Merced AI 0.8.0

merced-ai 0.8.0

Release notes, September 28, 2026. The full list of changes is in the
changelog.

Highlights

• Harness adapter plugins. Every built-in adapter is now a HarnessSpec, and installed
  packages can add adapters through the merced_ai.harnesses entry-point group. A contract-test kit
  (merced_ai.testing.contract) checks third-party adapters. See plugins.
• Agent Client Protocol. Claude Code, Gemini CLI, Goose, and OpenCode run as ACP agents when
  their launchers are installed: replies stream, permission requests go through the AAIS approval
  dialog or a terminal prompt, and three of the four resume their own sessions. merced-ai acp
  serves a bot or a room to editors such as Zed.
• Worktree rooms. group ask/chat --worktrees gives each write-capable bot its own git
  worktree, with group diff, group apply, and group cleanup (and matching web UI views).
  Without worktrees, write-capable bots sharing a workspace now take turns.
• Cross-harness evals. merced-ai eval run sends one profile and prompt to several harnesses,
  scores deterministic checks first, and reports an optional judge separately. See
  evals.
• Reviewed OAP state inbox. State deltas are validated on arrival and applied only after
  approval. See inbox.
• Terminal approvals. When MagAgent, Loro, or an ACP agent asks for approval during ask,
  chat, or a group command, the CLI shows the request and takes one key; Deny is the default.
  Before this, those requests were denied silently on the command line.
• Prompts off the command line. Most harnesses now read the prompt from stdin or a private
  file, so long conversations no longer fail with E2BIG or a Windows command-line limit.
• Experimental A2A endpoint on the UI server. See serving.
• Web UI first run. A guide lists every detected harness with its state, offers a starter
  bot, keeps drafts typed before a bot exists, and explains a missing or stale token. Fonts are
  self-hosted.

Behavior changes

• merced-ai ui defaults to port 8773 (was 8765, which collided with loro web). Update
  bookmarks and A2A client configuration that assumed 8765.
• Requires agent-approval-interchange>=0.2.0,<0.3. Approval-presenter and run-record owners are
  recorded as aais.liveness owner identities; existing files are read and upgraded in place.
• Harness descriptors report harness_supports and broker_implements separately, and only
  broker-implemented capabilities are shown as supported. Probe JSON keeps a deprecated
  capabilities field for this release.
• Projection reports list every profile section a prompt-context projection drops.
• A security self-review of the new surfaces (see threat model) led to fixes for
  worktree path trust, symlinks in applied patches, plugins loaded from the working directory, DNS
  rebinding and request size limits on the UI server, and approval labels chosen by the harness.

MagAgent and Loro compatibility

Merced AI 0.8.0 works with earlier MagAgent and Loro releases and uses newer features when the
installed version has them. Features are detected from each harness's own help and version output.

Harness	With this version or later	Older versions
MagAgent 1.4.0	Prompt through a private file (ask --prompt-file); shell: ask asks for every command and shell: deny removes the shell tools (reported as mapped)	Prompt as an argument, subject to the size guard; shell is narrowed
Loro 0.22.0	Prompt through a private file (run --prompt-file) and run --json output	Prompt as an argument, subject to the size guard

A development build of MagAgent that still reports 1.3.x is treated as 1.3.

Upgrading

Back up .merced-ai before upgrading. Conversation, run, and presenter files from 0.7.0 load
without manual steps: 0.7.0 run journals are converted to the append-only JSON Lines format and
bare-PID owners are upgraded on first use. AGS, OAP, and AAIS document and wire formats are
unchanged; conformance results are in docs/oap-conformance.json and docs/ags-conformance.json.

Merced AI 0.7.0

merced-ai 0.7.0

Release notes — September 12, 2026.

• Conversation appends are transactional, carry stable turn IDs, and preserve concurrent accepted responses. Stale full-record saves fail with an explicit conflict; deleted conversations cannot be silently recreated by stale clients.
• The broker owns runs independently of HTTP streams, journals bounded replay events, supports reconnect by run ID and sequence, and marks abandoned owner records interrupted on startup.
• Cancellation and timeout stop owned process groups on POSIX and request tree termination on Windows. Incremental stdout/stderr capture is bounded, including an independent bounded AAIS control-frame path.
• Session profile spec digests are checked before dispatch in group and resumed CLI conversations. Replies record the actual profile revision and digests; state-only changes do not trigger authority drift.
• The approval presenter restores live requests, keeps idempotent decisions and authority receipts, and distinguishes orphaned requests during recovery.
• Required WebMCP routes use installed native capability negotiation; unknown/old installations fail conservatively. Authenticated registry and final policy checks remain in each harness.
• The browser reconnects to an owned run, restores saved run observation after reload, uses truthful completion status, and wraps header controls to avoid inspector overlap.

Existing conversation files load without a rewrite. Back up .merced-ai before upgrading; keep that backup for rollback to 0.6.0. A server restart marks abandoned work interrupted and never automatically repeats a possibly mutating action.

AGS, OAP and AAIS document/wire formats remain unchanged. Local validation evidence and remaining platform gates are recorded in the ecosystem release report.

Recovery ownership checks use a non-destructive Windows process query, with a regression test that verifies live child processes survive inspection.

Merced AI 0.6.0

Merced AI 0.6.0

Release candidate prepared on 2026-09-06.

Merced AI now models WebMCP as an explicit harness capability. A bot can require WebMCP in its
portable binding, and routing will select only a native MagAgent or Loro adapter that satisfies the
requirement. The CLI and local Web UI show capability readiness and preserve the requirement when
bot bindings are created, loaded, or edited.

Merced AI remains a broker: live page discovery, browser credentials, exact-origin policy,
registry-revision checks, user approval, and audit records stay within the selected harness. This
keeps the trust boundary clear and avoids duplicating browser authority in the broker.

Validation

• Complete Python suite: 107 passed, 3 skipped, with 78.99% coverage against a 70% gate.
• Bot persistence, capability inventory, routing, Web API, and browser UI regression coverage.
• Ruff lint and formatting gates.
• Wheel and source archive build with Twine metadata validation.

See WebMCP routing for configuration and fallback behavior.

Merced AI 0.5.1

Merced AI 0.5.1

Released on 2026-08-31.

Merced AI can now present AAIS 1.0 exact-action requests from MagAgent and Loro in its Web UI and
return digest-bound decisions over a dedicated bidirectional process channel. Policy remains owned
by the selected child harness; Merced AI persists only the pending presentation state.

Validation

• Complete Python suite: 106 passed, 3 skipped, with 78.87% coverage against a 70% gate.
• AAIS relay, persistence, idempotency, Web API, and accessibility regression coverage.
• Wheel and source archive build with Twine metadata validation.

Merced AI 0.5.0

Merced AI 0.5.0

Merced AI 0.5.0 completes profile and bot lifecycle management and adds portable, prompt-driven OAP
profile authoring. Users can generate a reviewed profile from the CLI or UI and choose project,
native-user, or universal ~/.agentprofiles storage. Autonomous harness work emits a proposal
unless policy explicitly permits activation.

The release also replaces error-prone provider and model fields with discovered choices, improves
generation progress and source labeling, and retains the broker's loopback, token, origin, path,
credential, and subprocess authority boundaries.

Validation covers the complete Python suite, static UI syntax and API behavior, coverage threshold,
package build, Twine checks, and a clean installed-wheel smoke test.

Merced AI 0.4.0

Merced AI 0.4.0

Merced AI 0.4.0 closes the local collaboration UI's workspace-context and run-observability gaps
while retaining the broker's deliberately small authority boundary.

Highlights

• Select up to twenty project files or bounded browser uploads as explicit context for a run.
  Text-like files are inlined within per-file and aggregate budgets; large, binary, and image files
  are stored beneath .merced-ai/attachments/ and sent as confined workspace references.
• Inspect durable run records independently of conversation transcripts, including participants,
  context manifests, normalized events, elapsed time, completion state, and partial failures.
• Opt into browser completion notifications and copy a shell-quoted handoff command for the active
  harness and workspace.
• Preserve loopback/token/origin protections and add traversal, internal-state, upload-size,
  inline-context, and run-record durability coverage.

Validation

The Python formatting, lint, test, and coverage gate passes. Static UI behavior is covered by asset
and live API tests, and the wheel/source distributions pass Twine metadata validation. The browser
context surface does not bypass the selected harness's own sandbox, permissions, credentials, or
approval model.

Merced-AI 0.3.0

Merced AI 0.3.0

Merced AI 0.3.0 aligns its specification integrations with the published OAP and AGS 1.0.1 Python
support libraries.

Highlights

• OAP 1.0 Level 1 broker evidence pinned to upstream commit
  7fb633a1a59dd7636ffb0030d254f2f58934f74a.
• AGS 1.0 Level 0 validation and deterministic read-only planning pinned to upstream commit
  f180a4dbd07911f90dd0821f531d7ccd51bb0764.
• Dynamic CI coverage for every upstream valid example and invalid fixture.
• Graph digests, dependency ordering, reachability, worst-case work, cost/tier summaries, and
  explicit unsupported-feature reporting.
• OAP trust assignment and discovery-collision reporting remain derived from local roots rather
  than profile-authored metadata.
• The profile management UI now surfaces those trust and collision warnings instead of leaving
  them visible only in API responses.

Boundaries

Merced AI remains a broker. It does not execute AGS graphs or claim AGS Levels 1–3, and it does not
replace a selected harness's effective permission, sandbox, credential, or approval enforcement.
The conformance files describe Merced AI's own parser, projection, and planning behavior.

Upgrade

python -m pip install --upgrade "merced-ai==0.3.0"
merced-ai --version
merced-ai harness list

See Agentic Graphs, oap-conformance.json, and
ags-conformance.json for the exact specification boundary.

merced-ai 0.2.0

Merced AI 0.2.0 release notes

Merced AI 0.2.0 turns the original harness broker into a practical local collaboration workspace.
It adds durable multi-bot conversations and a complete optional web UI while preserving the core
boundary: installed harnesses continue to own model access, tools, credentials, sandboxing, and
final policy enforcement.

Highlights

• Durable group sessions with ordered participants and attributed assistant turns.
• Exact @mention, ask-everyone, named-recipient, and round-robin dispatch from the CLI, API, and
  browser UI.
• Concurrent isolated fan-out with progressive per-bot status, deterministic persistence order,
  partial-failure containment, shared cancellation, and exact failed-bot retry.
• A functional loopback-only web workspace for profiles, bot bindings, single and group chats,
  routing, approvals, transcript search/resume/export, and harness-health inspection.
• Searchable ordered group setup, conversation naming and derivation, stable bot identities,
  mention completion, responsive mobile controls, and refreshed desktop/mobile documentation.
• OAP profile editing with revision-safe preservation of unedited fields, provider/model selection,
  and explicit edit/shell permission requests.
• Hardened fragment-token exchange, HTTP-only SameSite cookies, origin checks, CSP, framing and
  referrer protections, cache prevention, and loopback-only binding for the local UI.
• Immediate workspace bootstrap with cached harness health, progressive background detection,
  per-harness detecting/ready/failure states, and explicit refresh controls.

Compatibility and validation

• Python 3.11 through 3.14 are exercised across Ubuntu, macOS, and Windows.
• The automated suite contains 66 tests: 65 local tests pass with 79.65% branch-aware coverage and
  one dedicated Chromium test validates the real desktop/mobile collaboration workflow.
• Chromium CI publishes current UI screenshots and preserves failure captures as an artifact.
• Wheel and source distributions pass build and Twine metadata checks.
• The existing fourteen-harness qualification matrix remains unchanged; group orchestration uses
  the same qualified adapter boundary and deterministic fake adapters for paid-provider-free tests.

See MVP validation, group conversations, and the
UI guide for detailed evidence and runtime boundaries.

Upgrade notes

• Existing one-bot session JSON remains readable. New group fields have backward-compatible
  defaults.
• Existing OAP profiles and bot bindings require no migration.
• The browser UI remains optional: install merced-ai[webui] before running merced-ai ui.
• Approval prompts describe requested authority, but the selected harness remains authoritative.
• Token-level streaming, interactive harness approval forwarding, universal native-session resume,
  and OAP Level 2 writeback remain future work.

Merced AI 0.1.0

Merced AI 0.1.0 release notes

Merced AI 0.1.0 introduces a local-first OAP broker for collaborating through agent harnesses that
are already installed and authenticated. Merced provides portable profiles, bot bindings, session
records, a normalized CLI, and an optional loopback web UI while leaving model access, tools,
approvals, and sandbox enforcement with the selected harness.

Highlights

• Discovery and executable adapters for Codex, Claude Code, Gemini CLI, OpenCode, Goose, Loro,
  MagAgent, Anton, DSH, AGY, Pi, Prime Agent, OpenClaw, and Kimi Code CLI.
• OAP validation, portable profile discovery, profile/spec digests, and explicit projection reports.
• Project and user bot bindings with conservative availability-only fallback.
• One-shot asks, interactive chat, durable normalized sessions, JSON automation, and local UI.
• Multi-provider DSH routing and configurable Kimi provider files without storing keys in Merced.
• Bounded shell-free child execution, timeout/cancellation handling, output limits, and structured
  failure normalization.
• Cross-platform detection overrides and bounded Linux, macOS, and Windows installer locations.

Qualification

All fourteen installed harnesses returned unique exact-token responses through Merced AI in a
disposable workspace. The automated suite contains 46 tests with 75.27% branch-aware coverage. The
wheel and source distribution pass Twine checks, and a clean wheel installation independently
discovered all fourteen local harnesses.

See MVP validation for provider/model details and the Anton atomic-turn safety
finding.

Important boundaries

• Merced AI is not a sandbox and does not supersede harness policy.
• installed inventory status does not verify authentication or model availability.
• Capability declarations are provisional until runtime handshakes are implemented.
• ACP streaming, normalized tool/approval events, native-session resume parity, and OAP Level 2
  writeback are planned beyond the MVP.
• Native OAP schema differences can still require translation, particularly richer permission
  documents consumed directly by older MagAgent releases.

Before publishing

The repository and package are release-ready locally. Maintainers must still choose the final
version/tag, run the configured cross-platform CI on the public remote, publish artifacts, and
perform the post-PyPI clean-install checks in the release guide.