v0.0.10

Highlights

• Gate filter and pre-push gates. A gate that sets filter: true in .bellows.yaml accepts an ad-hoc {"gate","filter"} call; the filter reaches the command only as env GATE_FILTER, for that one run, and never counts as evidence. The master prompt now requires the covering gates before every push (#1041).
• Token accounting by type, task, run, user, day, model and source (#842).
• No-change tasks skip close-time gates (#1037).
• Runner uid seam fixed: files shared between the CLI uid and the tool uid within bounds, skill helpers installed outside the private config dir, gate pair minted before the group and a commit identity for the agent (#1007, #1016–#1018, #1021, #1023, #1024).
• Executor images ship python3 and procps; opencode ships ripgrep instead of downloading it at runtime (#1022).

Fixes

• #1010 runner token requests actions:read; a 422 names the missing App permissions.
• #1019 a job whose executor its scope does not hold is refused at create.
• #1020 a jest per-test timeout gate failure is classified as environment.
• #1039 claude-executor image checks match the entrypoint and run as a test:jobs phase.
• Driver git helpers hardened against agent-written checkout config.

Upgrade notes

• Migrations 085_job_execution.sql, 086_metric_point_identity.sql and the repeatable views apply on boot.
• The GitHub App should grant Actions: read; without it the board names the missing permission on a 422.
• No chart value or env var changes.

Validation

• Full suite on a93502d: npm test 9221 passed, test:db, helm, test:jobs 379/0, kind --cluster 544/0, verify:ui 101/101.
• v0.0.10-rc-2 (same code) ran on a staging deployment, migrating from v0.0.9-rc-4 data.

Known limits

• No lane drives a filtered ad-hoc gate call end to end; integration tests cover it.