v1.0.0 — the Tandem release: agents take a seat on the team

v1.0.0

Released: 2026-10-20
Tag: v1.0.0  ·  Diff: v0.9.5...v1.0.0

443 commits · 406 merged PRs · 2,485 files (+352k/−34k) · 217 public + 156 private-tracker issues · enterprise submodule 08cd4dd → 982735f · release candidates rc1–rc4 cut from dev along the way; the release is cut from the dev tip after rc4.

Freeze plan and coherence review: v1.0.0-freeze-plan.md. User-facing summary: What's New in v1.0.0.

Highlights

1.0 is built around one story: an agent takes a seat on the team. It has a named
role, serves named people, works inside projects, is bounded by approvals the platform
enforces, is measured against business numbers, and reaches people through one Inbox.

• Agents are assigned to people. An admin names who an agent serves (its primary),
  who approves for it, who collaborates and who views; the agent knows this on every
  run. One companion can serve several seats, an agent can hold a seat itself, and every
  assignment change is audited. Workspace shows each person a role card with the
  role, objectives and metric freshness (ent#500, ent#527, ent#810, ent#811, ent#814,
  ent#817, ent#676).
• One Inbox, platform-native approvals. Workspace opens on an Inbox (Action / Unread /
  All, reading pane) across every agent. Agents ask over MCP; an ask can be answered with
  an option, "something else", discussed in a linked chat, or dismissed, and stays attached
  to the chat it was raised in. Asks are addressed to a role, never a named person
  (ent#610 in part, ent#611, ent#606, ent#816, ent#748, ent#747, ent#738, #2915, #3242,
  #3243, #3247).
• Gated skills. Mark a skill requires approval by role X: the approval reaches a
  person who can open the agent before the agent ever sees the request, an approved
  run executes once with exactly the approved input, and an in-container hook refuses the
  bypass lane. The requester is told how it ended (ent#751–#756, ent#844, ent#881,
  #3653, #3654).
• Self-change grants and agent reach. An agent changes its own skills, schedules,
  instructions, other agents or projects only with an admin-granted toggle. An agent key
  reaches only itself, the agents it may call and the agents it spawned — on fleet routes
  too; an edge exposes the skills the target declares, and library skills need a per-skill
  grant (ent#164, ent#756, ent#662).
• Projects. A project is a platform record with members, visibility, a Continue card,
  Tasks / Log / Files tabs and a Steward agent; agents work on projects over MCP
  (ent#661, ent#896, ent#588).
• Business metrics and objectives. Templates declare metrics; agents push points over
  MCP (batched, idempotent, restatements reported); dashboards and the role card show
  target vs actual with freshness, and a stale metric says so (ent#477–#479, ent#666,
  ent#812, ent#727, ent#729–#731, ent#671).
• Suggestions and readiness. "Things you can ask" and "Suggested for you"; a companion
  stays in calibrating (no proactive brief) until its owner marks it ready
  (ent#465, ent#637, ent#663, ent#689).
• One Settings home per agent and a restored agent header — in-place name and avatar,
  funding switcher, live sparklines, 7-day spend, GitHub line, capacity bars; a two-pane
  New agent dialog (ent#887, ent#888, ent#890, ent#891, ent#353, ent#950, ent#955, #3792).
• Git sync that pulls. Auto-syncing agents fetch and rebase on a heartbeat; conflicts
  are recorded; divergence over 24h turns red on the agent card and fleet health
  (ent#703–#708, #3010, #3011).
• Workspace-only users. Platform role user signs in to Workspace only; sharing an
  agent no longer creates an operator login (ent#837).
• Hosting. Hosted compose ships a bundled PostgreSQL; AWS one-click (AMI +
  CloudFormation) and a Vultr Marketplace listing join DigitalOcean (#3159, #3004, #2282).
• A2A. Outbound A2A is OSS core, x402-priced inbound A2A, and every inbound call now
  needs a credential (the keyless trusted-network path was removed before release,
  ent#885). Signed AAuth agent identity between instances ships dark behind
  AAUTH_ENABLED (PRs #2956, #3659).
• Security sweep. 81 security-themed issues across both trackers: agent keys can no
  longer act as their owner on admin/owner routes, guardrail hooks run from an isolated
  read-only config, the Files surface has one tier-per-verb rule, rooms re-check access at
  wake time, suspended accounts lose /ws/events, A2A callers see only their own tasks.

Features

• #1989 Decide (on paper) whether human-interactive chat belongs in the pull queue — TARGET_ARCHITECTURE Open Question 7
• #2282 feat: Vultr Marketplace imageless listing for Trinity (cloud-init Vendor Data)
• #2392 feat(pull): platform-injected execution id for the side-effect guard — Tier-6 T6.3, blocks default-ON for side-effect agents
• #2842 feat(pull): interactive turns jump the queue — the starvation half of Open Question 7
• #2843 feat(pull): one turn per conversation at a time — the transcript-safety half of Open Question 7
• #3004 feat: AWS one-click — Marketplace free AMI (Launch from Website) + CloudFormation Launch Stack link
• #3114 feat(pull): route interactive producers onto the durable queue on pull pilots
• #3127 feat(pull): UI /chat on the durable queue for pull pilots
• #3242 Approval asks have no "something else" answer — the person must pick an option they reject before Send unlocks
• #3243 Agents write long, compound asks — teach atomic asks in the ask_operator contract and cap option count/length
• #3247 Scheduled runs re-ask what is already pending — show an agent its open asks and let it replace one
• #3695 Workspace sidebar: order the top controls Inbox, Projects, New chat, Search

Private tracker (trinity-enterprise):

• ent#155 Chat: Escape key + Stop button cancel the in-flight turn and restore the message to the input field
• ent#242 feat(skills): skill-runner admin surface — UI/MCP for enable, provision, sync, and access grants (ent#139 follow-up)
• ent#253 Consistent data-refresh treatment across all polled surfaces — invisible background refresh, standard first-load motion
• ent#329 feat: operator-queue respond → re-trigger dispatch (async human-gate resolution re-entry)
• ent#353 Settings tab: surface the per-agent execution timeout (default for MCP/chat/channel-triggered runs) in the UI
• ent#403 Workspace chat: user-friendly model dropdown
• ent#428 feat(workspace): addressed asks — the column, its roster validation, and the portal read/answer path (ent#364 slice 1+2)
• ent#429 feat(workspace): render an ask in all three surfaces, attach it to a chat, and show it expiring (ent#364 slice 3+4)
• ent#430 feat(workspace): wire an answered ask to the ent#329 resume dispatch, and turn the flag on (ent#364 slice 5 — the gate)
• ent#433 Subscription headroom history — persist probe snapshots for utilization trends
• ent#434 Alert the operator at ≥75% of the weekly subscription limit (per subscription + all-subscriptions-saturated escalation)
• ent#451 Workspace: multiple chats per agent — topic-scoped conversations instead of one running chat
• ent#454 feat(systems): teardown — DELETE /api/systems/{name} with dry-run preview, soft-delete semantics, honest partial report
• ent#456 Workspace opens in a new browser tab by default
• ent#457 Workspace: live execution visibility — dispatch → monitor → report back, rendered in chat
• ent#465 Workspace: personalized recommended actions — per-user, per-agent, derived from usage trends, capabilities and schedule state
• ent#468 Workspace: decide whether an answered ask tells the client that work started
• ent#477 Metric registry: backend reader for template.yaml metrics: — materialize at create/sync, validate with named errors, expose definitions (revives D-006)
• ent#478 record_metrics MCP tool + metric_points store — batched, idempotent, validated against the registry (Postgres, OSS core)
• ent#479 Per-agent metrics read + freshness — history API, MCP get_metrics, stale flag, declared metrics as default agent-dashboard tiles
• ent#483 Validation parity for template.yaml metrics: — platform compat check (D-006) mirrored in trinity-templates tools/validate.py + /audit-templates and a wizard gate in /audit-wizards + /test-wizard
• ent#498 Workspace: brief delivery into the 1:1 thread — a schedule delivers its output to a named user's Workspace conversation (API/MCP only; split from #442)
• ent#499 Workspace: report-a-problem — a negative rating raises a bounded operator-queue alert
• ent#523 Workspace: agents at the centre — clicking an agent opens its most recent chat; a pinned Main chat with Reset; chats as tabs; New chat with a hotkey
• ent#525 Workspace: the live execution card in chat + the Work tab history — the visual half of ent#457
• ent#527 Workspace: the role card in Agent details — role, objectives with metric freshness, your relationship kind, readiness state
• ent#530 feat(skills): skill sets — assign a named collection of library skills to an agent in one act, kept current as a unit
• ent#534 Workspace voice mode: the orb takes the conversation — real-time call over the current chat, canvas in the right column, transcript back into the chat
• ent#537 Canvas design kit: a platform stylesheet, starter layouts and a canvas library skill — an agent's canvas looks designed without touching CSS
• ent#551 Voice mode: a long task runs in the background while the conversation continues — spoken acknowledgement on dispatch, result brought back when it lands
• ent#568 feat(prompt): the platform prompt and chat_with_agent teach the delegation contract — a receipt means running, never re-send on silence, async for long work
• ent#582 feat(onboarding): configure Claude, GitHub, email and Gemini keys inside first-run — no terminal
• ent#600 Telegram groups: agent sees the group's recent conversation as context when tagged
• ent#621 Workspace key map: switch agents (⌥↑/↓) and chats (⌥⇧↑/↓), show the rail (⌘.) and change its tab (⌥.), all from the message field
• ent#625 feat(workspace): theme switch (light / dark / system) at the top right of the central column
• ent#631 Workspace: tag a person into a conversation — the mention reaches them, instead of doing nothing
• ent#637 Schedules can write an individual user's memory — the proactive brief maintains the seat it serves (R26)
• ent#638 Seat-level decision record as a platform primitive — why a thing was approved, deferred or killed (R25)
• ent#653 feat(executions): agent-facing execution search — grep prompt/response/error across accessible agents (MCP search_executions)
• ent#657 Workspace: unsent input survives switching agents, chat tabs and rooms — with a Draft indicator on the conversation
• ent#661 Workspace: Projects — a platform-owned project with members, chat and room links, and agent MCP access (enterprise)
• ent#665 feat(messaging): caller-declared idempotency key + TTL on send_message — cross-execution dedupe for the human-facing send path
• ent#666 Objective ↔ metric join: one read of target vs actual with freshness, shared by the role card, project hub and proactivity trigger
• ent#671 Settings: read/write rows for metrics_retention_days and metrics_daily_point_cap in the retention panel + enterprise retention key mirror
• ent#676 Role card reads the objective ↔ metric join (ent#666) instead of its own join and 30-day stale rule
• ent#679 feat(a2a): usage-priced hosted agents — the x402 payment gate on the A2A inbound path, priced on the agent card, paid once at add time
• ent#689 Readiness gate: a calibrating companion's proactive brief must not fire — and the gate must not silently mute every unstamped agent (ent#663 enforcement half)
• ent#692 feat(skills): admin- and controller-key source management over MCP — list / register / edit / sync library sources, registration included
• ent#703 Git sync: a pull heartbeat in the container — human and fleet work reaches the agent within a bound (invariant G3)
• ent#704 Git sync: working-branch mode reachable from the UI and MCP create paths — the create flow asks "an agent" or "a deployment of a codebase"
• ent#705 Git sync: agents created as agents default to working branch + auto-sync on + freeze on — the repository is the agent
• ent#706 Sync health: divergence age is the signal — red at >24h ahead or behind origin, freeze keys on it for work agents; dirty-file count and last successful push persisted on the row
• ent#707 Sync health surfaces: a sync block in get_fleet_health read from the existing row, sync fields on the agent card, the fleet sync-audit exposed over MCP
• ent#708 Git sync: narrow the fleet-wide .claude/settings.json ignore (over-broad since ent#345) and pick one durability owner — marketplace hooks or the platform heartbeat
• ent#724 Canvas tab: replace the chip-strip selector with a dropdown, shorten agent-generated titles, fold Manage into one control
• ent#727 Narrow cross-agent metrics read — GET /api/agents/{name}/metrics + get_metrics(agent) honoured for an agent_permissions grant holder (ahead of ent#80)
• ent#729 record_metrics restatement: a corrected value at the same (metric, ts, dims) UPDATES the row — revision + recorded_at, corrected in the batch receipt (R45)
• ent#730 Bound dashboard widget ignores dims: — a tile cannot name one series and renders the cross-series fold (blocks R43 display)
• ent#731 Guard metrics: the objective reader ignores guard_metrics: and cannot express a hold on a registry-directional metric
• ent#734 Asks raised during a chat turn attach to that chat, not Main
• ent#738 Workspace chat: reply to a message from inside the chat, not only from the Inbox
• ent#747 Workspace asks: Discuss — open a new conversation with the agent about an ask and answer in free text
• ent#748 Workspace asks: one-click Dismiss without answering — the ask ends as dismissed and the agent is notified
• ent#754 Agent Skills tab: merge Playbooks into Skills — own and shared sections, one row shape with Run and Requires approval
• ent#755 Inbox: the gated-skill approval card — which agent, which skill, what input, on whose request
• ent#756 Agent Settings: the self-change permissions as four admin-only toggles — skills, schedules, instructions, other agents
• ent#761 feat(a2a): outbound A2A control is OSS-core — register/list/remove endpoints without the enterprise entitlement (consumer side of remote agents)
• ent#784 Workspace: opening an agent starts a new chat with the cursor in the message field
• ent#794 System test: chain tests on a rolled-out fleet — roll-out, canon facts, fact routing, library changes, objective to brief — run on every release candidate
• ent#795 System test: approval and project chains — a canon approval rule enforced end to end, a project run across agents, an approved action inside a project
• ent#804 [Epic] Change propagation as library playbooks — protocol + /canon-rebuild + /propagate-change in tandem-skill-library
• ent#810 Admin UI for agent assignments: set the primary human, approvers, collaborators and viewers on an agent's detail page
• ent#812 Objective join resolves owned objectives through the seat the agent holds or its primary holds, not x-role; supporting_agents frozen
• ent#813 Readiness gate keys on 'a primary holds a seat', not on the presence of x-role; fails open
• ent#814 Shared companion serves several seats: one primary as the default seat, the served person's own seat per run; seat decisions stamp the right role
• ent#817 Assignments backend for the ent#810 admin UI: optional role, agent as seat holder, canon role picker, tri-state consent
• ent#836 Workspace: an Asks tab in each agent's rail, opening the ask in the Inbox, and a calmer "needs you" mark
• ent#841 Workspace: close a chat from its tab with an ×, which archives it (never deletes)
• ent#842 Workspace: star the current chat from a button in the chat input area
• ent#843 Workspace role card: objectives in plain words — what the agent owns first, what it supports collapsed, no metric code names
• ent#856 Workspace: recency that holds still — chat tabs re-sort only on arrival; Inbox recency by default with an urgency switch
• ent#887 feat(ui): Agent Settings home — the rail scaffold, the General pane and one restart banner (trinity#966 step 1)
• ent#888 feat(ui): Settings › Storage — repository, credentials, shared folders and file sharing in one pane (trinity#966 step 2)
• ent#890 feat(ui): Settings › Guardrails — bounds, unprompted work, checks and reliability in one pane (trinity#966 step 4)
• ent#891 feat(ui): Settings › People — the Access tab becomes a Settings pane (trinity#966 step 5, after the Access-tab PRs merge)
• ent#892 Workspace agent rail: reorder the tabs to Info, Canvas, Files, Projects, Asks, Work, Loops
• ent#896 Project page: lead with Continue, show the steward's state, and say how a project moves
• ent#901 Agents can withdraw their own pending ask without raising a new one
• ent#945 Platform prompt: a facts-only "Your environment" block — durable home vs /tmp, the reserved directories, when template.yaml edits take effect, protected paths
• ent#950 Agent header after ent#887: repo + tags + a small context chart back; Talk and Workspace doors out
• ent#955 Agent header: edit the display name and change the avatar in place again (ent#887/ent#950 follow-up)

Fixes

• #2105 bug: ahead_working reports ahead-of-main for any non-trinity/* branch, and fleet audit reads it as unpushed
• #2107 bug: git-sync write access is never validated — a read-only credential fails silently forever (ls-remote and the REST permissions.push field both lie)
• #2197 bug: page body scrolls horizontally on Settings and Agent Detail below 1024px
• #2201 bug: text contrast below WCAG AA on nav badge and secondary labels (both themes)
• #2202 bug: Settings page emits a 404 on every tab and renders all 306 MCP keys unpaginated
• #2318 bug: trinity-system agent can never be created on hosts with fewer than 4 CPUs — template cpu:"4" passed to Docker unclamped
• #2329 bug(pull): the pull sink ignores post-turn delivery settings — a pulled turn succeeds but its result never reaches the caller's session
• #2372 Operator queue: acknowledging a platform-minted alert leaves it responded forever — the write-back re-injects it into the agent's queue file and the #1631 guard rejects it on every boot
• #2514 fix(pull): close the pilot-scoped gaps left by #2391 — schedule context, RETRY-001 stacking, _dispatch_and_record_outcome, breaker test
• #2711 bug(workspace): the rail column appears after load and shifts the conversation column, against the contract's "nothing shifts on arrival"
• #2771 bug(canvas): markdown inside table cells is not rendered — table block cells show raw bold/code/link text
• #2806 bug: agent-to-agent chat chains have no depth guard — a runaway A→B→A bounce is bounded only by capacity parks and hop timeouts
• #2840 bug(canary): B-02 has no pull awareness — fires critical on a healthy pull pilot, and Phase 5 does not retire it
• #2845 bug(pull): retry is in neither the autonomous nor the pull-reachable trigger set — retried tasks switch dispatch systems mid-task and skip the skill-not-found alert
• #2846 bug(pull): the Phase-2 lease-renewal heartbeat was never built — a hung turn is re-delivered while it is still running
• #2888 bug: run-full.sh never runs the api/standalone/postgres tiers — unclassified-dir glob resolves against the wrong cwd
• #2889 bug: a 503 from an exhausted credit balance is laundered into an "acceptable skip" across 32 tests
• #2890 bug: hardened-YAML guard's venv exclusion is off by one — a tree-root virtualenv yields false positives
• #2899 bug(onboarding): fresh install greets the first agent with red "must-fix" compatibility findings from Trinity's own starter templates
• #2900 bug(frontend): agent detail tabs are not in the URL — Back button leaves the page instead of returning to the previous tab
• #2914 bug: assigning a library skill whose name matches an agent-authored skill silently overwrites the agent's copy — refuse and show the name conflict in the Skills tab
• #2915 bug(operator-queue): a pending approval can sit unseen for days — the human's card goes stale while the container↔platform sync stays silent
• #2919 The 503 skip-laundering fix has a twin one status code over: 18 bare 429 skips still hide an exhausted subscription
• #2930 bug(first-run): every local-template agent files a "could not check this agent's git remotes" alert, blaming a capability setting that is not the cause
• #2938 bug(git-sync): initialize places a new repo in workspace/ when it is non-empty, but the agent server only looks at /home/developer — init reports success, everything after says "not enabled"
• #2944 bug: watchdog fails a completed synchronous execution after a backend restart instead of recovering its result
• #2952 bug(tests): mcp-server access-wiring "#2807 refused loop is audited as a refusal" reads the previous test's late fire-and-forget audit row — flaky on dev alone
• #2957 bug(git): get_git_status drops the first character of the first modified path — the outer strip() on porcelain output eats an unstaged entry's leading space
• #2958 bug(execution): a chat turn continues whatever session was persisted last — after a long scheduled run it inherits that run's context, pays its compaction, and the execution record says nothing
• #2959 bug(validation): the validator is handed an empty run response and its "nothing to inspect" is recorded as failed_validation — a wrong high-priority alert per successful run
• #2964 bug(workspace): the live chat card jumps ~2s into a turn — " doesn't report steps." and Stop pop in after first paint
• #2968 bug: sync chat path (execute_claude_code) ignores is_error results — failures returned as success or as a generic "empty response" 500
• #2969 bug(docker): execute_command_in_container ignores timeout — a hung exec wedges session cleanup and can drain the 4-thread Docker pool
• #2971 bug(agent-runtime): Gemini runtime cannot run a turn on the current base image — unpinned gemini-cli rejects --system-prompt/--max-turns and fails the trusted-folder check
• #2987 bug: selectable model catalog is stale — Claude Opus 5.5 (claude-opus-5-5) not selectable anywhere; ops cost view would render it "Claude Opus 5 5"
• #2991 bug(agents): start_agent drops skills_injection/skills_result at the API boundary — skill-delivery failures are invisible to REST and MCP callers
• #2994 bug(ci): dependabot-auto-merge fails every Dependabot PR — skipped pytest checks counted as failures
• #2995 bug(ci): Deploy to Dev goes green when the backend fails its post-deploy health check
• #3001 Workspace Work card says " doesn't report steps" while its own live activity line shows the agent reporting
• #3010 bug(git-sync): the auto-sync toggle is not authoritative — OFF never takes effect (the baked env is OR'd forward at recreate), ON waits for the next recreate
• #3011 bug(git-sync): the auto-sync heartbeat pushes without fetch or rebase — on a shared branch it fails non-fast-forward forever after the first foreign push
• #3012 Default model claude-opus-5-5 fails on cached Claude Code 2.1.278, and the rejection is misclassified as auth (seat rotation + API-key fallback)
• #3024 bug(operator-queue): every ask the platform ends reads "Re-used id" — the #2915 reconcile flags the entry it is about to flip
• #3041 bug(frontend): /m Agents tab shows "Couldn't load agents" for a non-admin session instead of saying the list is admin-only
• #3046 bug(uploads): every ZIP attachment is rejected as 'file type mismatch' — libmagic 5.46 (trixie) misdetects ZIP via from_buffer
• #3053 bug(skills): re-assigning a skill set keeps the old assigned_by; the set components use raw gray classes
• #3055 bug: Workspace ask card hides the answer controls when the ask belongs to another chat
• #3059 bug: Workspace asks read silently stops at 200 rows with no total
• #3064 bug: Workspace unread count full-scans enterprise_portal_messages on every poll
• #3079 bug(infra): backend image floats on python:3.13-slim — Debian release drift (bookworm→trixie) shipped libmagic 5.46 unnoticed, pin the codename or add a capability parity test
• #3080 bug(file-sharing): outbound detect_mime() uses libmagic from_buffer — shared ZIPs now classify as application/octet-stream on libmagic 5.46
• #3088 fix(retention): approving a metric-points prune 409s forever when METRICS_RETENTION_DAYS supplies the window
• #3106 bug: agent server fails to start on every OTEL-enabled agent — startup.sh's unpinned per-boot pip upgrade pulls FastAPI 0.142.0, whose auto-telemetry refuses grpc
• #3109 fix(onboarding): the dashboard stays empty for 30s after the first-run overlay closes
• #3115 bug(operator-queue): markdown in approval/question asks renders as raw text on some surfaces (portal asks, options, resolved history)
• #3134 Library skills marked user-invocable: false are reported as user-invocable — the platform parser reads only the underscore spelling
• #3135 Library → Skills: the shadowed badge tooltip reads "Shadowed by: [object Object]"
• #3138 bug(workspace): the agent band shows 1% for a 100% success rate — a 0..1 ratio rendered as a percent
• #3140 bug(workspace): a chat or agent URL the viewer cannot open still shows a live composer
• #3159 bug: one-click hosted installs (DigitalOcean 1-Click first) create new instances on SQLite after its end-of-support — bundle PostgreSQL in the hosted compose
• #3163 Chat tab banner says "Stateless chat" but the page sends the last 20 messages as context
• #3166 Workspace shows another turn's reply when two turns run on the same thread
• #3170 Public link copy button copies a relative /chat/ path when FRONTEND_URL is unset
• #3186 fix(compat): D-003 hard-fails metric-bound dashboard widgets that omit value/color — the renderer fills them, the check does not know
• #3194 bug: Settings → Trinity Prompt copy says it is injected into CLAUDE.md at startup and needs a restart — it applies every turn
• #3206 bug: Settings → Trinity Prompt box should link to the recommended-prompt docs page
• #3210 bug(rooms): an agent reply over 8,000 characters is silently dropped — the turn is billed and marked success, the room shows nothing
• #3214 bug: the #1581 orphan agent-volume sweep is instance-blind — a second stack on the same Docker daemon force-removes other stacks' agent volumes and logs it at INFO as a successful reclaim
• #3215 fix(nevermined): card (fiat) plans can't be paid — the 402 and verify/settle always use the nvm:erc4337 scheme
• #3218 bug(canvas): a newly created canvas is not selected when another canvas is already open — it stays hidden until picked from the selector
• #3232 bug: chat_with_agent never forwards its execution_id argument, so a delegated task cannot report back to the caller's channel
• #3233 bug: a system-scoped caller of a gated skill is promised the outcome but never receives it
• #3234 bug: two MCP tool descriptions run past Claude Code's 2,048-character cap, so their tails never reach the model
• #3237 bug: system agent is never created on a fresh install until the backend restarts — /setup creates the admin after the only deploy attempt
• #3244 bug: chat_with_agent reports a usage-limit 429 as agent_busy although the turn already ran, so a retry repeats its side effects
• #3245 bug: an async /task keeps replaying its accepted receipt for 24 h after the run fails, so an exact retry returns the failed run
• #3246 bug: platform alerts pile up in the operator queue — every new reading files a new row and nothing ends the ones that are no longer true
• #3262 bug: system agent is never created when ADMIN_USERNAME is not 'admin' — SYSTEM_AGENT_OWNER is hard-coded
• #3264 bug(workspace): the agent band's activity tooltip opens upward and is cut off under the header
• #3265 bug(workspace): a sent message doesn't show its attachments — the image chip vanishes and the bubble shows only text
• #3272 bug: test_deploy_writable_templates leaves services.* package attributes pointing at re-imported modules — later files in the same xdist worker fail
• #3293 A bound dashboard widget's dims: selector can miss a series that reports rarely beside a busy one
• #3295 bug: a sequential chat_with_agent call cannot report back to the caller's conversation
• #3305 bug: concurrent slot admission can exceed configured capacity
• #3307 Registered subprocess ownership is lost when execution waiters are cancelled
• #3313 bug: an unhashable value in an agent's operator-queue file silently stops answer delivery to that agent
• #3314 bug: operator-queue fingerprint sees options: [] as a rewrite, so answers are refused with 409 item_diverged
• #3316 bug: a fault between the loop claim and the run-row close leaves the loop "running" forever
• #3319 bug: queue status reports the newest slot as the "current execution", not the oldest
• #3320 bug: a duplicate room post that arrives while the first is in flight gets 200 "replayed" instead of 409, and the message can be lost
• #3321 bug: a pulled turn's system prompt states the recorded timeout, not the clamped limit it actually runs under
• #3340 bug: an API error the agent server parsed (e.g. "Output blocked by content filtering policy") reaches the user as "no diagnostic output — most likely OOM"
• #3356 Workspace: starring a chat fails on the first click, works on the second
• #3357 Work card says "Steps could not be read right now" under its own live activity line when an agent has two runs
• #3406 bug: returning visitors of email-verified public chat links are sent to the operator /login after 24 h and stay locked out
• #3431 bug(workspace): the chat's Working clock restarts at 0s when you open a chat mid-turn
• #3442 bug: test suite drifted behind merged changes — scheduler fixture, dormant-alert seam, sanitizer env leak, stale api assertions
• #3443 bug(ui): Anonymous public-chat history never restores after reload (session id lowercased on lookup)
• #3446 bug(ui): Help chat button overlaps the Send button on the agent Chat tab
• #3447 bug(ui): Sharing tab renders ChannelConfigDialog that is never imported (6 Vue warnings, dead dialog path)
• #3449 bug(ui): A filter on the Notifications tab rewrites the global Operations counts
• #3450 bug(ui): Health tab says Active Alerts (50) but renders five with no way to see the rest
• #3452 bug(ui): Health tab shows no circuit-breaker state for agents whose breaker is DORMANT
• #3453 bug(ui): Entitlement-gated Settings tabs fall back to General on a cold load or refresh
• #3454 bug(ui): Retention tab never renders the backup status the API already returns
• #3455 bug(ui): Email whitelist accepts any string: no client-side or server-side validation
• #3456 bug(ui): A whitelist entry containing a slash cannot be removed
• #3458 bug(ui): A long unbroken token in a Workspace message renders a bubble thousands of pixels wide
• #3459 bug(ui): Esc while renaming a Workspace chat saves the edit instead of cancelling
• #3460 bug(ui): Message over the 8000-character server limit fails with a bare error 422 and no client-side limit
• #3461 bug(ui): Public chat shows visitors the raw execution error, including the exit code and operator-only remediation
• #3463 bug(ui): Agent name has no length ceiling, no format hint and no preview of the sanitized slug
• #3465 bug(ui): Dashboard list rows overlap and clip at 768 px with the Systems sidebar expanded
• #3470 bug: Workspace turn fails with "reached its usage limit" instead of walking every subscription — SUB-003 retries once, then hands the retry to the user
• #3520 Gated skill: the requesting agent is told the approved run started and gets no notice when it ends
• #3521 bug(workspace): a thumbs-down comment never reaches the operator's alert — the alert says "They left no comment."
• #3524 Workspace Inbox: an answered approval does not show whether it was approved or rejected
• #3525 Gated skill: the approver's rejection reason is not passed to the requesting agent
• #3526 Agent Chat tab: a gated request held for approval leaves no trace after reload, and re-sending raises duplicate approvals
• #3527 Workspace Inbox approval card: requester shown as "A caller", request buried under history, decision needs two clicks
• #3533 Workspace: a chat is titled with the title generator's own failure text ("Unable to generate title")
• #3534 Workspace role card renders nothing when template.yaml has no x-role, even for a seated primary with a canon role file and an objective
• #3545 bug: an agent created from the creator's own repo with their own token comes out pull-only as "shared catalog template"
• #3554 PostgreSQL installs seed the admin with email = username, so the first-run "Sign-in email" step never appears
• #3574 bug(project hub): Overview renders a pending ask in full and stretches the content column to match
• #3583 Public links: an invalid expiry is stored, then the agent's link list returns 500 and the panel says "No public links"
• #3588 bug(activities): execution_cancelled and caller-side collaboration activities stay started after terminate / watchdog claim (#1804 class)
• #3589 bug(watchdog): a recovered turn records the claim time as completed_at — 5m 32s shown for a 64-s turn
• #3590 bug(pull): recreate_missing_container rebuilds a pull pilot without the pull env — its queue stalls silently
• #3637 bug: SMTP email sends block the backend's event loop (no timeout)
• #3642 bug: a producer-supplied completed_at earlier than started_at is stored as-is (no low-end clamp)
• #3653 Gated skill: the person who asked never sees the outcome in their chat; the requesting agent's wake-up run carries no channel context
• #3654 Gated skill: the Chat tab says "Finished successfully" without the run's reply, so an approved run that did nothing reads as done
• #3655 bug: Login page says a code was sent when the install has no email provider — codes go to the backend log and the page never says so
• #3660 Workspace role card tells the agent's primary and approver "no assignment recorded"
• #3672 Workspace: the sidebar's agent and chat lists jump as they load — hold the layout and fade content in
• #3677 bug: PUT /api/agents/{name}/model turns the agent's 400 for an invalid model into a 503 "Failed to set model"
• #3679 bug: a capped read of pending asks drops the longest-waiting ones (server sorts newest first, clients show oldest first)
• #3688 Workspace header reads "Finished" for a rejected/expired gated request notice (_portal_body)
• #3692 bug(workspace): project page prints the goal as raw markdown instead of rendering it
• #3694 bug(workspace): project Overview grid leaves data-dependent gaps and flips its column rhythm between rows
• #3702 bug(ui): A2A tab hides "Choose…" for advertised skills after exposure is switched on in the tab
• #3708 Gated-skill approval card links Workspace-only members to an execution page they cannot open
• #3710 Generated .env seed overwrites injected workspace credentials on startup
• #3712 Concurrent executions reuse tool IDs and cross-wire activity completion and output
• #3714 Inbox pane shows Open canvas on asks and no way to the ask's chat
• #3715 Stale stderr overrides terminal Codex failure classification
• #3719 Git credential maintenance cannot inspect owner-readable private workspaces with restricted capabilities
• #3725 bug: creating an agent from a public github: template fails when the resolved GitHub token is stale or rate-limited, although the clone needs no token
• #3737 bug: starred chats in the Workspace tab overflow menu render with the title pushed to the right
• #3738 bug: a file attached to an unsent Workspace message cannot be removed from the composer
• #3746 bug(telegram): fenced replies become attachment references without uploading a file
• #3749 bug: inbound A2A message/send never returns a working task for a long agent turn, so the caller's 30 s timeout loses the answer
• #3792 bug(ui): Create Agent dialog overflows the screen, scrolls both ways and jumps — redesign as a fixed two-pane picker
• #3795 bug: Workspace Main after Reset shows only the reset notice, not the new-chat empty state
• #3813 bug: renamed agent keeps its old AGENT_NAME across recreate — pull workers and heartbeat 403 under the dead name
• #3814 bug(pull): the system agent can be put in PULL_MODE_PILOT_AGENTS but its system-scoped key is refused by every pull seam

Private tracker (trinity-enterprise):

• ent#672 A library skill marked deprecated: true is still listed, assignable and injected — the platform parser drops the lifecycle keys
• ent#815 Broad list_operator_queue under-returns: the MCP agent-scope filter runs after SQL's LIMIT, so count < limit is not evidence of completeness
• ent#881 A gated skill's approval addressed to a person the agent isn't shared with never reaches their Inbox, and nobody is told
• ent#898 bug(a2a): the A2A panel's outbound endpoint form writes a per-agent table that call_a2a_agent never reads
• ent#904 No primary seat written ⇒ to: primary reaches nobody: proactive messages refused, asks and reports fall to the Operating Room

Security

• #2907 bug: auto-detected MCP URL ignores X-Forwarded-Proto — advertises http://host:8080/mcp behind an HTTPS proxy
• #2955 bug(files): follow-up of ent#549 review — withhold audience_source from key principals with the address fields, compute a row's audience once, one email normaliser
• #2973 bug: loops, schedule triggers and agent events start a fresh depth-0 chain — an agent can launder its inter-agent chain depth (#2806 follow-up)
• #2975 Report and canvas MCP tools reject the system agent's system-scoped key
• #2996 bug(auth): agent-scoped keys can toggle their own agent's autonomy — PUT /api/agents/{name}/autonomy lacks reject_agent_principal
• #3032 refactor(security): agent-server file handlers use string-prefix path containment — align on is_relative_to
• #3052 bug(skills): the Skills tab always sends probe=true, so any reader of an agent triggers an in-container exec
• #3063 bug: Workspace history returns cost and execution_id to portal tokens
• #3102 security: scope fences compare request.url.path, which a crafted Host header desyncs from the routed path (CSO 2026-09-29 #1)
• #3103 ci: backend-unit-nightly runs fork-PR code in a main-scoped job with a shared pip cache and a verdict bot that trusts fork-produced JSON (CSO 2026-09-29 #2)
• #3104 security: {{payload.*}} event interpolation lands another agent's payload in the subscriber prompt raw, unframed and uncapped (CSO 2026-09-29 #4)
• #3105 security: Bash guardrail has no deny pattern for sudo writes to the guardrail registration; docs claim it cannot be rewritten (CSO 2026-09-29 #5)
• #3130 bug: the operator-queue flood guard enqueues into the queue it guards — self-sustaining alert growth, and depth-held requests are never reported to the filing agent
• #3139 bug(workspace): an external client's agent page lists other people's runs of that agent (run ids and timings)
• #3164 bug: fork-to-own always demands a GitHub token even when the user's personal token is already saved
• #3274 Gated skills: close the seven #3208 validation gaps before the gate map makes them reachable
• #3278 docs: "How Trinity keeps agents in bounds" — the guardrails vision page, and fix the two "agents cannot bypass" overclaims
• #3311 bug: log sanitizer leaves a sensitive KEY=value unredacted when it follows a harmless pair
• #3312 bug: sanitize_dict / sanitize_list return the raw subtree past max_depth, so nested secrets escape redaction
• #3323 bug: reject_embedded_credentials misses protocol-relative userinfo, so a token in a skills-library URL is stored in plaintext
• #3324 bug: hardened YAML loader raises RecursionError / ReaderError outside its named-error contract, giving a 500 on deploy_system
• #3325 bug: credential envelope and secret-setting errors have the wrong type — malformed archive gives a 500, bad value reported as a missing encryption key
• #3385 bug: operator_queue.type is unbounded at ingest and at the DB sink
• #3404 bug(security): a delegate-minted session can self-approve gated skills with the audit blind to it (is_person fails open)
• #3434 refactor: remove API routes nothing calls — five unauthenticated internal routes, two duplicate activity routes — and the orphan observability store
• #3435 refactor: hide the three credential-migration MCP tools from agent sessions that can never call them, and say who may
• #3510 bug: agent startup auto-import of .credentials.enc calls a backend route that does not exist, so it always fails silently
• #3644 chore(a2a): refresh the AAuth prototype branch feature/623-aauth-agent-identity onto current dev (394 behind, 7 conflicting files) so PR #2956 builds again
• #3676 bug: email-login endpoints return 500 on a malformed body (unauthenticated /api/auth/email/request and /verify)
• #3751 bug: bearer A2A tasks/get reads any execution on an agent the principal can access, not only the tasks it started
• #3769 bug(sanitizer): URL-credential redaction swallows JSON across keys — an AAuth resource's identity reply reaches the agent as ***

Private tracker (trinity-enterprise):

• ent#164 Self-change grants: an agent changes its own schedules, instructions or other agents only if a person granted it
• ent#279 feat: system credential vault — agents fetch granted credentials on demand via MCP (pluggable 1Password/external backend)
• ent#345 security: guardrail hook registration lives in agent-writable, git-synced ~/.claude/settings.json — an agent can disable its own guardrails
• ent#467 security: /ws broadcasts fleet-wide agent_activity (execution ids, agent names) to any authenticated user — scope by accessible_agents
• ent#500 Assignments: who fills which role and which agent serves which human — agent_assignments (user × agent × role × kind) injected into execution context
• ent#549 Workspace shared files are for the person the turn was for: one file-audience rule across chat and channels
• ent#580 feat(onboarding): first-run admin claim on marketplace installs — the operator sets the admin in the browser, not the droplet console
• ent#596 Only designated agents may change another agent's skills — the MCP skill-assignment tools have no such gate
• ent#606 Governance decision: who is responsible for an approval — instance operator, the agent's manager, or the served user
• ent#611 Decision requests are platform-native: agents ask over MCP, gated actions raise their own items, the operator-queue file becomes a compatibility path
• ent#614 bug(audit): actor attribution on chat/task/fan-out trusts the raw X-Source-Agent header from human principals — a permitted user can attribute their action to an agent in the SEC-001 audit log
• ent#615 security: the fleet PAT is readable inside every agent container — embedded in remote.origin.url and exposed in git child argv on every sync-health fetch
• ent#623 Prototype: cross-instance agent-to-agent authentication with AAuth agent identity (agent-identity-only mode) — demo by 2026-09-18
• ent#628 bug(security): run_agent_loop skips checkAgentAccess — an agent-scoped key can start a loop on any same-owner agent without a permission edge
• ent#629 agent-scoped MCP keys are owner-equivalent on the raw backend chat/task/fan-out/loops/A2A routes — agent_permissions is enforceable only at the MCP layer
• ent#662 An agent-permissions edge exposes every library-assigned skill on the callee — assigning a skill to A silently widens what every caller of A may run
• ent#711 An agent's own API key can rebind its owner's sign-in email (PUT /api/users/me/email has no principal gate)
• ent#712 security: GET /api/mcp/keys returns every user's key inventory to an agent-scoped principal — the one sibling in mcp_keys.py without reject_agent_principal (#1854)
• ent#713 security: GET /api/events applies no ownership scoping — any authenticated user reads every agent's event payloads (CWE-862)
• ent#715 security: operator-queue reads return person emails to agent-scoped keys
• ent#718 An agent's own key can have a user-scoped MCP key created for its owner — POST /api/mcp/keys (scope=user) and ensure-default have no principal gate
• ent#720 Sign-in email binding: residual doors after #711 — unclaimed-address binding, no unique constraint, unverified bind
• ent#739 bug(permissions): withdrawing an agent_permissions edge does not withdraw the access it granted — shared-folder mounts and live event subscriptions survive it
• ent#751 Gated skills: a skill marked 'requires approval by role X' raises the approval before the agent ever sees the request
• ent#752 Gated skills, the bypass lane: a pre-execution hook refuses a gated skill without a platform approval token
• ent#753 Approval map in Trinity: per agent × skill, which role approves — set in the UI, over API/MCP, or applied from canon
• ent#787 bug: GUARD-002 guardrail hooks can be neutralised from the agent's own workspace (shell-form registration, no -I)
• ent#792 File routes: a //-prefixed path skips the deny-list and the capability fences
• ent#811 Assignments: an agent can hold a seat itself; role optional per row and clearable; a trigger-free resolver answers the seat an agent holds or serves
• ent#816 An ask addressed to a multi-person role gets no Workspace addressee and renders in nobody's Inbox, while the receipt reports resolved: true
• ent#819 security: agent file download/preview sit at the accessor tier with no read deny-list — a chat-shared user reads .env and the agent's Trinity MCP key (CWE-863)
• ent#820 security: the whole agent Files surface is accessor-tier — rule the tier per verb, one path-policy source (the "owner-only files router" belief is wrong)
• ent#823 File routes: ~/.claude.json and .claude/.credentials.json are on no write-deny list
• ent#837 Workspace-only access: platform role user means Workspace-only; sharing stops creating platform accounts (ruled 2026-10-07, no new role)
• ent#839 security: a sibling agent's key records and reads seat decisions for another agent's seat — the one agent-callable module without the self-gate (CWE-863)
• ent#844 Operator-queue backlog-cleanup sweep cancels pending approvals by age alone, erasing audit trail for bypassed approvals
• ent#848 Gate approvers by canon role: role-id resolver, picker and labels (ent#754 AC5 follow-up)
• ent#849 SSO: 'Keep email / admin password login available' is never enforced — make it control user email-code login, keep admin break-glass
• ent#857 File read routes return any path in an agent's home, credential files included, at accessor tier
• ent#858 /ws/events does not refuse a suspended account's key
• ent#860 Rooms: a revoked share can still wake the agent in an existing room (platform principals)
• ent#866 security: a client the agent is shared with reads every rating alert — with the other raters' emails — through the operator queue
• ent#872 security: fleet-level routes still answer an agent key with its owner's reach — other agents' task text and emails, and two writes (follow-up to #629)
• ent#878 AAuth person-token binding — an agent acts for its owner through the Hellō person server (person.hello.coop): bind once by link + code, hold one person token per resource
• ent#879 AAuth outbound resource client + call_aauth_resource tool — an agent calls an external AAuth resource (Senzing sanctions screening) through the full challenge ladder; demo harness steps 7–8
• ent#882 security(executions): terminal completed_at accepts an agent-backdated past value — retention self-erase (#3629 follow-up)
• ent#885 Drop the keyless trusted-network A2A path before 1.0 (every inbound A2A call needs a credential)
• ent#886 security: the resume turn hands the agent the responder's email — every other return path withholds it (ent#715 class)
• ent#903 Enterprise A2A and SSO configuration writes leave no audit row (the #883 class)
• ent#928 AAuth resource calls: support four-party resources (resource token aud = access server) — Senzing refuses three-party

Refactors

• #1482 refactor(db): reduce database.py facade signature width — param objects for execution/chat writers
• #1925 refactor: adopt OverflowTabs for hand-rolled tab/nav strips (design-system p9/p10)
• #2918 Safety-critical UI logic keeps landing in the one tier with no executable coverage — and the stated reason is false
• #2945 ci: tiered validation — PR gate shrinks to Tier 1, dev carries Tier 2 per push and Tier 3 nightly; merge train gates on Tier 1 and treats Alembic forks as mechanical
• #3123 chore(skills): bump the bundled community-catalog pin to trinity-skills v0.3.0 (lockstep with the library release)
• #3430 chore(skills): bump the bundled community-catalog pin to trinity-skills v0.5.0 (lockstep with the library release)
• #3432 refactor: remove the process-schedule remnant from the scheduler (tables created at boot, polled every sync, execute path posts to a route that no longer exists)
• #3433 refactor: remove about 50 backend and scheduler symbols that no production code references

Private tracker (trinity-enterprise):

• ent#801 Positioning (ADR-0011): clean the runtime system prompts — platform instructions header, meta-prompt copy, system-agent seed, ask_trinity, instance custom prompt

Documentation

• #2885 docs(readme): star-the-repo asks at the three highest-goodwill moments — README top, end of Quick Start, and the start.sh next-steps card
• #3187 docs: recommended Trinity prompt page — research-backed fleet rules any instance can adopt
• #3200 docs: recommended Trinity prompt page misstates two evidence rows (scope direction, anti-deception reduction) and one conflict-rule attribution
• #3436 docs: record the agent-loop sweep and its idle cost — diagnosis found no code change is needed
• #3693 docs: Workspace Projects user guide — continuing work, the agent's role, the steward
• #3797 docs: compatible-agent guide has no recommended workspace layout — three zones (platform-owned paths, committed workspace, volume-only runtime)

Private tracker (trinity-enterprise):

• ent#797 Positioning (ADR-0011): OSS README, repo About, first-run UI, installer, marketplace listings and CLI onto the operating-system line
• ent#798 Positioning (ADR-0011): docs source — user-docs 'What is Trinity' + FAQ (feeds the docs site and ask_trinity)
• ent#799 Positioning (ADR-0011): docs site — merge trinity-docs#2, move the homepage hero H1, guard against sync overwrite
• ent#800 Positioning (ADR-0011): engineer context — CLAUDE.md, AGENTS.md, docs/memory, onboarding, template.yaml, trinity-dev

Other fixes (no type label)

• #3175 bug(codex): incidental 429 digits are classified as provider rate limits
• #3177 bug(sanitizer): Google desktop consent links are mistaken for sensitive assignments
• #3192 Gemini platform key is rejected because the AIza prefix check predates Google's new AQ. key format

Private tracker (trinity-enterprise):

• ent#588 PM standard: shared projects — project-init --canon mode, project-steward reads the charter wherever the epic points, PROJECT_STANDARD gains a Visibility section (project-init 1.2 · project-steward 1.3 · intake/task path resolution)
• ent#663 Pattern spec: the agent owner flips a companion calibrating → ready after the walkthrough — recorded on the role card, never by the agent (1.0 gate)
• ent#763 Verify NVM-001 against x402 v2 — header name and payments-py version

Delivered inside the enterprise module

2 further private-tracker items shipped inside the private enterprise submodule (pin 08cd4dd → 982735f, 31 commits). Per the open-core docs rule (trinity-enterprise#45), they are not enumerated here.

Other changes

• #3084 (PR, no tracker issue) Workspace "Things you can ask" holds still while the agent's skills load
• #3125 (PR, no tracker issue) the first-run seeder creates Cornelius again
• 12 dependency bumps (dependabot) on dev, plus 9 dependency bumps and README updates (1.0 refresh, AWS Marketplace button) reconciled from main
• Code-health dashboards, user-docs syncs (#3822, #3850) and the CSO report

Abilities Marketplace (ecosystem)

Updates to the abilities plugin
marketplace during this release window (2026-09-17 → 2026-10-20). Two PRs merged
(Abilityai/abilities#21, Abilityai/abilities#23); everything else landed as direct
commits and is referenced by short SHA. No marketplace releases were cut.

• agent-dev: the PM standard grows up. Shared projects live in a top-level canon
  projects/ zone (project-init --canon, charter envelope, lint rule, consume/reconcile
  modes; Abilityai/abilities#21, 93a8ff3, c00c040, 0f9db5a), and a project can track
  its tasks in its own folder (Abilityai/abilities#23, 83a6b37). One project-skill lineage
  with a §0-configured standard and project-status (agent-dev 1.21.0, 09e190f), and the
  project skills gain a platform mode that works against Trinity Projects when enabled
  (agent-dev 1.22.0, d826887). Also: add-canon-lint baseline ratchet (8ee9404),
  canon-publish 1.5/1.6 (3ff6c3b, b4e7ea4), controlled self-improvement in
  create-playbook 2.19 / adjust-playbook 1.13 (900e335), sync-fleet-to-head 1.5/1.7 and
  reconcile-skill-map in add-orchestrator (de6584d, e3491b5, 1538cda), and no bare
  dollar-digit in skill code (1.22.1/1.22.2, 97dc8a8, 716a45a).
• create-agent: custom 1.13 wizards declare business metrics and the scaffolded
  /update-dashboard records them (35aeabf); custom 1.16 adds a headless mode for builder
  agents (create-agent 2.2.0, af3165b).
• trinity: managed-hosting claims dropped — connect 1.6 / onboard 6.3 hand off to
  /trinity:deploy-new-instance (c9c71d5); onboard 6.5 and deploy-new-instance 1.7 carry
  the "operating system for the AI-native company" line (bb52c61).
• Marketplace-wide: platform-truth syncs to v0.9.5, dev and 1.0.0-rc1 — native and
  replaceable asks, role addressing, self-change grants, the live skill gate, the delegation
  contract, agent_busy vs rate_limited (3325e25, 16ea364, b140351, 2f954f5,
  8fa5826), and the positioning line across the marketplace (b36f67b).

⚠️ Behavior changes / upgrade notes

Rebuild or pull the platform images, then rebuild the agent base image and recreate agents

Agents on an older image keep working, but the operator-queue write protection and the
in-container skill-approval hook only take effect after the agent is recreated on the 1.0
image. Until then the Skills tab shows a gated skill as "not enforced".

Behaviour that changes by default

• Hosted compose now defaults to the bundled PostgreSQL (#3159). start.sh --hosted keeps
  an existing SQLite install on SQLite. If you run docker-compose.hosted.yml directly and your
  data is in trinity.db, add DATABASE_URL= (empty) to .env before upgrading, or migrate
  first (SQLITE_TO_POSTGRES.md). POSTGRES_PASSWORD is now
  required there. The PostgreSQL role must be allowed to CREATE EXTENSION pg_trgm.
• Platform role user is Workspace-only (ent#837). See
  WORKSPACE_ONLY_USER_ROLE_2026-10.md.
• Agents can no longer change skills by default. An admin grants "Change skills" per agent
  under Settings → Guardrails.
• An agent can no longer run another agent's library skills by default (ent#662). A
  permission between agents covers the skills the target declares itself; a library skill needs
  a grant per skill. Settings → Agents lists the calls from the last 30 days that are now refused,
  each with a Grant button.
• Every inbound A2A call needs a credential (ent#885). The trusted-network list now only
  limits where your agents may call out to.
• Delegated work reports back into the Slack, Telegram or Workspace conversation that asked
  for it. Turn off with MCP_REPORT_BACK_ENABLED=false.
• Telegram group context is on for existing groups (ent#600). Turn off per group in the
  agent's Telegram panel.
• Pull sync starts on auto-syncing agents — they also fetch and rebase on a timer.
• New default limits: inter-agent chain depth 8, event-triggered runs 120/hour per agent
  pair, pending asks marked aged after 24h, metric points kept 365 days (100,000 per agent per
  day). All adjustable via PUT /api/settings/ops/config (Settings → Ops).
• Re-login after the backend restarts and reconnect MCP clients.

Config keys whose behaviour changed

Every .env / docker-compose*.yml key whose meaning changed between v0.9.5 and v1.0.0 (#3763):

• DATABASE_URL (hosted compose) — unset now means the bundled PostgreSQL; previously unset meant SQLite. Set it empty (DATABASE_URL=) to stay on SQLite. Prod and dev compose are unchanged (unset → SQLite).
• POSTGRES_PASSWORD — required by docker-compose.hosted.yml (the file does not render without it); previously only with --profile postgres.
• ADMIN_PASSWORD_SOURCE — new value instance-id (AWS image): /setup also asks for the EC2 instance ID (#3004).
• TRINITY_INSTALL_SOURCE — new values aws-marketplace, do-script, aws-script.
• TRINITY_DEFAULT_SKILL_SOURCE_REF — default moves v0.2.0 → v0.5.0 (fresh installs only; existing installs keep their pin).
• OPERATOR_QUEUE_TITLE_MAX — still the truncate-with-marker cap, but agent-raised ask titles are now refused or held first at OPERATOR_QUEUE_ASK_TITLE_MAX_CHARS (120).

New keys (no prior meaning): AAUTH_ENABLED, AAUTH_PROTOTYPE_ENABLED, AAUTH_ISSUER,
AAUTH_PERSON_SERVER, AAUTH_RESOURCE_ALLOWLIST, MCP_REPORT_BACK_ENABLED, METRICS_RATE_LIMIT,
METRICS_READ_RATE_LIMIT, METRICS_RETENTION_DAYS, METRICS_DAILY_POINT_CAP,
OBJECTIVES_READ_RATE_LIMIT, INTER_AGENT_MAX_CHAIN_DEPTH, OPERATOR_QUEUE_MAX_OPTIONS,
OPERATOR_QUEUE_OPTION_MAX_CHARS, OPERATOR_QUEUE_ASK_TITLE_MAX_CHARS,
OPERATOR_QUEUE_PROPOSAL_MAX_BYTES, OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS,
OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS, NEVERMINED_MAX_INFLIGHT,
NEVERMINED_FACILITATOR_WAIT_SECONDS, TELEGRAM_GROUP_CONTEXT_MAX_MESSAGES,
TELEGRAM_GROUP_CONTEXT_MAX_AGE_HOURS, READINESS_CHECK_TIMEOUT. system_settings keys were
not swept mechanically this release.

Enterprise instances

Bump the enterprise submodule pin to the release's commit (982735f).

Known limitations

• Recreate agents on the 1.0 base image for the approval hook and operator-queue write protection (see above).
• Approvals have a single approver. Approval chains and edit-before-approve are not in 1.0.
• Self-change permissions govern the changes an agent makes through the platform (skills,
  schedules, instructions, other agents). Edits an agent makes to its own files inside its
  container are not gated in 1.0.
• Signed agent identity between instances ships switched off. Cross-instance A2A uses keys
  unless an admin enables AAuth; person tokens and resource calls are prototypes behind a second switch.
• Pull dispatch is an opt-in pilot per agent; push dispatch remains the default.
• Sharing an agent gives that person full access to the agent's files. Share only with people you trust.
• DigitalOcean 1-Click can be deployed on plans below the 4 GB / 2 vCPU minimum — choose at
  least that size (#3009).
• Workspace: a background run's card in the Work panel cuts off long outcomes (#3523);
  "Bind to this repo" stays disabled while the saved personal GitHub token is in use — bind via
  the API meanwhile (#3546).
• The Workspace Inbox ships six of eight planned pieces; room events in Unread and
  queued/running item state follow (ent#610 stays open).
• Post-rc4 payload: the release is cut from the dev tip, which carries ~80 commits after
  rc4 (agent header and Settings home, ent#662 skill grants, late security fixes). Those are
  covered by CI and the dev-instance deploy, not by an RC test pass.

Contributors

@dolho, @trinity-ability, @vybe, @obasilakis, @AndriiPasternak31, @webmixgamer, @alex-furman,
@pavshulin, @developerjillur, @harimaruthachalam, @Suraj370, @oleksandr-korin — plus dependabot.