v1.13.0

1.13.0 (2026-10-12)

Features

• devenv-image: move to nixos-26.05 (devenv 2.1.2), VERSION 2.0.0 (#480) (e042f14)
• isolation: add personal-kit template for the scope-layers pattern (8c9e84a)
• isolation: add the scope-layers pattern and a team-kit template (#441) (35ea9b0)
• isolation: validate kit templates under acq-kits/examples/ (#476) (3aeae67)
• patterns: add paseo kit identity gate for a stale host forwarder (#453) (35306d9)
• usai-provider: normalize and vendor USAi model catalog (#436) (665373d)

Bug Fixes

• usai-catalog: serialize feed data before config emission (800ba7e)

v1.12.1

1.12.1 (2026-10-06)

Bug Fixes

• ci: clear two new markdownlint-cli transitive CVEs (katex, smol-toml) (#478) (f1913ba)

v1.12.0

1.12.0 (2026-10-05)

Features

• acq-kits: install OpenCode v2 via opencode kit (#466) (dc84c6c)

Bug Fixes

• ci: replace markdownlint-cli2 with markdownlint-cli, drop the shim (#471) (dd22daf)

v1.11.0

1.11.0 (2026-10-02)

Features

• acq-kits: add opencode agent-harness kit (SHA-pinned release binary) (#455) (36038a6)

Bug Fixes

• usai-provider: drop embedding models from the chat-model catalog (#462) (56500ba)
• usai-provider: make the catalog drift check report real drift (#459) (73606d7)

v1.10.0

1.10.0 (2026-10-02)

Features

• isolation: add generic devenv sandbox image built and published to GHCR (#395) (8c7e9ca)
• oci-engine: add rootless podman OCI-engine capability kit (#437) (b980c93)
• paseo: bump pinned Paseo CLI to 0.10.2 (#439) (ef3aa29)
• paseo: register child repos in parent mounts (#391) (eded00c)
• patterns: add pi-coding-agent acq-kit (earendil-works/pi, npm install, unprivileged startup-only) (#399) (5d1a877)
• schema: add optional agent block to hybrid/v1 kit schema (#454) (856c975)

Bug Fixes

• ci: bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory (#409) (086f9f6)
• ci: bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory (#411) (acc0346)
• ci: pin markdownlint-cli2 once and stop the pre-commit/CI drift (#451) (543e08f)
• paseo: keep npm cache agent-owned (#402) (c0ad118)
• usai-provider: USAi model catalog refresh + NIST-grounded permission hardening (#417) (b3afd89)

v1.9.0

1.9.0 (2026-08-25)

Features

• kits: add neutral network.tier vocab (strict/balanced/open) to hybrid/v1 (#300) (#313) (3f51984)
• kits: add neutral volumes to hybrid/v1 schema (#353) (7d742fb)
• kits: add paseo self-hosted web UI acq mixin kit (#312) (de22b4e)
• kits: pre-populate Paseo projects from mounted host directories (#349) (4dc2a52)
• network-tiers: balanced baseline allowlist + deterministic additions guard (#301, #302) (#315) (aff5d63)
• prime-agent: add kit skeleton + spec.yaml (hybrid/v1) (#378) (dd80e38)
• skills: executive technical explainer capability (3 skills + technical-explainer profile) (#329) (2a82c1b)
• usai-catalog: harness-neutral USAi model catalog — schema, build, emitters + byte-exact guarantee (#358/#359/#360/#361) (#379) (305dfa8)

Bug Fixes

• ci: authenticate Link Check to github.com to stop rate-limit false-positives (#316) (#317) (e71209f)
• ci: enforce pattern test-cases in CI + keep ruff pins in lockstep (#345) (0ea5bac)
• ci: ignore climbing relative links in Link Check (400 false positives) (#309) (118825c)
• ci: scope link-check GITHUB_TOKEN to the real github hosts (trailing slash) (#354) (ac9b794)
• kits: bind Paseo daemon to 0.0.0.0 so create-time publish reaches it (#335) (61c8a5a)
• links: repoint dead federal links to live official/GitHub sources (#311) (a73f9c1)
• openchamber: install @openchamber/web unprivileged (drop sudo/root) (#355) (2c27856)
• repair 11 dead skill links, align local audit to CI, doc-honesty fixes (#350) (ae5b0dd)
• schema: enforce prohibited_content minimum + category coverage (#340) (#352) (0d3266c)
• usai: add Claude 5 + Gemini 3.x, repoint the dead GPT ids (#386) (f60a805)

v1.8.0

1.8.0 (2026-08-04)

Features

• acq-kits: openchamber wrapper owns a shared opencode server (#234) (0e04073)
• acq-kits: startup script owns the shared server for a terminal-free openchamber (#246) (d27c22b)
• communications: design-artifact pack + workflow + multi-artifact output (#241) (#270) (74f198e), closes #237
• integrations: add backend-aware pricing to USAi provider (#281) (acdfae8)
• kits: add bundle provenance schema + permission/drift guards (#273) (#274) (5c55bcf)
• kits: add neutral publishedPorts + background to hybrid/v1 schema (#276) (bf8add3)
• meta: add data-driven pattern-router + deterministic scorer (#239) (#266) (2a805a9), closes #237
• openchamber: adopt neutral publishedPorts + background; sbx+msb parity (#283) (6230faa)
• patterns: classify patterns + deprecate safe-code-review [MERGE AFTER #266] (#240) (#267) (ea6ea67)
• schema: add collection + routing taxonomy foundation (#238) (#245) (25508e4), closes #237
• workflows: language-aware security-scan-review workflow (#229) [MERGE AFTER playbook#157] (#230) (325b5b0)

Bug Fixes

• acq-kits: reject shell-metachar paths in kit specs (#225) (#236) (eb8a68c)
• playbook-kit: fetch via GitHub REST tarball for cross-backend auth (quickstart#203) (#269) (3fcde8e)
• router: stop broad workflow/trigger from displacing specific skills (#271) (#272) (c39396d)

v1.7.0

1.7.0 (2026-07-17)

Features

• acq-kits: add environment vocabulary to hybrid/v1 schema (#227) (7181d21)
• acq-kits: convert openchamber to hybrid/v1 and move to acq-kits/ (#224) (900d2fa)

v1.6.0

1.6.0 (2026-07-16)

Features

• integrations: add neutral hybrid/v1 acq-kits + schema + registry (#221) (f386458)
• sbx-kits: add opt-in openchamber mixin kit (#220) (9af380f)

v1.5.0

1.5.0 (2026-07-07)

Features

• ci: add unsafe-shell-pattern scanner + wire into CI (M3 #154, #155) (#210) (f281707)
• integrations: relax usai-provider permissions for sandbox use (#201) (6cb6cde)
• integrations: vendor git-ssh-sign sbx mixin kit (#200) (b791e04)
• sbx-kits: usai kit merges into global opencode config (#216) (5de0f3b)
• schema: add name field + tighten skill schema (additionalProperties: false) (#202) (3f298d1)
• skills: add Security Skills Pack M2 — 7 security review/authoring skills (#205) (c736287)
• skills: Security Skills Pack M2 updates — secure-code-review + dependency-analysis (#206) (f5e6898)
• test: security-skill fixtures + runner assertions (M3 #156/#157/#158, #203) (#212) (ecde334)

Bug Fixes

• ci: suppress low adhoc-packages zizmor findings in frontend-skills-qa (#215) (259ea27)