per-agent
  credential setup (ent#127) on the new Trinity-installable agent standard
  (ent#128), bind an agent to a repo you own from Agent Detail (ent#109), and
  template.yaml schedules materialized at creation (ent#89).
• Skills platform, phase 2 (trinity-enterprise#182): the Skills tab rebuilt
  (ent#235), library lifecycle automation — scheduled auto-sync, fleet re-inject,
  removal-on-unassign (ent#236), a multi-source library with a bundled
  community repo + per-instance custom repos (ent#237), vendor-neutral layout
  (ent#332), the Templates page renamed Library (ent#263) with a tabbed
  Skills section that shows which agents hold each skill (ent#384).
• A2A, bidirectional: an inbound A2A server — public Agent Card + JSON-RPC/SSE
  task endpoint, per-agent opt-in (ent#157) — with a config UI (ent#158) and MCP
  control tools (ent#160), plus outbound call_a2a_agent to operator-
  registered external endpoints (#736).
• Dashboard: the Agents page folded into a List view (ent#260),
  type-to-filter across all views (ent#261), a grid widget chassis with the
  first data tiles — Executions by trigger, Recent failures (ent#325/#96/#100
  over the new GET /api/executions/timeline, ent#326), an org overlay of
  departments and reporting lines (ent#305), the scanline data-loading motion
  language (ent#245), the seven Base* design-system primitives (#2122) and a
  dark ink-ladder sweep (#1922).
• Agent Reports, complete (Epic #1534): prompt guidance (#1535), Excel/PDF
  export (#1536), large-payload paging (#1537), MCP read-back (#1538), search &
  filter (#1539).
• Reliability at scale: automatic database backups for SQLite and
  PostgreSQL (#2216), bounded container logs (#1871 — the disk-full/dockerd
  wedge class), rebuilt base images now actually adopted on cold start, fleet
  restart and by trinity-system (#1809/#1860/#1816), the terminal-activity
  close contract (#1804), a first-run seeding race fixed (#2215), orphan
  containers reclaimed on failed creation (ent#313), log archival un-wedged
  (#2205), one shared single-flight lock primitive (#1920), and a canary harness
  that runs on prod compose, elects one leader, names its instance, retries lost
  Slack alerts, reports its own run-state, and stops paging on four false-positive
  classes (#1878/#1881/#1987/#1897/#2217/#1813/#1880/#1990, ent#335/#337/#372).
• Security: require_admin/assert_admin reject agent-scoped principals
  (ent#297 — root cause of four prior escalations, incl. ent#293/#346), hardened
  YAML everywhere author-controlled input is parsed (ent#314, #1884, #1965), a
  path-traversal fix in template resolution (#1900), per-spawn execution
  environments so a removed credential stops reaching executions (#1999/#2114),
  PAT-scrubber under-match fixes (ent#292/#347, #2052), SSRF fixes on Slack and
  WhatsApp media downloads and the CGNAT range (#1951, #1932, ent#393/#394),
  durable audit hash-chain (#2015/#1984), portal sign-in brute-force and
  enumeration protection (ent#309/#311, #308), first-class agent MCP keys with
  verification and rotation (#1854), and the A2A outbound edge sweep
  (#2174/#2175, ent#395–#399).
• Channels & agent runtime: Telegram in-progress indicator (ent#264) and
  long-task report-back (ent#265), ZIP uploads in chat (ent#391), ask_trinity
  docs Q&A over MCP (ent#328), .mcp.json.template finally rendered for
  github: agents (#2007), a committed self-healing plugin manifest (#1704),
  Codex runtime model/auth fixes (#1971/#2207), and behavioral-evaluation
  foundations — the referee surface (ent#267) and a cross-model referee (ent#277).
• Abilities marketplace: structure for agentic systems. This release cycle
  pairs the platform with a marketplace cycle that introduces a new level of
  organization into agentic systems — the structural primitives fleets need to
  collaborate: a shared canon (a canonical-data layer with
  publish/consume/reconcile, deterministic linting, and per-counterpart
  relations — add-canon 1.0→1.6), system-aware orchestration with
  install-time divergence detection, a bundle-wide --autonomous run mode and
  event choreography, playbooks as the unit of inter-agent work
  (playbook-call), and repository-first creation & in-place onboarding —
  the marketplace half of the platform's pre-installed Trinity plugin
  (ent#411/#1704), a tighter integration of the plugin marketplace and the
  platform. Full list in the Abilities Marketplace
  section below.

Features

• #736 call_a2a_agent MCP tool — outbound A2A protocol calls to registered external agents
• #925 client-side cron validation + warning icon for invalid schedules
• #1534 Epic: Agent Reports — richer creation, export, scale, read-back & search
• #1535 report-tool guidance injected into the agent platform prompt
• #1536 download & render reports as Excel / PDF
• #1537 reports at scale — 5 MiB payload cap + row-windowed table reads
• #1538 agents read back their own reports over MCP
• #1539 search & filter reports (fleet + per-agent)
• #1813 canary H-01: fail loud when a SQL-tier collector reads zero rows on a provably non-empty fleet
• #1854 first-class agent-scoped MCP keys — visibility, verification, regeneration, self-heal
• #1987 canary Slack alerts name the instance that fired them

Private tracker (trinity-enterprise):

• ent#14 remote template registry — the agent catalog served from an external, self-updating repo
• ent#15 GitHub-repo import wizard — fork / archive-copy / clone-own with inline compatibility check
• ent#89 materialize template.yaml schedules at agent creation (disabled by default)
• ent#96 grid tile: Executions — hourly chart by trigger type (24h)
• ent#100 grid tile: Recent failures — latest failed executions fleet-wide
• ent#109 bind an agent to a GitHub repo you own — post-creation ownership retrofit from Agent Detail
• ent#126 install a system from a manifest via the UI — paste/upload/pick → dry-run → deploy
• ent#127 guided per-agent credential setup — required-credentials checklist with status and how-to-get
• ent#128 "Trinity-installable agent" standard — per-variable credential setup metadata in template.yaml + contract doc
• ent#157 A2A inbound server — public Agent Card + JSON-RPC/SSE task endpoint
• ent#158 A2A config UI — per-agent exposure, card URL, skill curation, inbound allow-list & outbound endpoint registry
• ent#160 A2A control over MCP — exposure, card, allow-list & outbound endpoints as MCP tools
• ent#163 Workspace: delegated identity — a trusted backend acts as an end user via token exchange
• ent#199 benchmark selection decision — Terminal-Bench 2.1 + TRB + borrowed-host scorer
• ent#235 Skills management surface — the Skills tab rebuilt (library browse, assignment, injection status)
• ent#236 skills library lifecycle automation — scheduled auto-sync, fleet-wide re-inject, removal-on-unassign
• ent#237 multi-source skills library — bundled public community repo + per-instance custom repos
• ent#245 scanline loading animation — the app's default data-loading motion language
• ent#260 dashboard List view replaces the standalone Agents page (timeline · grid · list)
• ent#261 hotkey type-to-filter across dashboard views
• ent#263 Templates page renamed Library — one surface for agent templates + the skills library
• ent#264 Telegram: in-progress status indicator while a task runs
• ent#265 Telegram: long-running task reports back to the originating chat on completion
• ent#267 behavioral-eval referee surface + Completion relabel (foundation)
• ent#277 cross-model validation — an independent second-model referee
• ent#281 Workspace: log out a signed-in client (revoke sessions) + block re-entry
• ent#286 Workspace: portal-session streaming path
• ent#287 Workspace: per-client rate limits on portal chat and upload
• ent#305 grid view org overlay — department zones + reporting lines
• ent#325 grid widget chassis — InfoTile, GRID_WIDGETS registry, layout v2, Tiles menu
• ent#326 GET /api/executions/timeline — bucketed execution rollups for the grid data tiles
• ent#328 ask_trinity docs Q&A tool in the Trinity MCP server
• ent#332 vendor-neutral skills-library layout — per-source skills root
• ent#348 compliance audit API — auditor-facing pull export of the audit log
• ent#356 Workspace: client portal moved from entitled module to OSS core
• ent#357 Workspace: rename Client Portal and open it in one click from the platform
• ent#358 Workspace: absorb the Session tab
• ent#359 Workspace: sidebar IA — agents block on top, starred chats, dated chats
• ent#360 Workspace: agent page — clicking an agent opens its page
• ent#361 Workspace: create a chat with one or more agents; @mention adds an agent mid-chat
• ent#362 Workspace: admit a workspace user as a room participant
• ent#375 Workspace: sessions survive — sliding renewal instead of a hard 12-hour expiry
• ent#380 Workspace: skill hints in chat
• ent#381 Workspace: retire the Sessions page + nav entry
• ent#384 assign skills to agents from the Library — per-skill agent list, tabbed Library with a Skills tab
• ent#391 ZIP file uploads in chat (Slack/Telegram/WhatsApp + web)
• ent#392 Workspace composer typeahead — / for the agent's playbooks, @ for reachable agents

Fixes

• #1634 toggling a schedule scrolled the Schedules tab back to the top
• #1656 Cornelius seed vault MOCs linked to notes that don't ship
• #1677 platform operator-queue alert emitters bypassed the #1632 ingestion caps
• #1704 agent plugin install-state lost on container recreate → committed .trinity/plugins.yaml + boot self-heal
• #1741 schedule_executions.tool_calls stored a verbatim copy of execution_log
• #1775 integration suite ran only 6 of 83 tests when collected as a directory
• #1782 frontend-e2e changes path-filter hard-failed on PRs >300 files
• #1788 docs advertised two install paths that fail on a fresh machine
• #1791 README install + first-time-setup instructions were stale
• #1796 schedules on a non-autonomous agent were silently skipped with a live countdown
• #1804 recovery paths wrote execution terminals without closing the paired activity (agent "running" for up to 2h)
• #1806 self-reminders on a non-autonomous agent were silently held
• #1808 freeze_schedules_if_sync_failing was never enforced
• #1809 a rebuilt agent base image was never picked up — no image-drift predicate
• #1810 /api/version reported "unknown" without start.sh
• #1811 recreate_missing_container rebuilt a divergent container (dropped mounts, minted a new MCP key)
• #1814 start.sh never rebuilt platform images on an in-place upgrade (version now reports the code in service)
• #1816 trinity-system never adopted a rebuilt base image
• #1821 PUT /agents/{name}/label silently cleared the label on an unknown body field
• #1823 legacy IANA timezone aliases (Europe/Kiev …) crashed schedule creation with a 500
• #1831 mid-string Z in agent-supplied fire_at passed validation then 500'd
• #1832 negative duration_ms from clock skew reached the Overview chart unguarded
• #1833 retention_guard.evaluate could raise on a non-numeric count
• #1834 a failed retention-guard alarm permanently suppressed its own retry
• #1840 Sonnet 5 / Fable 5 recorded a 200K context window on most runs
• #1841 system-deploy dry run passed a manifest with an unresolvable template
• #1842 skill-package prune left empty directories behind
• #1848 MCP key row metadata misaligned for never-used keys
• #1849 errors[0] picked Claude Code's [ede_diagnostic] header, defeating resume-not-found self-healing
• #1853 error_during_execution runs stored zero telemetry
• #1860 fleet restart bypassed start_agent_internal — no agent adopted a rebuilt base image on "Restart All"
• #1862 default Settings panel too narrow
• #1870 completed turn discarded on error_during_execution — jsonl_recovery never consulted
• #1871 container logs unbounded — no json-file max-size anywhere; filled the disk and wedged dockerd
• #1878 canary harness could not be enabled on any deployed instance (CANARY_ENABLED absent from prod compose)
• #1880 five Phase-4 canary invariants alerted with no name, runbook, or detail
• #1881 canary had no cross-worker leader lease (double cycles under --workers 2)
• #1888 white overscroll band behind the app
• #1891 CI validated on Python 3.11 while every shipped image runs 3.13
• #1895 108 test files sat in tests/ root where no CI job ran them
• #1896 the live-instance integration suite had no CI home
• #1897 a failed canary Slack post was counted as delivered and never retried
• #1898 test_ent183_skill_packages sys.modules stubs poisoned later tests
• #1909 test_a13_exact_cutoff_row_is_not_expired was wall-clock flaky
• #1914 navigating to a non-existent agent rendered a blank page
• #1919 fleet-restart lock: lease refresh not ownership-checked
• #1920 seven hand-rolled Redis single-flight locks → one shared SingleFlightLock
• #1926 fetch failures rendered as empty states or vanished silently
• #1931 the agent catalog still shipped 11 dd-* VC-demo templates and a Dec-2025 GitHub repo list
• #1932 WhatsApp inbound media download always failed — SSRF allowlist rejected Twilio's own CDN
• #1941 nightly unit-suite reported a false merge conflict on every PR
• #1945 set_autonomy_status erased per-schedule enabled intent
• #1953 Agent Detail toast overlapped the header controls
• #1967 global GitHub PAT rotation never reached agents without .env
• #1968 manual schedule trigger always returned execution_id: undefined
• #1969 cron tick suppressed by the distributed lock left no execution record
• #1971 codex_runtime.py unconditionally set CODEX_API_KEY, discarding a valid subscription auth
• #1990 canary E-01 had no lease-awareness — fired on legitimately-running pull turns
• #1994 _execute_process_schedule lock-denial branch unaudited (sibling of #1969)
• #2006 deploy-local persisted an archive whose .mcp.json failed validation
• #2007 github: templates never rendered .mcp.json.template — declared MCP servers silently absent
• #2008 POST /api/credentials/update had no callers but was named as the sanctioned MCP-config path
• #2016 a duplicated GITHUB_PAT line survived rotation and won
• #2017 a backslash in the token raised re.error mid-rotation
• #2019 a single hanging test burned the 25-minute unit-suite budget (no --timeout)
• #2023 .env quote-escaping was write-only — a credential with a double quote round-tripped corrupted
• #2027 ask_trinity truncation could split a surrogate pair; session-less response lost caller context
• #2035 #848 inline email auth — a verified session was discarded on the next request
• #2036 base image baked container-only hook paths into ~/.claude/settings.json; external clones bricked
• #2048 pull pilot can only route agent-to-agent work — claim corrected, cron/schedule stays on push
• #2050 mcp-server's unbounded fast-uri override let a major bump past ajv's declared range
• #2052 free-text PAT scrubbers only fired on a literal https://
• #2068 enterprise submodule pin advance landed two Alembic heads — entitled instances degraded to OSS-only
• #2069 the fleet-wide .gitignore merge never ran at agent creation
• #2070 first backend Push untracked template-committed .trinity/pre-check and pushed the deletion
• #2092 recreate_container_with_updated_config unconditionally started the container
• #2101 Workspace new-chat briefing rendered capability hints as an unbounded card grid
• #2114 .env-resident ANTHROPIC_API_KEY shadowed subscription auth in the per-spawn execution env
• #2127 turn ending with background subagents in flight recorded SUCCESS and discarded the work
• #2128 Workspace multi-agent chat picker offered on builds with no rooms backend
• #2130 Agent Detail ?tab= deep-link applied ~10s late and overrode the user's click
• #2131 #1804 terminal-activity parity guard didn't scan client_portal/
• #2133 Workspace awaitPersistedReply could poll for an hour on an orphaned in-flight marker
• #2140 test_inject_assigned_credentials leaked a stubbed module into sys.modules
• #2153 ?tab= deep-links to a2a/loops/playbooks/access/nevermined silently landed on Overview
• #2157 agents told Workspace clients the surface is text-only — portal TTS never advertised
• #2159 Workspace sidebar roster — no loading state, unbounded list, slug-as-title
• #2160 Workspace agent page initial load slow — build_page profiled and parallelized
• #2161 Workspace agent page UX — Overview chart reuse, asks get their own tab
• #2162 Workspace Reports tab showed raw JSON to clients — display_hint renderers reused
• #2169 Workspace Overview layout — activity + recent work share a row, asks move below
• #2193 agent-header 7d cost sparkline permanently flat on PostgreSQL
• #2196 Workspace roster listed agents with no container — now a per-card availability state
• #2198 Agent Detail and Workspace over-fetched on load (21 redundant requests, N+1 roster)
• #2199 seven frontend e2e specs failed on stale constants and a missing fixture agent
• #2200 / filter hotkey silently dropped for ~50ms after the dashboard painted
• #2204 Deploy to Dev had failed on every run since 2026-08-10
• #2205 log archival was dead — /data/archives root-owned while the backend runs as UID 1000
• #2207 Codex runtime pinned a retired model and mis-estimated cost for every current GPT-5.x model
• #2211 Workspace chat readability — line spacing, message column, composer scrollbar
• #2212 Workspace voice mode started the mic and stopped instantly, every failure silent
• #2213 Workspace composer / typeahead listed only part of an agent's skills
• #2214 Workspace chat turns were hard-capped at 300s, ignoring the agent's execution timeout
• #2215 fresh-install seeding raced itself across workers — two seeders allocated the same SSH port
• #2216 shipped database backup tooling was never invoked — now scheduled, both backends
• #2217 canary harness left disabled on a retired constraint, and nothing reported whether it ran
• #2228 Executions grid tile clipped its legend mid-row
• #2241 MagicMock blocked assert_* attributes — 14 api-tier tests broke at import
• #2242 stale test mocks drifted from #1804, #2015 and ent#237
• #2243 calendar-expiring tests and stale strict-xfails kept 17 tests permanently red
• #2245 _git_toplevel missed a home-rooted repo when workspace/ is a separate mount
• #2247 test_ent96_timeline_split red on dev since 2026-08-15 — stale date fixture

Private tracker (trinity-enterprise):

• ent#218 rooms: message-budget termination discarded the final agent reply (billed, lost) and 410'd a landed human message
• ent#219 skill-runner: ACL grants survived agent delete/rename
• ent#241 backend/__init__.py registered skill_runner twice and bypassed the isolation wrapper for 3 modules
• ent#313 failed agent creation leaked an orphan container that also blocked its own volume reclaim
• ent#335 canary E-06 fired every cycle on schedules of soft-deleted agents (94% of all violations)
• ent#337 canary R-01 paged critical on a single transient zombie
• ent#372 canary S-03 reconstructed a slot's initial TTL from two readings taken seconds apart
• ent#397 A2A refusal reason derived by substring-matching its own human message
• ent#398 an A2A endpoint on port :0 validated but was permanently refused
• ent#399 _same_origin compared IPv6 literals textually

Security

• #1884 harden parse_manifest against YAML anchor/alias expansion and duplicate keys
• #1900 path traversal in template resolution: local:<id> read escape + cross-tenant .mcp.json staging
• #1908 sage/scout/scribe templates shipped no .gitignore — every agent born with 4 hard findings
• #1917 exception messages flowed into ops/system-agent API responses (stack-trace exposure)
• #1951 Slack download_file had no SSRF allowlist and blind-followed redirects
• #1965 agent server still parsed author-controlled YAML with bare safe_load — vendored safe_yaml
• #1966 POST /api/settings/ops/reset wrote no audit entry
• #1970 scheduler create_execution never populated execution origin columns
• #1984 audit-log verify returned valid:true with checked:0
• #1999 credential injects mirrored .env into the long-lived agent-server env — removed keys kept reaching executions
• #2015 audit hash chain did not survive a backend restart — now persisted, chain head read in-transaction
• #2075 _detect_git_dir picked the wrong repo root for agents with a populated workspace/ directory
• #2094 schedule enable/disable/trigger always 422 (regression from #2081 CSO M1)
• #2174 deleting one A2A endpoint could remove two, destroying a stored credential
• #2175 four low-severity A2A outbound edge defects (origin pin, port 0, reason codes, blank credential)
• #2258 Workspace "Sign out" didn't sign out — the platform JWT silently re-authenticated on refresh

Private tracker (trinity-enterprise):

• ent#220 shared-sessions: turn-engine budget/idempotency edge + role enforcement + participant-cap residuals
• ent#292 orphan sweeper logged reaped process cmdlines verbatim — git PAT leaked to container logs
• ent#293 agent-scoped MCP key passed assert_admin — skills_library_url repoint enabled fleet-wide prompt injection
• ent#297 require_admin/assert_admin did not reject agent-scoped principals — admin on all 114 admin-gated routes
• ent#308 portal inbox directory collided across client identities — cross-client file read + overwrite
• ent#309 portal sign-in leaked client existence through response timing
• ent#311 portal OTP sign-in had no brute-force protection
• ent#314 harden author-controlled YAML (template.yaml) against alias-expansion amplification and duplicate keys
• ent#334 /skills/library/status disclosed source repo URLs to any authenticated principal
• ent#346 agent-scoped MCP key could inject a fleet-wide skills source via PUT /api/settings/skills_library_url
• ent#347 both PAT scrubbers under-matched a double-@ URL
• ent#393 mapped-CGNAT bypassed the SSRF destination predicate on the A2A outbound and template-registry paths
• ent#394 mcp_validator's internal-address predicate had no CGNAT clause
• ent#395 remove_endpoint deleted every A2A endpoint matching an id-or-name
• ent#396 a whitespace-only A2A credential silently cleared the stored secret

Refactors

• #1710 audit and retire the slack.py inv8 carve-out left by #1310
• #1922 dark ink-ladder sweep — raise dark-theme meta text off gray-500/600
• #2080 test harness: honest full-suite runs — collection breakage, PG/Alembic + git-sync tiers, skip-audit gate
• #2086 centralize the selectable model catalog — one source of truth for three hand-synced lists
• #2104 retire the vestigial agent type taxonomy
• #2122 the seven Base* primitives the design-system contract mandates
• #2132 delete orphaned views/enterprise/Sessions.vue
• #2137 align the agent-compatibility catalog with what the platform implements (88 checks, 12 categories)

Documentation

• #2055 TRINITY_ONBOARD_PLUGIN.md Phase 7 documented an .mcp.json writer onboard no longer has
• #2089 consolidate three drifting screenshot stores into one manifest-guarded store
• ent#83 Workspace: API-completeness matrix re-verified + gaps filed
• Design system: system of record, builder contract, reference page + raw-color scanner & ratchet baseline
• Trinity FAQ — 264 grounded Q&As across 14 topic pages; architecture explainer video; CSO full-codebase audit report (2026-07-13); open research folder

Other changes

• Retention community floor applied by seeding fresh installs, not by lowering prune-time defaults (no-issue, #1638 follow-through)
• Skill paths sanitized at one chokepoint (no-issue)
• Avatar generation: thinking-token truncation no longer drops the color-scheme block (no-issue)
• 34 dependency bumps (dependabot)

Abilities Marketplace (ecosystem)

Added post-release by the marketplace sweep. Window: v0.8.5 → v0.9.0
(2026-07-26 → 2026-08-17), plus the post-tag v0.9.0 platform-truth sync.
Marketplace items reference abilityai/abilities PRs or short commit SHAs.

The abilities plugin marketplace ships
as part of the platform ecosystem, and this cycle is the thematic companion to
v0.9.0: together they introduce a new level of organization — and a new level
of control — into agentic systems, the structural primitives agents need to
collaborate as systems rather than as individuals, with tighter integration
between the marketplace and the platform (the platform now pre-installs the
Trinity plugin in every agent image, ent#411/#1704; the marketplace answers with
in-place onboarding and platform-truth syncs). Four primitives carry the theme:
a shared canon, system-aware orchestration, playbooks as the unit of
inter-agent work, and repository-first creation & onboarding.

Canon — a shared canonical-data layer (agent-dev)

• add-canon 1.0: fleet canon repo on plain git — per-agent owned folders with publish/consume/reconcile skills; add-orchestrator goes canon-aware (5830340)
• add-canon 1.1: fleet enrollment — align mapped agents with the canon from the orchestrator; discover-agents canon coverage (32e785e)
• add-canon 1.2: access verification + the deployed-credential story; new /canon-doctor runtime skill (9bd3c47)
• add-canon 1.3: live-delivery guarantee — pull-first reconcile, fleet activation offer, undeliverable-agent visibility (bd55171)
• add-canon-lint 1.0: deterministic (no-LLM) canon KB linting on push/PR + the two-zone lintable schema (ent#274) (fb3a808)
• add-canon 1.5: the publish test — what belongs in canon; canon-publish review gate (387f80f)
• add-canon 1.6: relations — per-counterpart collaboration memory, read before acting on a counterpart's ask, appended before closing (749d924)

Playbooks — the unit of inter-agent work (agent-dev / create-agent)

• playbook-call: playbooks become the unit of inter-agent work — agent-dev 1.14.0, create-agent 1.13.0 (70c1e60)
• 9 generated schedule messages conformed to the playbook-call grammar (898ede4)
• library-grade playbook authoring: create-playbook 2.12/2.13 (bundled tier templates) + adjust-playbook 1.8/1.9 Trinity-first refresh (7c91354, ddf0420)

Orchestration (agent-dev / add-orchestrator)

• install-time divergence detection — --check mode + overwrite-prompt wiring (Abilityai/abilities#13)
• --autonomous promoted to a bundle-wide run-mode convention (Abilityai/abilities#14)
• allowed-tools realigned with skill bodies (Abilityai/abilities#9); stranded sync-fleet-to-head & profile-fleet universalized (Abilityai/abilities#10)
• event choreography: orchestrate v1.11 teaches the event layer's emit side; onboard v5.1 custom-events note (4305e5e)

Creation, deployment & onboarding — tighter platform integration (trinity / create-agent / agent-dev)

• deploy-as-is → onboard-in-place: /trinity:onboard 6.0 in-place mode, /trinity:sync plugin reconcile, plugins: blocks everywhere — the marketplace half of the platform's pre-installed Trinity plugin (ent#411 / #1704) (b39a110)
• repository-first agent deployment across trinity, create-agent and agent-dev (19e8f1f)
• /trinity:start-here: a guided, resumable first journey into Trinity, grounded in live platform docs (5cd6a27, 629aabb)
• create-agent 1.8.0: Trinity-connected deploy becomes the default (confirmation-gated) end-of-wizard action (6988238)

Fleet analysis & migration (agent-dev)

• agent-fleet-analysis v2.3: universal fleet analysis across paradigms — Claude Code, n8n exports, LangChain/CrewAI/AutoGen, freeform-coded agents (aa14e23)
• agent-fleet-migrate v1.0: execute the fleet-analysis work order into a verified Claude Code fleet, non-destructively (8ba9ac4)

Collaboration conventions (agent-dev / create-agent)

• cross-actor project management: add-project-management v1.0/v1.1 (intake primitive, headless task creation, reconciler), then folded into agent-dev (4c48dca, 4a43766, 2a07655, 9b9b2d8)
• Request Dispatch SOP convention — create-agent 1.9.0 + agent-dev 1.7.0 (1c351fd)
• loop-closure: close the loop with the user, hand back the loops owed to others (9c9a9ab)

Marketplace-wide

• platform-truth realignment with Trinity dev — five production blockers + stale contracts fixed (dc855a3); post-tag v0.9.0 platform-truth refresh of the trinity-knowledge pack — headless fork wait (#2127), .mcp.json public-URL rule (ent#394), agent-scoped report guard, autonomy banner (#1796) (4e3d050)
• create-agent:website v1.3 (13deed4)

⚠️ Behavior changes / upgrade notes

Rebuild the platform images (backend image gains postgresql-client-17)

As in v0.8.5 (#1814): start.sh does not rebuild platform images. This release
changes all four platform Dockerfiles — the backend now bakes
postgresql-client-17 for PostgreSQL backups (#2216) and both Python images
carry the tz-database + Python-version parity guards (#1823/#1891):

git checkout v0.9.0
docker compose build            # or: docker compose build backend frontend mcp-server scheduler
./scripts/deploy/start.sh

GET /api/version reports version (code in service) and image_version
(the build it runs inside) — if they differ, the image is stale.

Base-image rebuild + agent recreate — and it now actually propagates

25 files under docker/base-image/ changed. A fleet on the old image degrades
safely but silently lacks:

• .mcp.json.template rendering for github: agents (#2007) — declared
  MCP servers were never installed before.
• Per-spawn execution environments (#1999/#2114) — a credential removed from
  .env stops reaching the next execution; a stale .env ANTHROPIC_API_KEY
  no longer shadows subscription auth.
• Committed, self-healing plugin manifest .trinity/plugins.yaml (#1704).
• Hardened YAML parsing (#1965), the container-only hooks path fix (#2036),
  the discarded-turn recovery (#1870), PAT-free orphan-sweep logging (ent#292),
  Codex auth/model fixes (#1971/#2207).

Operator action: ./scripts/deploy/build-base-image.sh, then stop and
start each agent (or use Operating Room → Restart All). Unlike v0.8.5, a cold
stop/start now detects a rebuilt image and recreates the container (#1809), the
fleet restart routes through the same lifecycle (#1860), and trinity-system
adopts on its next stop/start (#1816). A start of an already-running agent
never image-recreates it.

Template catalog now resolves through a remote registry by default (ent#14)

The GitHub half of the catalog is fetched at runtime from
TEMPLATE_REGISTRY_URL (default: the public Abilityai/trinity-templates
registry) — a new outbound fetch, and the bundled GitHub-repo floor plus the
11 dd-* demo templates were removed (#1931). Air-gapped / egress-controlled
installs: set TEMPLATE_REGISTRY_ENABLED=false (or use the admin override —
Settings → Template Registry shows live status). Fetches are byte-capped,
SSRF-validated (incl. CGNAT, ent#393), and fail open to the bundled catalog.

Automatic database backups are ON (#2216)

A nightly (03:30 UTC) verified recovery point lands under ~/trinity-data/backups/
(/data/backups/) for both SQLite and PostgreSQL, plus a boot-time
pre-migration copy when a migration is pending. Retention backup_retention_days
(default 14, floor 3 kept). Budget disk accordingly — free-space preflight skips
loud, never prunes-to-make-room. DB_BACKUP_ENABLED=false disables. Same-disk
scope only: this protects against corruption and bad migrations, not disk loss.

Container logs are bounded (#1871)

json-file logging is capped (10m × 3 by default; CONTAINER_LOG_MAX_SIZE/ _MAX_FILE for platform services, AGENT_LOG_MAX_SIZE/_MAX_FILE for agents).
Platform services adopt on the next docker compose up; agents on recreate.
Vector's aggregate under /data/logs remains the primary queryable log.
/data/archives is now writable by the backend, so log archival runs again
(#2205) — expect it to reclaim a backlog on the first pass.

Admin gates reject agent-scoped principals (ent#297)

require_admin / assert_admin now refuse any agent-scoped MCP key, closing
the class where an admin-owned agent's TRINITY_MCP_API_KEY was admin on every
admin-gated route. Automation that drove admin endpoints with an agent's key
must switch to a user-scoped key. Agent self-check flows (heartbeat, reports,
result callbacks) are unaffected.

Skills library: skills_library_url → skill_sources (ent#237)

The single skills_library_url setting is replaced by a multi-source table
with a bundled community source (TRINITY_DEFAULT_SKILL_SOURCE, tag-pinned;
set to "" to disable — the passthrough is now wired in both composes) plus
admin-added custom repos. An existing skills_library_url is adopted as a
custom source; the legacy checkout keeps rendering until you re-sync. Tag pins
that move are refused, never adopted (moved_tag).

Navigation IA changes (all legacy routes redirect)

• Templates → Library (/library, ent#263) with tabs Agent Templates ·
  Systems · Skills (ent#126/#384).
• Agents page → Dashboard List view (/agents → /?view=list, ent#260).
• Agent Detail Session tab → Workspace (?tab=session → /workspace?agent=,
  ent#358); the Sessions page and its nav entry are retired (ent#381).
• Client Portal → Workspace (/workspace), available in every build
  (ent#356/#357). The /api/enterprise/client-portal prefix and
  enterprise_portal_* table names are retained history, not licensing.

Schedules and autonomy

• Toggling autonomy no longer rewrites per-schedule enabled (#1945); an
  off→on cycle restores prior per-schedule intent.
• Schedules on a non-autonomous agent are surfaced as held instead of silently
  skipped with a live countdown (#1796); same for self-reminders (#1806).
• freeze_schedules_if_sync_failing is now enforced (#1808).

Enterprise instances

Bump the src/backend/enterprise pin to 65182c1 (enterprise-main tip). The
pin advance includes the Alembic single-head fix (#2068) — earlier pins made
entitled PostgreSQL instances silently degrade to OSS-only — and the removal of
the enterprise client_portal module (ent#356), which would otherwise mount a
duplicate router on the same prefix.

New environment variables (all optional, forwarded in both composes)

TEMPLATE_REGISTRY_ENABLED / TEMPLATE_REGISTRY_URL · DB_BACKUP_ENABLED /
_HOUR / _MINUTE / _PG_DUMP_TIMEOUT_SECONDS · CONTAINER_LOG_MAX_SIZE /
_MAX_FILE · AGENT_LOG_MAX_SIZE / _MAX_FILE · TRINITY_DEFAULT_SKILL_SOURCE
/ _REF · SKILLS_FLEET_INJECT_CONCURRENCY / SKILLS_RECONCILE_MAX_REMOVALS ·
PORTAL_CHAT_BURST_LIMIT / _HOURLY_LIMIT · PORTAL_UPLOAD_BURST_LIMIT /
_HOURLY_LIMIT · PORTAL_TITLE_MODEL / _TIMEOUT_SECONDS · A2A_OUTBOUND_ENABLED
· MCP_A2A_TIMEOUT_MS · MCP_INLINE_AUTH_ENABLED / _TIMEOUT_MS ·
OPERATOR_ALERT_MAX_PENDING_PER_TYPE · CANARY_ENABLED / CANARY_SLACK_WEBHOOK_URL
(now reach prod compose, #1878) · TRINITY_INSTANCE_NAME · TRINITY_MANIFESTS_DIR
· ASK_TRINITY_ENDPOINT · AGENT_IDLE_FINALIZE_S. See .env.example.

Reminder: SQLite end-of-support September 1, 2026 (#1278)

PostgreSQL is the forward path; migration guide at
docs/migrations/SQLITE_TO_POSTGRES.md.

Known limitations

• Agent evaluations ship as a foundation — the referee surface and the
  "Completion" relabel are live; graders and agent/UI read surfaces follow
  (trinity-enterprise#205).
• A2A inbound exposure is per-agent opt-in and cards are unsigned — signed
  Agent Cards (JWS) are tracked in trinity-enterprise#159. Outbound
  call_a2a_agent is default-OFF (A2A_OUTBOUND_ENABLED) with an admin-managed
  endpoint registry.
• Skill-runner has no admin surface yet — enable/provision/sync via MCP/API
  only (trinity-enterprise#242); per-agent skill-pack toggles are
  trinity-enterprise#342.
• Workspace multi-agent chats ride the rooms engine and are
  entitlement-gated; the picker hides itself on builds without it. Workspace
  exposure config is API-only — no Settings panel yet.
• Grid data tiles: Executions and Recent failures shipped; Next schedules
  (trinity-enterprise#99) did not.
• MCP keyless email sign-in (#848) ships dark — enable via
  MCP_INLINE_AUTH_ENABLED.
• Pull-mode pilot routes agent-to-agent work only — cron/schedule triggers
  stay on push dispatch (#2048 / #1081).
• deploy_local_agent archive path still lacks integrity verification
  (#2060). Codex API-key auth remains inert (#2208); subscription auth works.
• CI: dev's required checks still run no unit tests (#1958) — the release
  PR is the first full-suite run over a payload.

Commit-reconciled addendum (post-release)

Post-release reconciliation of the release PR's commit payload (#1781 head
e9eb40da → #2268 head bcf67116) against the status-in-dev issue set
surfaced shipped work the label-driven notes above missed:

Post-v0.8.5 hotfixes promoted to main on 2026-07-28 (#1839, untagged) —
in the v0.8.5→v0.9.0 diff but in neither release's notes:

• #1795 agent base image hardcoded TZ=America/New_York — agents ran 4h off UTC
• #1790 Cornelius seeder marked itself seeded on a volume-conflict 409 — Cornelius never provisioned
• #1793 / #1759 a nonexistent local: template silently created an empty agent (200) — now rejected, and the missing local:default ships (v0.8.5's Known-limitations entry for #1759 is resolved)
• #1830 Dashboard stats bar right controls overlapped host telemetry below ~1170px — elastic degrade instead of clipping

Shipped in the payload, closed outside the label sweep:

• #2186 starting a stopped agent 500'd when a recreate was needed — require_running gate narrowed to the one call site (#2187)
• #2259 Workspace composer buttons aligned to the input, not to the typeahead wrapper (#2260) — was still status-in-progress; closed by reconciliation
• ent#336 canary S-03 built its TTL floor from the agent cap, not the execution's own timeout — every shorter-timeout scheduled run paged critical (via #2022)
• ent#339 canary S-03's below_floor arm is an internal-coherence check, not a dispatch-timeout check — documented honestly (via #2022)

Correction: the Known-limitations line claiming @abilityai/trinity-docs-mcp
was not yet on npm has been removed — the helper MCP server has been published
as the unscoped trinity-docs-mcp (0.1.0; npx -y trinity-docs-mcp per the
README). trinity-enterprise#330 closed as completed.

Headline count corrected: 155 public + 62 private-tracker issues.