CodeConvoy v0.9.0

CodeConvoy 0.9.0 — History & Reliability

Changes since 0.8.0

This release adds configurable history retention, Markdown and JSON exports,
storage measurement and explicit managed-worktree cleanup. Large histories save
and navigate faster, with stronger recovery checks and clear feedback when saving
temporarily blocks an action. Existing settings and history remain compatible;
automatic retention is disabled by default.

History Retention & Cleanup

• Optional count and age limits in Settings → History Retention. Unlimited history
  and disabled automatic retention are the defaults, including existing settings.
  Removes the previous implicit 30-entry cap without changing the state version.
• Manual Clean Up History preview uses stable IDs and rechecks protection/policy
  before confirmation. Changed previews require confirmation again.
• Opt-in automatic retention runs once after startup loading, with no polling,
  repeated cleanup attempts or writes when no entries qualify.
• Newest means actual completion time, then convoy ID; both constraints apply.
  Missing/inconsistent/future dates remain outside retention limits.
• Remove, Clear and retention share protected deletion and background atomic saves.
  Failed saves retain live history; successful saves safely update selection.
• Runtime worker/lifecycle ownership, active validation and retained worktree
  evidence remain protected even when visible agent status is terminal. History
  removal never cleans worktrees or changes repository/validation configuration.

See history usage and validation evidence.

History Export

• Export one terminal convoy or selected/filtered/all retained history to one
  Markdown or JSON file. Existing single-convoy selection and history filters are
  reused; active convoys are excluded.
• Shared Copy Summary Markdown formatter and independent JSON schema version 1.
  Saved completion observations, unknown values, validation and review resolution
  remain distinct; current Git and live Review are never consulted.
• Metadata-only confirmation snapshots survive later history/filter changes and
  cleanup. No logs, diffs, attachments, environment or internal ownership metadata.
  Bounded task/name/command fields follow the existing Copy Results privacy policy.
• Native save dialog, explicit overwrite review, cancellable background formatting
  and temporary-file publication, with concise completion/error feedback.
• Deterministic model, file-failure, privacy and headless egui interaction tests.
  No new dependencies, persistence schema, backend or scheduler changes.

See export formats and privacy and
export validation.

Storage Overview

• Settings → Storage… shows persisted historical convoy count, actual shared
  state-file bytes, managed worktree count/sizes, original locations and current
  base, unavailable entries, per-category successful times and partial totals.
• Read-only ownership inventory reuses manifests, saved/live references and exact
  custom-location bindings, including previous bases and known orphan attempts.
  Duplicate references are counted once; incomplete ownership stays explicit.
• Logical regular-file sizes include generated output. Links/reparse targets,
  external Git administration, exports and unrelated data are excluded. Unix hard
  links are deduplicated within each checkout; physical allocation is not claimed.
• Cancellable background scans, coalesced manual refresh, stale-result rejection,
  bounded diagnostics and a compact, scrollable keyboard-accessible view.
• Storage measurement remains read-only and does not trigger cleanup or retention.
  Ownership and Git checks for explicit cleanup remain a separate operation.

See measurement semantics and
storage validation.

Stale Worktree Detection & Safe Cleanup

• Storage Overview now inspects managed lifecycle, ownership, Git registration,
  current changes and cleanup eligibility, including recorded older locations.
• Explicit selection and exact-path confirmation; active, unresolved/retained,
  modified, ignored, missing, orphaned and unverified copies remain protected.
  Completed or clean alone never authorizes removal.
• Independent final checks per target under existing Store transactions and
  execution/validation leases. The new ordinary action unlocks only verified
  ownership and uses non-force Git removal, with no prune or recursive fallback.
• Bulk progress and Removed/Skipped/Failed outcomes, preserved history and
  validation evidence, invalidated size measurements and post-batch refresh.
• Journaled failures preserve evidence; normal quit finishes the in-flight
  critical operation and skips remaining targets. No automatic cleanup or Force
  Delete. Windows removal is disabled pending stable filesystem identity support.
• Disposable-Git safety tests, failure injection and keyboard confirmation tests.
  Existing result Discard semantics and dependencies are unchanged.

See worktree cleanup and validation.

History Performance & Reliability

• Buffered atomic state writes remove the measured long-save bottleneck. Periodic
  and recovery saves run on a worker using the existing single-writer reservation;
  acknowledgement preserves edits and validation events received during saving.
  Normal quit and fallback native exit wait for that writer before the final save
  of interrupted jobs and validations.
• Start, result actions, validation and cleanup controls show when saving blocks
  them. Existing review acknowledgements and removal confirmations are preserved;
  completing a save never launches or confirms an action automatically.
• Persistence snapshots omit session-only logs, diagnostics and Review caches,
  while retaining every serialized field and ownership protection. No stored
  history, validation metadata or task text is truncated.
• Virtualized history rows preserve order, stable selection, current summaries,
  keyboard focus and Arrow/Home/End navigation. Empty search avoids allocating
  lowercase copies of every task; there is no new presentation cache.
• Failed loads disable writes through that Store. Missing core envelope fields,
  malformed records, duplicate IDs and unsupported versions preserve the original
  file and report errors. Legacy optional fields retain their defaults; lagging
  counters advance past retained IDs and exhausted counters cannot launch.
• Export publication also syncs its directory on Unix and reports uncertainty
  if that sync fails. JSON schema, Markdown formatting, cancellation, retention,
  scan generations and conservative worktree cleanup semantics are unchanged.
• Deterministic 100/1,000/5,000-convoy fixtures, repeatable performance checks,
  persistence failure injection and save/selection/shutdown regressions.
  No new dependencies, state schema, backend or scheduler changes.

On the recorded Linux benchmark with 5,000 convoys, median atomic save time fell
from 768.2 to 26.6 ms and open-history selector layout from 13.2 to 0.31 ms.
Stricter load validation increased load time from 25.9 to 35.6 ms. These are local
measurements, not guarantees for other machines or filesystems; explicit durable
intent and final saves can still pause on slow storage.

See measurements, audit and release-candidate checks.

CodeConvoy v0.8.0

CodeConvoy 0.8.0 — Workflow & Productivity

Changes since 0.7.0

This release adds reusable validation command presets, bulk validation setup,
keyboard shortcuts, Markdown result copying and quick repository filtering.

Validation Presets & Bulk Assignment

• Nine built-in command templates: npm Lint, Rust Tests, Rust Check,
  Rust Clippy, npm Test, npm Build, Python pytest, CMake Build and Make Test.
• Single-repository Preset/Custom selection fills the existing executable and
  literal JSON argument fields. Commands remain editable, with a readable preview;
  only Save changes configuration. Reopening preserves existing custom commands.
• Assign Validation Preset… selects repositories or multiple overlapping groups
  independently of convoy selection. Canonical paths deduplicate targets; group
  membership stays unchanged. Review shows target and existing-command counts.
• Preserve existing commands by default. Explicit overwrite requires a separate
  confirmation with Cancel focused. Updated, preserved and failed targets are
  reported individually, including removed registrations and stale overwrite reviews.
• Stage eligible updates and persist them with one atomic state replacement.
  Failed saves keep live settings unchanged and report unconfirmed disk outcomes.
  Existing command serialization and state version stay unchanged; no migration,
  preset IDs in saved settings, dependencies or additional validation backends.
• Configuration never executes commands or agents, inspects Git, creates worktrees,
  changes scheduling or rewrites saved validation execution records. One command
  per repository remains the rule; multiple checks belong in project-owned scripts.

See validation usage and
preset validation evidence.

Keyboard Shortcuts

• Ctrl/Cmd+Enter uses the Run Convoy button's shared action and existing preflight
  review. Readiness checks, dirty-tree acknowledgment and explicit Start remain
  in place. Held keys and repeated layout passes do not repeat dispatch.
• Ctrl/Cmd+F focuses and selects the existing repository filter text when the
  filter is available. Escape leaves focus without changing query, selection or
  group expansion; history search is unaffected.
• Ctrl/Cmd+1–4 select Activity, Diff, Raw Output and Task & Settings for the
  selected convoy using the existing tab state and cached views.
• Text editors retain Run/view key events; dialogs and menus take precedence.
  Modified Enter cannot accidentally activate a focused confirmation button.
  Escape uses each modal's existing safe dismissal, only for the topmost dialog.
• Compact Settings → Keyboard Shortcuts… reference uses egui's platform
  labels. No hotkey dependency, global hooks, settings schema or execution and
  scheduling changes.

See keyboard shortcut validation for checks
and platform coverage.

Copy Results

• Copy Summary for terminal/historical convoys and Copy Repository Result
  in the existing job details copy concise Markdown via egui's system clipboard.
  Both actions support keyboard navigation and brief inline copy feedback.
• Saved execution metadata, UTC timestamps, durations, completion observations,
  review status and latest validation records remain distinct. The convoy table
  keeps original repository order, independent of view filters.
• Missing historical changes stay Unknown; partial counts are labelled “known”.
  Missing validation says “Not run / not recorded”, without consulting today's
  mutable configuration. Copy never invokes Git or reads live review statistics.
• Bounded, escaped task/name/command metadata; no automatic logs, diffs,
  environments, attachments or local path metadata. Recognizable local paths in
  free text are omitted. Review copied text for sensitive content before sharing.
• Pure formatting tests and headless egui clipboard/keyboard coverage; no new
  dependency, persistence field, execution behavior or export screen.

See copy-results validation.

Quick Repository Filter

• Find registered repositories immediately by name or path with case-insensitive
  substring matching using full Unicode case folding (for example,
  Straße/STRASSE); surrounding query whitespace is ignored.
• Matching groups open temporarily, retain their order and shared selection,
  and show only matching repositories. Ungrouped stays first when it has matches.
• Clear restores manual expansion. Hidden selections remain selected; global
  and group selection controls retain their full-membership behavior.
• Compact empty state and keyboard-accessible filter/Clear controls, using native
  egui styling. The overall selected count remains visible.
• Session-only cached matching; no search dependency, filesystem/Git work, new
  persistent settings, backend changes or scheduling changes.
• The small unicase text utility supplies Unicode folding without transitive
  dependencies or application-maintained character tables.

See filter validation for automated coverage
and native smoke results.

Maintenance

• Update serde_json to 1.0.152.
• Update GitHub Pages actions and use Python 3.15 in CI and release packaging.

CodeConvoy v0.7.0

CodeConvoy 0.7.0 — Validation & Confidence

Adds optional per-repository validation with configurable commands, manual Run/Cancel controls,
live output, and persisted results. Validation runs safely in the correct Direct or isolated worktree,
supports cancellation, and respects existing repository locks. Agent outcomes, Git state,
and validation results remain independent. Fully backward-compatible, with no automatic actions,
new dependencies, or architectural changes.

Changes since 0.6.0

• Optional per-repository validation configuration: executable plus literal
  arguments, edit/remove, persisted in the existing state file. Disabled by default.
• Explicit Run Validation and Cancel Validation in repository result details,
  a separate Validation output tab, and compact comparison indicators.
• Correct original Direct/isolated directory targeting with identity and ownership
  checks; unavailable historical worktrees never fall back to the source checkout.
• Responsive background execution with streamed bounded stdout/stderr, elapsed
  time, exit status, timestamp, process-tree cancellation and coordinated Quit.
• Latest validation command and execution metadata saved with the exact convoy/job.
  The latest 64 KiB of output and diagnostics stay in memory for the current session.
  Existing history remains compatible; interrupted validation never resumes.
• Agent outcomes, Git completion observations and result resolution stay independent.
  Saved passes describe past executions, and current Git views refresh after commands
  modify files. No automatic execution, staging, commits, push or approval.
• Existing repository leases coordinate validation, agents and result operations;
  unrelated convoys keep their normal concurrency and scheduling. No new scheduler,
  database, dependency, backend, pipeline or validation dashboard.

See validation usage and configuration and
architecture.

Validation and remaining platform work

Linux x86-64 source validation on 2026-10-10 with Rust 1.95 passed:

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features: 375 tests passed, four optional installed-CLI
  probes ignored (excluding duplicate subprocess-test reporting).
• python3 -m unittest discover -s packaging -p 'test_*.py': 16 passed.
• cargo build --locked --release
• git diff --check

Headless egui coverage includes all three requested sizes and System/Dark/Light
modes, keyboard configuration/Run/Cancel, Escape dismissal and active-validation
quit confirmation. A native Linux X11 debug build started with disposable state
and repositories; Review and the Validation tab were visually inspected at
1180 × 820, including the displayed command and original target path. Native
Run/Cancel/history interaction acceptance was not completed; automated X11 input
was not reliable in this desktop session. Process execution/cancellation and
history behavior are covered by the deterministic tests, not claimed as native
interaction acceptance.

macOS/Windows builds and native runtime checks, full Linux/Wayland interaction
smoke, native theme/size/keyboard coverage, and exact release-package checks remain
required. No tag, push or package publication is part of this implementation.

Known limits: historical passes are timestamped observations, not continuous
certificates. Commands execute with local user permissions and may modify files;
side effects are retained on failure/cancellation. Intentionally detached Unix
children can escape process groups. Windows batch launchers require a directly
configured native interpreter such as node.exe; CodeConvoy never inserts a shell.

CodeConvoy v0.6.0

CodeConvoy 0.6.0 — Desktop Workflow

CodeConvoy 0.6.0 brings three workflow improvements: an optional system tray
for running convoys while minimized, configurable storage for isolated worktrees,
and collapsible repository groups with shared selection and clear counts.

Changes since 0.5.0

• Optional native system tray with Show, running-convoy count, Show Active Convoys
  and safe Quit. Off by default; counts include queued and preparing convoys.
• Immediate, persisted close-window preference: Quit by default, or minimize with
  an operational tray. Jobs continue while minimized; Dock/taskbar access remains
  available for recovery. Missing/failed trays use the normal Quit workflow.
• Shared restore-before-focus handling for tray, notification and quit actions.
  Show retains the current view; Show Active opens the existing ACTIVE group.
• Native macOS Cmd+Q, application-menu and Dock Quit remain explicit Quit actions
  regardless of the close preference. Repeated requests share one confirmation
  and cancellation path. Cancel leaves jobs and notification listeners unaffected.
• Linux StatusNotifierItem support without GTK/AppIndicator system libraries or a
  required GNOME extension. Missing hosts fail once; watcher loss restores the
  window and disables tray minimization until explicitly re-enabled.
• Settings and run changes persist while the window is minimized. Existing v1
  settings (including 0.5.0) default safely to tray disabled and Quit behavior.
• Configurable Settings → Worktree location with a native directory picker,
  absolute custom base or the existing default. New convoys capture the setting;
  queued and existing worktrees retain their original location. Unique attempts,
  pre-creation validation and Store-owned original-location records preserve
  recovery/Apply/cleanup safety without fallback, relocation or automatic deletion.
  Partial attempts retain their location after ownership or hooks initialization
  errors, with Git creation blocked until all preparation succeeds.
• Collapsible repository sections with Ungrouped first, followed by saved
  groups. Headers show repository and selected counts, with group selection
  available while collapsed and an overall unique selection count. Overlapping
  groups share selection state and still produce only one job per repository.
  Expansion survives navigation, renames and membership edits during the session;
  keyboard navigation and Select all / Select none remain available. Cached
  membership mappings and compact headers support narrow windows in every theme.
• Tests for settings compatibility, tray failure/routing/count changes, stale
  callbacks, close/quit decisions and notification restoration; custom worktree
  locations, recovery and cleanup; repository classification, shared selection,
  deduplication, counts and expansion through group edits/deletion. Includes
  headless keyboard/layout checks and a disposable native desktop validation
  example.

Selected dependencies are tray-icon 0.26.1 for macOS/Windows and ksni 0.3.6 for
Linux. Linux requires zbus >=5.19 for safe runtime selection when Tokio and
async-io are both enabled. See rationale and platform behavior.
Scheduling, process-tree cancellation, repository safety, history, notification
filters and execution backends retain their existing behavior.

Validation and remaining platform work

See the dated macOS validation record for build,
test and native-smoke evidence. Linux x86-64 source validation on 2026-10-10 with
Rust 1.95 passed formatting, strict Clippy, all-feature tests (355 passed, four
optional CLI probes ignored) and the release build. Repository-group interaction
and narrow-layout checks ran headlessly across dark/light/system themes.

Windows native builds, Linux/Windows desktop smoke checks, macOS Intel execution,
status-menu interaction and native notification activation remain platform
checks. These source checks did not exercise release packages or authenticated
backend tasks.

Known limits: tray presence cannot guarantee an icon is visible through every OS
or third-party menu-bar policy. Dock/taskbar access is retained deliberately.
Wayland and Windows can restrict focus; native notifications require existing OS
permissions and activation support. Jobs run only while the application process
exists; no daemon, cold-start notification routing or automatic restart is added.

CodeConvoy v0.5.0

CodeConvoy 0.5.0 — Visibility & Review

Improved History search and filtering, added compact Review comparisons with per-repository outcomes, and persisted completion-time change observations for reliable review tracking and notifications. Enhanced repository health monitoring with safe concurrent refreshes, cancellation handling, and responsive, theme-aware UI indicators.

Changes since 0.4.0

• Case-insensitive History search by convoy ID, task, repository and backend,
  with All, Completed, Failed, Cancelled and Needs Review filters. Active convoys
  remain separate; filters preserve selection and history order.
• Compact Review comparison with execution totals, changed/unchanged/unknown
  counts, review attention, per-repository outcomes and recorded duration.
  Filter rows and select a repository to use the existing detailed views.
• New jobs persist completion-time change observations separately from current
  Review and repository health. Direct counts compare against the reviewed HEAD
  and include pre-existing edits. Isolated results retain their fixed-base change
  flag. Older entries show Unknown without reconstructing history from live Git.
• Responsive repository health with branch, Clean/Dirty and availability,
  a shared four-check limit across refreshes, cancellation and stale-reply rejection. Active
  repository work shows Unknown until an explicit refresh after completion;
  unrelated repositories remain available during Apply and single/bulk Discard.
• Review-needed notifications prefer saved completion observations, including
  committed Direct changes and Unknown results. Delivery filters, outcome priority
  and exactly-once tracking remain unchanged.
• Text-backed change and review indicators support System/Dark/Light themes.
  Narrow comparison rows wrap instead of requiring a wide table.

No new dependencies, agent backends, Git mutation actions or background monitoring.
Existing notification policy, scheduling, cancellation, repository safety and result
resolution remain intact. The optional completion field is compatible with existing
version-1 state. Template names are not persisted in historical tasks and are not
searchable. Direct Diff remains live, and isolated completion file counts are not
available. See behavior and compatibility.

Validation and remaining release work

macOS Apple Silicon validation passed formatting, strict Clippy, 320 Rust tests
(four optional CLI probes ignored), the release build, 16 packaging tests and
version/tag consistency. A disposable native macOS smoke pass verified search,
filtering, comparison selection and Diff navigation; headless layout checks cover
all requested sizes and themes. Detailed evidence and remaining native checks are
recorded in visibility validation.
Native Linux/Windows UI checks, macOS Intel execution, release packages and the
native notification checklist
remain release checks. No authenticated backend E2E or native notification delivery
is claimed by this feature implementation.

Existing limits remain: external applications are outside CodeConvoy's leases;
unsupported Apply transfers are refused; uncertain Apply retains evidence and has
no in-app uncertainty-resolution flow. Review changes before committing. Package
signing, platform compatibility and installation requirements follow the
release procedure and existing validation records.

CodeConvoy v0.4.0

CodeConvoy 0.4.0 — Attention & Completion

CodeConvoy 0.4.0 adds native desktop notifications and convoy completion awareness.
Run one task across local Git repositories using installed Codex CLI, GitHub Copilot
CLI, OpenCode or Claude Code, and receive one configurable alert when the whole
convoy finishes. This is unreleased source preparation; no tag or publication is
part of the implementation.

Changes since 0.3.1

• Native XDG notifications on Linux, modern UserNotifications on macOS and WinRT
  toasts on Windows. Delivery and activation run outside the UI and scheduler.
• Settings → Desktop notifications provides a master switch and success,
  failure, cancellation and review-needed filters. All default to enabled except
  cancellation. Preferences persist with backward-compatible defaults.
• Foreground suppression defaults to enabled for success, cancellation and review.
  Failure alerts can still notify while focused; minimized windows count as
  unfocused. OS permissions and Focus/Do Not Disturb remain authoritative.
• One deterministic event wins: failure, cancellation, review needed, then success.
  Git changes and unavailable results can require review even after successful
  agent execution. No agent prose is treated as evidence of repository changes.
• Notification clicks use stable convoy IDs and the existing Review view. Removed
  history produces a notice; unavailable results keep their normal diagnostics.
  Restore is requested before focus, subject to desktop restrictions.
• macOS notifications expire after one hour without interaction so ignored alerts
  or Notification Center's Clear All cannot leave response listeners waiting for
  the rest of the application session. Expiration does not activate the window.
• History restoration, interruption recovery, refresh and Apply/Discard never
  replay completion alerts. Disabled, suppressed and failed alerts are not retried.
  Notification diagnostics stay separate from agent outcomes.

The native adapter uses notify-rust on Linux and its underlying modern macOS and
Windows transports directly for asynchronous/callback interaction. No web runtime,
tray, service, new agent backend or workflow feature is added. Existing dependency
versions remain unchanged; Cargo.lock adds only the new native notification trees.

Scheduler admission, concurrency limits, canonical/nested repository protection,
process-tree cancellation, immutable snapshots and result safety are unchanged.
See notification preferences, dependencies and platform limitations.

Result safety and limits

Apply conservatively refuses unsupported transfers, including submodules/nested
repositories, sparse or unmerged index state, divergent staged alternatives and
Git conversion settings that cannot be preserved. Changes must be reviewed again
if the retained result changes. Patches are capped at 32 MiB and rendered diffs
at 2 MiB; unavailable statistics are reported explicitly.

External tools can still change repositories outside CodeConvoy's leases. A
failure after an Apply write attempt is recorded as uncertain, retains evidence
across restart, and blocks retrying Apply, Discard and cleanup of that result.
There is no in-app uncertainty-resolution flow; manual inspection is required.
CodeConvoy never resets, cleans or stashes to recover a failed Apply.

Removing history only removes eligible CodeConvoy metadata. It never deletes
repository contents or grants permission to remove retained worktrees. Direct
execution can leave partial edits when stopped. Review changes before committing.

Downloads and platform notes

Downloads include Linux x86-64 DEB/RPM/AppImage, Windows x86-64 per-user setup and
portable ZIP, and one macOS Universal DMG with Apple Silicon and Intel slices.
SHA256SUMS covers the six packages. Linux packages are built on Ubuntu 26.04.
Earlier DEB and AppImage packages have user-verified installation/startup
coverage on Debian Forky; those checks have not been repeated for 0.4.0 packages.
The minimum glibc version and compatibility with older distributions still need
verification after the runner update. A working desktop graphics environment is
required; the native picker uses your desktop portal.

On macOS, drag CodeConvoy to Applications. The app is ad-hoc signed, not
Developer ID signed or notarized. After verifying the source and attempting a
first launch, you may need the CodeConvoy-specific Open Anyway option in
System Settings → Privacy & Security. Follow
Apple's guidance; do not disable
Gatekeeper globally. Windows packages are not Authenticode signed and may display
an unknown-publisher warning.

Install Git and your chosen coding-agent CLI separately. Desktop applications
may inherit a different PATH from your shell. Use an absolute agent executable
path where necessary; Git must also be available to the application.

Validation and remaining limits

Linux x86-64 source validation on 2026-10-09 with Rust 1.95.0 passed:
cargo fmt --check, strict all-target/all-feature Clippy, all-feature Rust tests
(297 passed, four optional CLI probes ignored), cargo build --release, all
16 packaging unit tests, and the v0.4.0 version/tag consistency check.
The latter validates consistency only; no tag was created.
Notification coverage includes mock transport errors/panics, event/focus policy,
exactly-once lifecycle tracking, restart silence, stable click routing and
headless egui restore/navigation tests. Real temporary Git repositories verify
Direct result classification while preserving HEAD and the real index.

Native notification smoke tests have not been performed on Linux, macOS or
Windows. macOS/Windows builds and current package installation also remain
unverified on this Linux host. The native smoke checklist
is required before publishing:

• GNOME/Wayland and X11 delivery, focus suppression, multi-convoy clicks and missing
  notification service/action support. Wayland may require manual app activation.
• Packaged macOS .app authorization, Focus mode and body/button callbacks on both
  architectures. Bare source executables have no notification bundle identity.
• Installed and portable Windows 10/11 sender identity, permissions, banner and
  Notification Center callbacks, minimized restore and foreground restrictions.
• All platforms: removed history, unavailable retained results, shutdown while
  alerts exist, and no replay after restart. Cold-start click routing is unsupported.

A single submission is not a guarantee that the OS displayed a banner. Notification
failure does not affect execution, and a crash/exit can prevent pending delivery.
Windows callbacks after banner expiry require native verification. Apply uncertainty
resolution and older Linux/glibc compatibility retain their existing limitations.
Earlier authenticated agent and Git safety validation is documented separately;
this implementation does not claim new authenticated agent or native package tests.
Follow the release procedure before creating a release candidate.

CodeConvoy v0.3.1

CodeConvoy 0.3.1

CodeConvoy 0.3.1 adds convoy-wide and global discard of unresolved isolated
results, and improves macOS branding and About links. Run one task across local
Git repositories using your installed Codex CLI, GitHub Copilot CLI, OpenCode or
Claude Code, then inspect each repository's result in the native desktop UI.

Changes since 0.3.0

• Use Discard convoy… to discard unresolved retained isolated results from
  one terminal convoy, or History cleanup → Discard all unresolved results…
  to select them across terminal history. Confirmation shows the scope and count,
  defaults to Cancel, and freezes the selection so later results are not added.
• Each confirmed result uses the existing ownership checks, exclusive repository
  lifecycle lease and durable cleanup transaction. Active convoys and already
  Applied/Discarded results are excluded. Source files and unrelated worktrees
  remain untouched; unverifiable ownership and uncertain Apply remain blocked.
• Bulk discard reports successful and failed results independently, with
  expandable diagnostics. A failed target does not stop unrelated targets, and
  protected results keep their history pinned. Quit waits for the current cleanup;
  restart reconciles per-result state without replaying the batch.
• macOS application menus consistently use CodeConvoy for the application,
  About, Hide and Quit labels. The native About panel includes a clickable GitHub
  repository link; the in-app About link uses the same Cargo repository metadata.
• Refresh the README screenshot.

Both concurrency limits, fair admission, canonical/nested repository protection,
process-tree cancellation and immutable launched snapshots remain in force.
Isolated preparation consumes scheduler capacity; result actions take exclusive
repository lifecycle leases while unrelated repositories can continue.
No automatic commits, staging, pushes, pull requests or agent continuation are
introduced. Agent installation and authentication remain under your control.

Result safety and limits

Apply conservatively refuses unsupported transfers, including submodules/nested
repositories, sparse or unmerged index state, divergent staged alternatives and
Git conversion settings that cannot be preserved. Changes must be reviewed again
if the retained result changes. Patches are capped at 32 MiB and rendered diffs
at 2 MiB; unavailable statistics are reported explicitly.

External tools can still change repositories outside CodeConvoy's leases. A
failure after an Apply write attempt is recorded as uncertain, retains evidence
across restart, and blocks retrying Apply, Discard and cleanup of that result.
There is no in-app uncertainty-resolution flow; manual inspection is required.
CodeConvoy never resets, cleans or stashes to recover a failed Apply.

Removing history only removes eligible CodeConvoy metadata. It never deletes
repository contents or grants permission to remove retained worktrees. Direct
execution can leave partial edits when stopped. Review changes before committing.

Downloads and platform notes

Downloads include Linux x86-64 DEB/RPM/AppImage, Windows x86-64 per-user setup and
portable ZIP, and one macOS Universal DMG with Apple Silicon and Intel slices.
SHA256SUMS covers the six packages. Linux packages are built on Ubuntu 26.04.
Earlier DEB and AppImage packages have user-verified installation/startup
coverage on Debian Forky; those checks have not been repeated for 0.3.1 packages.
The minimum glibc version and compatibility with older distributions still need
verification after the runner update. A working desktop graphics environment is
required; the native picker uses your desktop portal.

On macOS, drag CodeConvoy to Applications. The app is ad-hoc signed, not
Developer ID signed or notarized. After verifying the source and attempting a
first launch, you may need the CodeConvoy-specific Open Anyway option in
System Settings → Privacy & Security. Follow
Apple's guidance; do not disable
Gatekeeper globally. Windows packages are not Authenticode signed and may display
an unknown-publisher warning.

Install Git and your chosen coding-agent CLI separately. Desktop applications
may inherit a different PATH from your shell. Use an absolute agent executable
path where necessary; Git must also be available to the application.

Validation and remaining limits

Release preparation on Linux x86-64 with Rust 1.95.0 and Python 3.14.8 passed
formatting, strict Clippy, all-feature Rust tests (281 passed, four optional CLI
probes ignored), the release build, all 16 packaging unit tests and the
v0.3.1 tag/version check. No dependency versions changed.

Deterministic fixtures exercise all four backends, real Git worktrees, scheduling,
cancellation, retained-result recovery, Apply/Discard, retries, follow-up drafts
and old-state compatibility. Bulk discard fixtures additionally cover frozen
confirmation, keyboard cancellation/confirmation, mixed outcomes, active-convoy
exclusion, ownership refusal, restart reconciliation and history protection.
Earlier native macOS fixture checks cover isolation, cancellation, restart,
a 24-row Review, successful and failed-result Apply,
destination blocking, keyboard Discard, Retry and selected-result follow-up.
These use disposable repositories and a local fixture agent rather than
authenticated model execution. Detailed evidence is recorded in:

• Worktree execution validation
• Recovery and cleanup validation
• Review, Apply and Discard validation
• Retry, follow-up and v0.3 readiness
• Bulk discard validation

The bulk discard Linux window and Cancel focus were inspected natively. Native
confirmation, partial/global completion and history removal were not validated
through desktop input; those paths have deterministic real-Git and egui coverage.
The macOS branding changes still require native macOS verification.

Codex and Copilot have earlier user-verified authenticated E2E coverage on Linux
and macOS. Authenticated attachment/model acceptance remains unverified for all
four backends; OpenCode and Claude authenticated E2E remain unverified overall.
Broader native Linux/Windows desktop checks, Intel macOS runtime checks and fresh
0.3.1 package installation checks remain outstanding. Local source validation
does not replace the manual native package candidate workflow and exact-artifact checks
described in the release procedure.

CodeConvoy v0.3.0

CodeConvoy 0.3.0

CodeConvoy 0.3.0 adds isolated execution, convoy-wide review and explicit result
resolution, plus retries and follow-up convoys. Run one task across local Git
repositories using your installed Codex CLI, GitHub Copilot CLI, OpenCode or
Claude Code, then inspect each repository's result in the native desktop UI.

Changes since 0.2.0

• Choose Direct (the default) or Isolated worktree for each convoy.
  Isolated jobs start from the exact committed HEAD captured at launch review,
  without importing uncommitted source edits. Each attempt has a fresh detached,
  owned worktree; preparation failure never falls back to Direct.
• Retain isolated results after success, failure, cancellation or interruption,
  including unchanged and partially prepared worktrees. Startup validates saved
  ownership and availability in the background without resuming agents or
  recreating missing results. Unresolved ownership protects history from removal.
• Review all jobs in a compact convoy grid with execution status, mode,
  availability, resolution and Git-derived file/line statistics. Isolated Diff
  uses the saved base commit; Direct statistics describe the current working tree.
  Agent success and actual repository changes remain separate observations.
• Explicitly Apply a reviewed isolated result to its still-registered source
  only when the destination is clean at the saved base and ownership and changes
  pass revalidation and binary Git patch preflight. Apply changes working files,
  preserves HEAD and both real indexes, and retains the result copy for inspection.
• Explicitly Discard an isolated result with safe-default confirmation.
  Verified cleanup removes only that owned worktree through Git and leaves the
  source files intact. Applied copies can also be explicitly cleaned up. No
  automatic worktree deletion or pruning is performed.
• Retry a failed, cancelled or interrupted job as a new one-repository convoy
  with the original task, settings and attachment references. Normal launch review
  checks current Git, registration, backend capabilities and context again; isolated retries use a
  fresh worktree from newly reviewed HEAD. The earlier attempt stays independent.
• Use New convoy from selected to populate the draft from selected Review
  rows, copying registered repositories, backend settings, mode and per-convoy
  concurrency. Task and attachments start empty, omissions are reported, and
  nothing launches automatically. Retry/follow-up provenance links available
  source history without creating scheduling dependencies.
• Persist System/Dark/Light appearance. Existing v0.1/v0.2 state remains
  compatible, including registrations, groups, templates, settings and history;
  older jobs default to Direct mode.

Both concurrency limits, fair admission, canonical/nested repository protection,
process-tree cancellation and immutable launched snapshots remain in force.
Isolated preparation consumes scheduler capacity; result actions take exclusive
repository lifecycle leases while unrelated repositories can continue.
No automatic commits, staging, pushes, pull requests or agent continuation are
introduced. Agent installation and authentication remain under your control.

Result safety and limits

Apply conservatively refuses unsupported transfers, including submodules/nested
repositories, sparse or unmerged index state, divergent staged alternatives and
Git conversion settings that cannot be preserved. Changes must be reviewed again
if the retained result changes. Patches are capped at 32 MiB and rendered diffs
at 2 MiB; unavailable statistics are reported explicitly.

External tools can still change repositories outside CodeConvoy's leases. A
failure after an Apply write attempt is recorded as uncertain, retains evidence
across restart, and blocks retrying Apply, Discard and cleanup of that result.
There is no in-app uncertainty-resolution flow; manual inspection is required.
CodeConvoy never resets, cleans or stashes to recover a failed Apply.

Removing history only removes eligible CodeConvoy metadata. It never deletes
repository contents or grants permission to remove retained worktrees. Direct
execution can leave partial edits when stopped. Review changes before committing.

Downloads and platform notes

Downloads include Linux x86-64 DEB/RPM/AppImage, Windows x86-64 per-user setup and
portable ZIP, and one macOS Universal DMG with Apple Silicon and Intel slices.
SHA256SUMS covers the six packages. Linux packages are built on Ubuntu 26.04.
Earlier DEB and AppImage packages have user-verified installation/startup
coverage on Debian Forky; those checks have not been repeated for 0.3.0 packages.
The minimum glibc version and compatibility with older distributions still need
verification after the runner update. A working desktop graphics environment is
required; the native picker uses your desktop portal.

On macOS, drag CodeConvoy to Applications. The app is ad-hoc signed, not
Developer ID signed or notarized. After verifying the source and attempting a
first launch, you may need the CodeConvoy-specific Open Anyway option in
System Settings → Privacy & Security. Follow
Apple's guidance; do not disable
Gatekeeper globally. Windows packages are not Authenticode signed and may display
an unknown-publisher warning.

Install Git and your chosen coding-agent CLI separately. Desktop applications
may inherit a different PATH from your shell. Use an absolute agent executable
path where necessary; Git must also be available to the application.

Validation and remaining limits

Deterministic fixtures exercise all four backends, real Git worktrees, scheduling,
cancellation, retained-result recovery, Apply/Discard, retries, follow-up drafts
and old-state compatibility. Native macOS fixture checks cover isolation,
cancellation, restart, a 24-row Review, successful and failed-result Apply,
destination blocking, keyboard Discard, Retry and selected-result follow-up.
These use disposable repositories and a local fixture agent rather than
authenticated model execution. Detailed evidence is recorded in:

• Worktree execution validation
• Recovery and cleanup validation
• Review, Apply and Discard validation
• Retry, follow-up and v0.3 readiness

Codex and Copilot have earlier user-verified authenticated E2E coverage on Linux
and macOS. Authenticated attachment/model acceptance remains unverified for all
four backends; OpenCode and Claude authenticated E2E remain unverified overall.
Native Linux/Windows desktop checks, Intel macOS runtime checks and fresh 0.3.0
package installation checks remain outstanding. Local source validation does not
replace the manual native package candidate workflow and exact-artifact checks
described in the release procedure.

CodeConvoy v0.2.0

CodeConvoy 0.2.0

CodeConvoy 0.2.0 makes repeated maintenance across local Git repositories easier
with repository groups, task templates, file attachments and readable activity
views. It continues to use your installed Codex CLI, GitHub Copilot CLI, OpenCode
or Claude Code, with each backend's own settings and permissions.

Changes since 0.1.0

• Save and edit named repository groups. Group selection updates the explicit
  repository list, deduplicates overlapping members and keeps unavailable
  memberships visible for repair.
• Save, load, edit and delete task-text templates. Loading a template preserves
  repository selection, attachments and backend settings, and never starts work.
• Attach Markdown, text, JSON, YAML, PNG, JPEG and WebP files using the native
  picker or attachment drop area. Each backend supplies text and images through
  its own supported CLI interface; unsupported input fails explicitly.
• Check attachments before launch and again when queued jobs start. History
  retains file references and metadata rather than file contents. Reusing a
  convoy keeps missing or changed files visible and blocks launch until they
  are explicitly removed or restored and re-added.
• Inspect backend events in Activity alongside Diff, Raw output and
  Task & settings. Activity and raw logs remain bounded and session-only.
• Check installed agent CLIs automatically in the background at startup and
  after executable changes. Missing agents do not prevent editing tasks or
  viewing repositories and history.
• Improve keyboard navigation, accessible controls, compact-window layouts,
  group-selection performance and the About dialog's project link.
• Document Linux installation commands and Homebrew/Scoop installation and
  updates. The release publisher now verifies drafts by numeric release ID and
  requests package-repository updates after publication when configured.

Existing state remains compatible. Convoys keep immutable task/settings/context
snapshots, independent results, fair bounded scheduling, repository conflict
protection, Git baseline review and process-tree cancellation. Agent CLIs and
authentication remain under your control. No provider credentials, agent CLIs,
updater, service or background agent are bundled.

Downloads and platform notes

Downloads include Linux x86-64 DEB/RPM/AppImage, Windows x86-64 per-user setup and
portable ZIP, and one macOS Universal DMG with Apple Silicon and Intel slices.
SHA256SUMS covers the six packages. Linux packages are built on Ubuntu 26.04.
Earlier DEB and AppImage packages have user-verified installation/startup
coverage on Debian Forky; those checks have not been repeated for 0.2.0 packages.
The minimum glibc version and compatibility with older distributions still need
verification after the runner update. A working desktop graphics environment is
required; the native picker uses your desktop portal.

On macOS, drag CodeConvoy to Applications. The app is ad-hoc signed, not
Developer ID signed or notarized. After verifying the source and attempting a
first launch, you may need the CodeConvoy-specific Open Anyway option in
System Settings → Privacy & Security. Follow
Apple's guidance; do not disable
Gatekeeper globally. Windows packages are not Authenticode signed and may display
an unknown-publisher warning.

Install Git and your chosen coding-agent CLI separately. Desktop applications
may inherit a different PATH from your shell. Use an absolute agent executable
path where necessary; Git must also be available to the application.

Validation and remaining limits

The v0.2 workflows have deterministic coverage for all four backends, including
text/image delivery to two disposable repositories and independent results.
Native macOS fixture checks cover groups, templates, file selection, concurrent
convoys, history reuse, themes, keyboard navigation and compact/enlarged windows.
See the Part 2.3 completion report
for detailed evidence.

Codex and Copilot have earlier user-verified authenticated E2E coverage on Linux
and macOS. Authenticated attachment/model acceptance remains unverified for all
four backends; OpenCode and Claude authenticated E2E remain unverified overall.
Native Linux/Windows file-picker and OS drag-and-drop checks, Intel macOS runtime
checks and fresh 0.2.0 package installation checks remain outstanding. Codex
session continuation remains deferred. Consult the repository's validation
documents for platform-specific evidence and limitations.

CodeConvoy works directly in registered repositories. Stopping work does not
undo partial edits. Review changes before committing them. Removing history
only removes CodeConvoy metadata, never repository contents.

CodeConvoy v0.1.0

CodeConvoy's first release is a native desktop application for applying one task
across local Git repositories using Codex CLI, GitHub Copilot CLI, OpenCode, or
Claude Code.

It includes independent concurrent convoys, bounded scheduling, repository
conflict prevention, Git baseline review, process-tree cancellation, local
history, result/diff inspection, native folder selection and keyboard navigation.
Agent CLIs and authentication remain under your control. No provider credentials,
agent CLIs, updater, service or background agent are bundled.

Downloads include Linux x86-64 DEB/RPM/AppImage, Windows x86-64 per-user setup and
portable ZIP, and one macOS Universal DMG with Apple Silicon and Intel slices.
SHA256SUMS covers the six packages. Linux requires glibc 2.35 or newer and a
working desktop graphics environment; the native picker uses your desktop portal.

On macOS, drag CodeConvoy to Applications. The app is ad-hoc signed, not
Developer ID signed or notarized. After verifying the source and attempting a
first launch, you may need the CodeConvoy-specific Open Anyway option in
System Settings → Privacy & Security. Follow
Apple's guidance; do not disable
Gatekeeper globally. Windows packages are not Authenticode signed and may display
an unknown-publisher warning.

Install Git and your chosen coding-agent CLI separately. Desktop applications
may inherit a different PATH from your shell. Use an absolute agent executable
path where necessary; Git must also be available to the application.

Codex and Copilot have user-verified authenticated Linux E2E coverage. OpenCode
and Claude Code have deterministic protocol/execution tests; authenticated E2E
execution remains unverified. Consult the repository's validation documents for
platform-specific evidence and limitations.

CodeConvoy works directly in registered repositories. Stopping work does not
undo partial edits. Review changes before committing them. Removing history
only removes CodeConvoy metadata, never repository contents.