v1.9.0 — reference agent runners

The reusable worker loop a served agent runs. serve_queue claims from a TaskQueue, dispatches by operation to a handler, and completes each task (idempotent, lease-safe; a raising handler reports the exception type only). run_worker is the same loop over an A2A Worker. Both take stop / max_idle_rounds (serve-forever or drain-and-return), an injectable sleep, and a heartbeat hook (wire announce for a live-roster seat). hallpass runs no model loop of its own by design; the handler is where a model or tool call goes, acting with the agent's scoped token. Demo: examples/reference_agent.py. Additive; 320 tests, mypy --strict, ruff, catalog freshness green.

v1.8.0 — direct messages

A private 1:1 channel between two agents, as an auth-native construct. direct_channel(a, b) derives an order-independent channel name + single pair scope; open_dm(bus, a, b) declares it gated to that scope for both post and read. Privacy is the same scope gate as every other channel: a third party who learns the name but lacks the pair scope is denied opaquely. An ordinary channel once opened (post/catch_up/ack/roster all apply). Demo: examples/direct_messages.py. Additive; 310 tests, mypy --strict, ruff, catalog freshness green.

v1.7.0 — live roster / presence

Who is on an A2A channel right now. announce(principal, channel) heartbeats a live seat; roster(channel, within=) lists subjects seen in the window. Gated by the same scopes as the messages (announce = post, roster = read), opaque denial, and soft state that ages off and is never a grant, so an orchestrator can dispatch only to live workers and notice a dark one. Additive; 301 tests, mypy --strict, ruff, catalog freshness green.

v1.6.0 — auth-native routing

Route a task to a worker by capability, where capability is the auth scope set. Router.register(worker, scopes) / route(required) returns a capable worker (round-robin), or None if none is — the same scopes that gate tool calls decide who is capable, so work can't be routed to an unauthorized agent. The differentiator the harness-comparison research called out. Additive; 292 tests, mypy --strict, ruff, catalog freshness all green.

v1.5.0 — durable task queue

Durable, lease-based task queue (hallpass.taskqueue). TaskQueue on SQLite: claim hands one worker exactly one task under a write lock (no double-runs), an expired lease reclaims an abandoned task (dead-worker recovery), complete is idempotent by id, and results + backlog survive a restart. Crash-recovery + exactly-once, the two gaps the harness research flagged.

v1.4.0 — circuit breaker

Circuit breaker (CircuitBreakerHttpClient / BreakerPolicy): after a run of outages to a service the breaker opens and calls fail fast for a cooldown, then a half-open probe closes or re-opens it. Backpressure so a fleet of agents can't hammer a struggling downstream. Client errors never trip it; the clock is injected.

v1.3.0 — performance

Performance: pooled HTTP client (connection reuse; ~5x on loopback, more over TLS) + JWT verify cache (skip RSA on repeated tokens; ~160x on the hot path) + evals/benchmark.py throughput suite. HttpxClient gains close()/http2; TokenVerifier gains cache_size. Measured, not claimed.

v1.2.0 — agent spawning

Agent spawning (hallpass.agents). The orchestrator can now create scoped agents, not just dispatch to existing ones. Team.spawn(AgentSpec) mints each agent a token carrying only its harness scopes and launches it through a pluggable Spawner (default SubprocessSpawner), passing name/token/task/channel by env; AgentContext.from_env() picks it up inside the process. Each spawned agent is a scoped identity, not a trusted one. Model-agnostic: the loop inside is yours. Demos in examples/spawn_agents.py.

v1.1.0 — orchestrator

Orchestrator harness: an agent that drives worker agents, composed from A2A channels + FLEX + identities + scope gating. Orchestrator.dispatch/gather + Worker with per-operation handlers; tasks and results are FLEX messages tagged by id. Rides A2ABus so it is scope-gated, durable, and audited; at-least-once with gather de-dup. Runnable demo in examples/orchestrator.py. Additive over 1.0.

v1.0.0 — stable

First stable release. The public API is committed to under semver from here. hallpass is the multi-user auth core public MCP servers are missing: per-user OAuth 2.1 verification, an encrypted per-user credential vault, and call-time scope gating, plus a 47-service/115-tool connector catalog, the full OAuth connect lifecycle (connect/refresh/consent/revoke), A2A channels with the FLEX message language, a runnable HTTP server + CLI, and the operational layer (audit+latency, rate limiting, idempotency, doctor). See CHANGELOG.md.