v0.6.0 — "Chain of Trust"

A governance and transport-security pass: approvals now bind to the exact
operation and expiry a reviewer saw, standalone installers verify against a
digest pinned in the release tag instead of mutable release assets, and the
shared authority service gets an application-level access token — plus two
approval-reuse gaps closed in orchestrator grants and task takeovers.

Security

• Breaking: approvals for contract publication and approval-gated
  invocations now carry a SHA-256 subject digest and an expiry; existing
  action-only approvals no longer authorize these operations and must be
  renewed. See RFC 0025.
• Breaking: production agent-comms-server startup now requires
  AGENT_COMMS_AUTHORITY_TOKEN, alongside existing TLS and signing-key
  requirements. See RFC 0026.
• Breaking: standalone installers now require an exact release version,
  authenticate the downloaded verifier against six platform digests
  committed in that protected tag, and bind Sigstore verification to the
  exact requested tag. A separately installed Cosign binary is still not
  required.
• Orchestrator-grant and task-takeover approvals are now ID-scoped and
  single-use: a matching approval is consumed once used and can no longer be
  replayed to re-authorize the same grant or takeover indefinitely. See
  RFC 0023 and
  RFC 0024.
• Authority SSE streams now use a dedicated bounded connection pool so
  long-lived stream holders can no longer exhaust health-check or mutation
  capacity.
• Updated google.golang.org/grpc to 1.83.1 (fixes a high-severity HTTP/2
  DATA-frame-fragmentation heap exhaustion) and fast-uri to 3.1.7 (fixes
  two high-severity SSRF/host-confusion issues from percent-decoding and
  IDN-canonicalization handling).

Full technical detail is below and in CHANGELOG.md.

---

Full Changelog: v0.5.0...v0.6.0

v0.5.0 — "Plain Speech"

Every command's default human output changes from a raw JSON dump to a
readable summary — semantic status, tables, and next-action hints, while
--json stays byte-compatible — plus permanent, elevated-key-gated project
deletion.

Added

• Breaking: a new --output human|plain|json|jsonl contract replaces
  printing raw backend JSON to a human terminal by default. --json remains
  a supported alias and stays byte-compatible; human output does not. See
  RFC 0022.
• Breaking: agent-comms project delete permanently deletes a project,
  local and remote, with no automatic backup. OWNER-only, elevated-key
  required, no scripted path. See RFC 0020.

Full technical detail is below and in CHANGELOG.md.

---

Full Changelog: v0.4.0...v0.5.0

v0.4.0 — "Proof of Presence"

Identity resolution can no longer silently misattribute a signed action to
the wrong actor — closing a real incident end to end — plus self-service
role switching with freeform custom labels, ConPTY-backed interactive-serve
on Windows, cosign-free release verification, and a deep TUI interaction
audit (the command palette, a dead keybinding, and a missing focus
indicator).

Security

• Breaking: a governed write resolved through the legacy, machine-wide
  default-actor fallback is now refused outright whenever a project has
  two or more locally-registered identities to choose between, instead of
  silently signing under whichever one happens to be active — the exact
  mechanism behind a real, confirmed incident where one agent's action was
  signed under a different agent's identity. Session-scoped actor
  resolution (below) already made this safe for any Claude Code/Codex
  session; this closes the one remaining gap, for CLI/MCP/worker
  invocations with no recognized session at all. See RFC 0017.
• A provider session (Claude Code, Codex) now resolves its own isolated
  default actor, instead of inheriting the one shared, machine-wide
  default every concurrent session and script on the account used to read
  and write. See RFC 0016.
• Self-registering from a session-less caller (an opencode-based agent, a
  script) no longer claims the shared legacy default-actor slot for every
  other session-less process on the account — closing a second path into
  the same class of misattribution the two items above close.
• The project owner's role can no longer be changed through any path at
  all, self-service or administrative — mirroring the existing, absolute
  protection agent suspend/agent revoke already give the owner.

Added

• Breaking: self-service role switching (agent switch-role /
  agent_switch_role) — any active principal can relabel its own role at
  any time, to ORCHESTRATOR or any freeform custom label
  (Frontend-Architect, Tester, ...), with no owner/orchestrator
  elevation required. Never targets another principal, never touches
  capabilities/scopes, and can never target OWNER. Switching to
  ORCHESTRATOR keeps the full existing gate: a human principal, a
  pre-approved HUMAN-tier approval, and the elevated-key passphrase. The
  AGENT/OBSERVER roles are removed — AGENT duplicated
  PrincipalType's own value for no added meaning, and OBSERVER's
  read-only enforcement covered only two transitions. See RFC 0018.
• interactive-serve and --takeover-pid now work on Windows (10 version
  1809/October 2018 Update or later), closing a platform gap that
  previously errored outright. Built on ConPTY
  (github.com/charmbracelet/x/conpty) in place of creack/pty, a named
  pipe control socket (github.com/Microsoft/go-winio) in place of a unix
  domain socket, and TerminateProcess in place of POSIX signals for
  process lifecycle. See RFC 0014. Closes #17.
• install.sh/install.ps1 and agent-comms update no longer require a
  separately installed cosign CLI to verify a release at all — a new
  companion binary, agent-comms-verify, performs the identical cosign verify-blob --bundle check with no external process. Real cosign
  remains a fully supported, independent way to run the same check
  manually. See RFC 0015.
• The TUI's command palette now has real mouse support (click a match to
  run it), matching every other surface in the app.
• A new "change role" action in the TUI lets an owner/orchestrator change
  an already-active agent's role, not just a pending one's first
  activation.

Fixed

• Breaking: agent activate --role is now a required flag (it lost
  its AGENT default, since AGENT no longer exists as a role); and
  agent activate --role OWNER now fails for any target outside the one
  special bootstrap event at project creation, where it previously
  succeeded silently.
• The TUI resolves straight to the project owner, instead of refusing,
  when the legacy actor fallback would otherwise be ambiguous — the TUI
  can only ever be driven by a human physically present at a real
  terminal, unlike the CLI/MCP/worker paths the write-refusal above
  correctly still protects. See RFC 0019.
• The TUI's command palette leaked keystrokes into row actions if opened
  from inside a focused view — a typed character could silently trigger
  suspend, revoke, or delete on the selected row instead of composing a
  search query. The palette's rendered "top match" could also silently
  drift from what Enter actually executed, and the spacebar could never
  be typed into it at all (no multi-word command was ever reachable).
  Clicking elsewhere while the palette was open silently navigated
  underneath it instead of closing it.
• A RowAction keybinding could silently collide with a global reserved
  key (confirmed live for the new "change role" action, bound to r,
  which lost every time to the global refresh binding) with no error or
  indication — rebound, and the row-action key switch now documents the
  full reserved set to stop this recurring.
• The TUI now shows a visible focus indicator: the active tab renders
  differently depending on whether a row list actually has keyboard
  focus, or a key like r is just about to hit the hub-level browsing
  shortcut instead.
• The TUI's actor-switch form no longer clobbers its own success notice,
  no longer shows a blind list of candidate identities with no role/status
  shown, and now shows which actor ID is currently active.
• runtime verify-adapter also checks an adapter's subcommands' own
  --help output, not just the top-level command's.
• An unknown CLI flag produced zero output on every platform instead of a
  usage error.
• install.ps1's cosign prerequisite check no longer rejects a real,
  correctly installed cosign: it now also recognizes
  cosign-windows-amd64.exe, cosign's actual upstream release/winget
  asset name, instead of only the bare cosign name that no documented
  Windows install method for cosign actually produces. Previously this
  blocked every Windows install that followed the documented steps
  exactly — see #16.

Full technical detail is below and in CHANGELOG.md.

---

Full Changelog: v0.3.0...v0.4.0

v0.3.0 — "Point and Click"

A TUI you can drive with a mouse from a real-sized terminal, session-pinned
interactive delivery that survives a restart, a declarative path for adding
new CLI providers without touching Go, and a public marketing/docs site.

Added

• Full native mouse support across the TUI — click, scroll, sidebar and
  hub-tab navigation, double-click-to-act, and Project settings (the one
  view that was missing it).
• The TUI now scales down to a real small terminal instead of requiring a
  desktop-sized minimum: dynamic responsive layout, full body viewport
  scrolling for non-table views, live PTY preview, a split-pane inspector,
  rich status indicators, and background toast notifications.
• --takeover-pid safely migrates a live interactive session into
  interactive-serve, and every migrated/resumed session now pins its
  exact provider session ID (auto-discovered for claude and opencode)
  instead of racing each provider CLI's own "most recent session" guess —
  closes a real class of stale/forked-session bugs.
• A declarative JSON adapter specification system: add a new CLI provider
  by dropping a spec file under .agent-comms/adapters/, no Go changes
  required.
• runtime verify-adapter checks an adapter's assumed CLI flags against
  the real installed binary's own --help output.
• runtime.delete (protocol, CLI, TUI), task lock (create+claim a task
  in one step), and human-readable table output by default for
  agent/runtime/invocation list commands.
• A public marketing site and docs site, a nightly beta build channel, and
  one-keypress Orchestrator-approval requests from the TUI.

Fixed

• Dozens of TUI layout and rendering bugs, most surfaced by making the TUI
  usable at real (non-desktop) terminal sizes: sidebar/row-list overflow,
  click-position drift, footer/keybinding wrapping, and two ANSI/wrap
  corruption bugs (a truncated escape sequence leaking onto screen; a
  bordered box that could render wider than the terminal and split its own
  border mid-line).
• interactive-serve --takeover-pid now refuses outright if the calling
  process is itself a descendant of the target PID, instead of silently
  killing its own controlling terminal — confirmed live before the fix.
• Stale interactive-serve sockets are cleaned up automatically on startup.

Security

• Removed the agy (Google Antigravity) worker adapter and all
  agy-specific integration code, over an unresolved third-party Terms of
  Service compliance question — never reached a tagged release, so nothing
  for existing installs to migrate away from. See docs/backlog.md's
  "Compliance / third-party terms of service" section for the full
  research record.

Full technical detail is below and in CHANGELOG.md.

---

Full Changelog: v0.2.1...v0.3.0

v0.2.1 — "The Missing Bundle"

A hotfix restoring the Cosign-signed installer bundles that v0.2.0's CLI release was missing, so install.sh/install.ps1 work again.

Fixed

• The published release was missing the Cosign .bundle file for every primary CLI binary — the documented installers fail closed without it.

Full technical detail is below and in CHANGELOG.md.

---

Full Changelog: v0.2.0...v0.2.1

v0.2.0 — Chain of Custody

A managed-lifecycle and security-hardening release: safer credential
handling, a distinct human-approval gate on orchestrator grants, and a
truthful interactive-delivery model.

Added

• One-command project upgrades reconcile schema, binary, and daemon state
  automatically, with automatic backups and full post-upgrade verification
  (RFC 0011).
• Breaking: orchestrator grants now require a separate, explicitly
  human-approved decision — closes a self-escalation gap.
• A passphrase-protected elevated signing key now gates the most sensitive
  actions.
• Agent identities can be deleted and safely reused; every signed event
  carries its signer's key fingerprint (RFC 0012).
• Interactive delivery is now a real, auditable state machine — no connector
  can falsely report a message as delivered (RFC 0013).
• The TUI is a full control center: write actions everywhere, new panels,
  typo-proof pickers, redesigned views.

Fixed

• A duplicate agent register call could silently destroy an existing
  agent's credential with no recovery path — now rejected before any
  credential is generated.
• MCP's agent_register tool could register or squat an unrelated agent
  identity — now enforces its documented self-registration invariant.
• Assorted authorization and Postgres reliability fixes.

Full technical detail is below and in CHANGELOG.md.

---

Full Changelog: v0.1.0...v0.2.0

v0.1.0 — The Control Room

First tagged release: terminal-native, signed coordination between humans and
agents — typed messages, protected work leases, approvals, artifacts, living
documents — backed by either a zero-setup local SQLite authority or a shared
PostgreSQL team authority, and operated through a full console TUI or a
deterministic JSON CLI/MCP surface.