v0.1.3

Added

• Explicit embedded or external project Harness selection, verified external Git identity and revision snapshots, a machine-local Harness registry, and read-only config path/check/show/explain inspection with effective-value provenance.

• Local-first initialization through touchstone init --backend local, portable fleet checkout keys, and repository-specific launchd identities so multiple scheduled audits coexist on one Mac.

• A project covers many repositories. A project file holds the Loops, engines, and schedules that are the same everywhere; touchstone sync --check reports which members differ from what it renders, and touchstone sync --pr proposes each drifted member's fragment as a pull request. Members name that fragment with extends and override any key they disagree with, so precedence runs from machine-owned evidence, through the fleet's decisions, to the repository's own word. There is no direct-write path, a project may not set target, generated, project, state_dir, or version, and a credential-shaped key that is not an op:// reference is refused.

• A container backend, one repository per container. touchstone sync --compose renders one service per member, each with its own checkout, state volume, and credential set. The image carries Touchstone, git, gh, and the Agent CLI from its committed lockfile and nothing a project owns; a repository needing a toolchain derives from it. The supervisor is a fixed-interval wake signal over the existing run-due, not a second clock, and a failed wake is a failed run rather than a failed supervisor.

• A named engine pool. Any subtable of [engine] other than budget is a pool member, and loop.<name>.engine chooses one, so a Loop hunting hardcoded values can run on a cheap model while one judging naming runs on a strong one — or on another provider. [engine] remains the member called default, so this stays schema v2. A member carries api_key_env, since two members can speak the same API and hold different keys; the session receives that value under the variable its own CLI reads and never learns the original name. A named variable that is absent fails rather than falling back to the vendor key. api_key_ref records where the operator's own store holds it, and doctor prints the command that would resolve it without ever running one.

• A per-Loop merge policy, not just a switch. auto_merge_strategy picks squash, merge, or rebase — doctor compares it against what the repository permits, because attempting a forbidden one fails after the pull request already exists. auto_merge_window bounds when a merge may be armed, in the configured timezone, so a project can keep unattended merges out of Friday afternoons and the middle of the night; it bounds arming rather than completion, since the forge merges once the required checks pass. auto_merge_max_files leaves a larger change for a person, counted from the same path list the risk classifier already builds rather than from git diff --name-only, which misses the untracked files a commit picks up. auto_merge_delete_branch controls branch cleanup. Configuring any of these without auto_merge = true is refused: it reads as a policy and behaves as a pull request that waits forever. A forge that refuses to arm the merge now says so on the pull request record instead of leaving it indistinguishable from a condition that simply was not met.

• Per-Loop auto_merge, off by default. Arming requires low risk, an approving independent review, a ready pull request, passing Validation Gates, a repository that allows auto-merge, a declared required workflow, and a protected base branch; any unmet condition leaves the pull request for a person and records which condition it was. A backend without an independent Verify stage refuses such a Loop with policy-unsupported before pushing a branch, rather than silently opening an ordinary pull request.

• git.author chooses which of two identities git records as the author of a published commit — the bot that ran the Loop or the configured operator — and credits the other in a Co-Authored-By trailer. A configuration without an operator pair behaves exactly as before.

• Built-in rust and dotnet Stack Profiles, detected from a Cargo manifest and a project file, with their gates materialized as disabled candidates.

• Concern briefs builtin:hardcode, builtin:naming, builtin:error-handling, and builtin:test-coverage, which name no language or framework: a Profile declares its naming conventions in a [naming] table, profile refresh renders a Target's whole Profile Set into the generated Loop context, and the brief reads them from there.

• engine.base_url routes model calls to a self-hosted or third-party endpoint instead of the vendor's own, with engine.wire_api selecting the HTTP shape for Codex. Claude reads the address from ANTHROPIC_BASE_URL; Codex is given a named provider so the address, the wire shape, and the variable holding the key are declared together and the key itself never reaches a command line. The address must be https unless it is loopback, and may carry no query string or userinfo.

• Declarative built-in Profiles for generic, JavaScript, Node.js, TypeScript, React, Next.js, Python, FastAPI, and Django repositories.

• Bounded monorepo Target discovery for npm, pnpm, Yarn, Bun, uv, Poetry, and PDM evidence, including dependency-aware affected scope applied to local, hosted, and rehearsal validation.

• Schema-v2 project/generated configuration ownership, deterministic Profile refresh, and an explicit backup-first v1-to-v2 migration command.

• Structured preparation and Validation Gates with disabled-by-default detected candidates.

• Durable Due Slots shared by native schedulers and GitHub-hosted wake signals.

• Repository-owned GitHub Actions workflow generation, immutable Action pins, encrypted state/candidate artifacts, and split Prepare, Analysis, Verify, Publish, and Snapshot trust stages.

• Resumable owner-controlled GitHub App Manifest setup and hosted setup diagnostics.

• Hash-locked Python Action dependencies and integrity-locked Codex and Claude npm runtimes.

• A credential-free Preparation Stage that installs locked project dependencies and attests them to the repository HEAD, configuration digest, Target set, and lockfiles.

Removed

• actions.codex_cli_version and actions.claude_code_version; the hosted Agent CLI version is read from the Action's committed npm lockfile. A configuration that still sets either key fails with a message naming that key rather than a bare unknown-key error.

Changed

• Run outcomes and pull-request lifecycle states are separate machine contracts.
• Publication is PR-only by default; Touchstone no longer enables or requires GitHub auto-merge.
• status is read-only, while reconcile performs explicit lifecycle reconciliation.
• Operator resume decisions are approve, close, or reanalyze and remain bound to the reviewed candidate.
• Generated configuration records package managers per Target, expresses validation commands in that Target's own package manager, removes stale detected Profiles on refresh, re-adopts nested standalone projects the configuration already names, and supports repository-local declarative detectors.
• Hosted visibility and wake cadence are configurable during initialization; dry runs execute configured preparation and validation before stopping publication.
• Target IDs prefer package identity, survive checkout-directory changes, and retain existing configured IDs by repository-relative path during Profile refresh.
• Locked preparation is hook-free per package manager; Poetry reports a structured policy-unsupported result instead of installing with build hooks unless they are explicitly allowed.
• touchstone actions init resolves the release tag matching the installed distribution instead of the Action repository's default branch.
• Profiles enable only side-effect-minimal Validation Gates: git diff --check runs without review, every command that executes project code stays a disabled Candidate, and a repository-local Profile can no longer enable one.
• touchstone actions setup --organization stores App secrets as organization secrets restricted to the selected repository, and later checks read organization and repository secrets together.
• touchstone doctor reports a gh release older than 2.64, which cannot complete pr edit since GitHub sunset Projects (classic) and therefore cannot label a published pull request.

Fixed

• touchstone actions setup stores the one-time App private key before verifying the installation, so an install a person has not finished yet no longer consumes a key GitHub cannot reissue. A verdict that condemns the App — wrong permissions or a wider repository scope — still takes the stored key back, so a rejected App leaves nothing a workflow could mint a token from.
• touchstone actions setup can register an Owner App. The manifest omitted hook_attributes.url, which GitHub requires even for an inactive webhook, so registration was rejected outright; the CSRF state was also sent as a form field rather than in the action URL, so the callback carried no state to check.
• A parked draft no longer stops the code audit. Whether an open draft holds a loop's pull-request slot was inferred from require_change_under being set, which named the harness review exactly as long as it was the only loop with source paths to maintain; generated stack evidence began setting them for the code audit, and the inference started reporting the opposite of what it meant. The code audit parks every medium-risk finding as a draft, and a parked draft waits for a person and is never reaped, so its first medium-risk finding held the slot against every run that followed. The policy is now the loop's own drafts_hold_slot, false by default, and a migrated v1 harness review keeps it...

v0.1.2

Fixed

• Render README images correctly on both GitHub and PyPI.
• Use portable absolute links for documentation, configuration, security, contribution, changelog, and license resources.
• Guard packaged README resources against relative-URL regressions.

v0.1.1

Fixed

• Publish the stable pipx install touchstone-agent onboarding path on both GitHub and PyPI.
• Keep the documented release link aligned with the package version.

Touchstone 0.1.0

First public release of Touchstone.

• installable touchstone-agent package and touchstone CLI
• strict discovered TOML configuration with diagnostics and idempotent setup
• independently reviewed GitHub pull-request lifecycle with safe park/resume
• launchd and systemd user scheduling
• credential-free PyPI publishing through GitHub OIDC

See CHANGELOG.md for the complete release notes.