v1.2.0-beta.1

What's Changed

• docs(security): consolidate open findings across 5 audits into register.md by @kungfuk3nnyyy in #1132
• fix(workers): gate outcomes.classify_issues at risk-tier high by @kungfuk3nnyyy in #1133
• docs: seam-level JSDoc on the highest-traffic internal interfaces by @kungfuk3nnyyy in #1135
• docs: subsystem READMEs for high-traffic src/ and dashboard/extension dirs by @kungfuk3nnyyy in #1134
• docs+ci: add advisory docs-drift guard, fix stale coverage-threshold claim by @kungfuk3nnyyy in #1136
• test: cover the two 0%-coverage test cliffs (haltPushDispatch, approvalInsights) by @kungfuk3nnyyy in #1137
• test: raise shadowScan.ts and replayRun.ts coverage (39%->95%, 54%->96%) by @kungfuk3nnyyy in #1138
• feat(dashboard): non-technical-user UX pass — jargon, density, leaked internals by @kungfuk3nnyyy in #1139
• feat(connectors): add Telegram bot connector by @kungfuk3nnyyy in #1140
• chore: gitignore three personal working docs by @kungfuk3nnyyy in #1141
• fix(dashboard): UI/UX pass on Overview panes by @kungfuk3nnyyy in #1142
• fix(templates): add missing allowWrites to triage-failing-tests-autofile by @kungfuk3nnyyy in #1144
• feat(test): route npm test through the bridge's runTests tool when available by @kungfuk3nnyyy in #1145
• docs: refresh README dashboard screenshot by @kungfuk3nnyyy in #1146
• chore(release): bump to 1.1.0-beta.2 by @kungfuk3nnyyy in #1147
• fix(start-all): stop supervisor from causing bridge/IDE flakiness by @kungfuk3nnyyy in #1148
• perf: fix top hot-path findings from perf sweep (AJV, glob, git status, worker-trust, HTTP reparse) by @kungfuk3nnyyy in #1149
• fix(runVSCodeTask): stop success:false extension responses being reported as tool success by @kungfuk3nnyyy in #1151
• fix(runInTerminal): stop shell-integration-unavailable being reported as success + fix output-drain race by @kungfuk3nnyyy in #1150
• fix(bridge): resume WS sessions by client session ID, not a fresh UUID by @kungfuk3nnyyy in #1152
• fix(push): wire real phone approval-gate notifications by @kungfuk3nnyyy in #1153
• fix(tools): reject empty-string workspace + null bytes in editText by @kungfuk3nnyyy in #1154
• fix(workers): dogfood-setup review — trust-store overwrite, owns[] drift, allowWrites gaps by @kungfuk3nnyyy in #1155
• chore(release): bump to 1.1.0-beta.3 by @kungfuk3nnyyy in #1156
• feat(policy): deterministic patchwork.policy.yml enforcement by @kungfuk3nnyyy in #1157
• fix(policy): enforce patchwork.policy.yml even when approval gate is off by @kungfuk3nnyyy in #1158
• feat(policy): enforce per-worker allowedTools inside executeStep by @kungfuk3nnyyy in #1159
• feat(recipes): general-purpose circuit breaker for tool calls by @kungfuk3nnyyy in #1160
• feat(recipes): ephemeral rollback for file-write steps by @kungfuk3nnyyy in #1161
• feat(recipes): flight-recorder replay for flat (manual/cron/webhook) recipes by @kungfuk3nnyyy in #1162
• fix(security): 17 findings from multi-agent adversarial review of #1157-#1162 by @kungfuk3nnyyy in #1163
• docs: record trust-architecture roadmap completion (#1157-#1163) by @kungfuk3nnyyy in #1164
• fix(recipes): captured step output never survived disk persistence by @kungfuk3nnyyy in #1165
• feat: let users create recipes and workers from the dashboard/copilot by @kungfuk3nnyyy in #1166
• fix(dashboard): match CLI bridge-lock discovery (EPERM-alive, CLAUDE_CONFIG_DIR) by @kungfuk3nnyyy in #1167
• fix(bridge): case-fold workspace paths in lock discovery for Windows by @kungfuk3nnyyy in #1168
• fix(supervisor): --watch no longer crashes when the child can't spawn at all by @kungfuk3nnyyy in #1171
• fix(extension): validate --workspace arg before shell:true bridge spawn by @kungfuk3nnyyy in #1172
• fix(bridge): oversized-lock cleanup no longer bypasses PID liveness by @kungfuk3nnyyy in #1170
• fix(bridge): don't accept sessions until plugin loading finishes by @kungfuk3nnyyy in #1173
• fix(onboarding): give first-time users an actionable path forward by @kungfuk3nnyyy in #1169
• fix(bridge): reset extensionProtocolMismatch on connection replace by @kungfuk3nnyyy in #1174
• fix(bridge): generation-guard the approval-decision cleanup path by @kungfuk3nnyyy in #1175
• fix(recipes): re-check kill switch immediately before each connector write by @kungfuk3nnyyy in #1176
• fix(bridge): resolve pending approvals with 'cancelled' on shutdown by @kungfuk3nnyyy in #1177
• fix(recipes): dedup redelivered webhooks against the write-effect ledger by @kungfuk3nnyyy in #1178
• fix(recipes): stage installs + atomic rename so a crash mid-copy can't install a live, incomplete recipe by @kungfuk3nnyyy in #1179
• fix(approvals): dismiss phone push when a pending approval is cancelled server-side by @kungfuk3nnyyy in #1180
• fix(plugins): don't advance the plugin registry when a hot-reload fails on a live transport by @kungfuk3nnyyy in #1181
• fix(oauth): enforce Mcp-Session-Token in OAuth mode instead of treating a missing header as automatically allowed by @kungfuk3nnyyy in #1182
• fix(automation): fix DNS-rebinding IP-pinning silently no-op'ing for uppercase hostnames by @kungfuk3nnyyy in #1183
• fix(dashboard): stop bundle-install panel from double-counting recipes on retry by @kungfuk3nnyyy in #1184
• fix(dashboard): close the marketplace browse-grid one-click install bypass (same class of bug as #1185) by @kungfuk3nnyyy in #1186
• fix(dashboard): gate one-click install on YAML-vs-metadata trust divergence, not just registry metadata by @kungfuk3nnyyy in #1185
• fix(dashboard): match marketplace detail pages' fetch-cache revalidate to their route-segment ISR window by @kungfuk3nnyyy in #1187
• fix(dashboard): replay preflight now flags auto-generated positional step ids as unmocked by @kungfuk3nnyyy in #1188
• fix(dashboard): force AI-generated recipes disabled on save, same fix as copilot chat's installGeneratedRecipe (#1189) by @kungfuk3nnyyy in #1190
• fix(dashboard): check the response of the copilot-install disable PATCH before claiming success by @kungfuk3nnyyy in #1189
• fix(dashboard): bulk-reject reuses decide() so it gets the same audit-reason capture and 409 handling as single-item reject by @kungfuk3nnyyy in #1191
• fix(dashboard): guard bulk "Discard expired" against a second concurrent pass by @kungfuk3nnyyy in #1192
• chore(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /services/push-relay by @dependabot[bot] in #1193
• chore(release): bump to 1.1.0-beta.4 by @kungfuk3nnyyy in #1194
• chore: gitignore vps-backups/ by @kungfuk3nnyyy in #1195
• Codex/ChatGPT smallest-safe-milestone: OAuth issuer host fix, HTTP tools/call coverage, codex doctor by @kungfuk3nnyyy in #1196
• fix(dashboard): bulk approve enforces the evidence gate on irreversible actions by @kungfuk3nnyyy in #1197
• fix(oauth): replace Mcp-Session-Token requirement with bearer-hash session binding by @kungfuk3nnyyy in #1198
• feat(drivers): add core CodexDriver (unwired, not yet selectable) by @kungfuk3nnyyy in #1199
• feat(drivers): wire CodexDriver as selectable --driver codex by @kungfuk3nnyyy in #1200
• feat(recipes): wire codex as a selectable recipe agent-step driver by @kungfuk3nnyyy in #1201
• fix(recipes): translate worker sandbox to codex's coarse lockdown by @kungfuk3nnyyy in #1202
• docs(recipes): pin codex as intentionally unbilled (step 5) by @kungfuk3nnyyy in #1203
• fix(policy): close two fail-open holes in policy.yml enforcement by @kungfuk3nnyyy in #1204
• fix(recipes): recognize bare {error} connector failures in the effect ledger by @kungfuk3nnyyy in #1205
• fix(transport): route reconnected tool-call responses to the live socket by @kungfuk3nnyyy in #1206
• fix(workers): close worker-sandbox enumeration gap for destructive tools by @kungfuk3nnyyy in #1207
• fix(docs): remove documented plugin ctx.registerTool() API that doesn't exist by @kungfuk3nnyyy in #1208
• fix(connectors): stop a stale in-flight refresh from resurrecting cleared tokens by @kungfuk3nnyyy in #1209
• fix(bridge): stale connection close must not tear down a replacement session by @kungfuk3nnyyy in #1210
• fix(dashboard): correct kill-switch UI copy overstating its scope by @kungfuk3nnyyy in #1211
• chore(deps): resolve 3 open Dependabot alerts by @kungfuk3nnyyy in #1212
• fix(dashboard): pin sharp to 0.35+ to close libvips CVEs by @kungfuk3nnyyy in #1213
• feat(approvals): risk-tiered approval timeouts, live-configurable by @kungfuk3nnyyy in #1214
• fix(oauth): advertise RFC 9207 iss echo in discovery doc by @kungfuk3nnyyy in #1215
• docs(transport): record why elicit() has no caller and must not be deleted by @kungfuk3nnyyy in #1218
• chore(deps): bump brace-expansion from 5.0.7 to 5.0.9 by @dependabot[bot] in #1219
• chore(deps-dev): bump postcss from 8.5.15 to 8.5.25 in /vscode-extension by @dependabot[bot] in #1220
• chore(deps): pin postcss >= 8.5.25 to close 3 Dependabot alerts by @kungfuk3nnyyy in #1221
• docs(connectors): record why 12 webhook verifiers have no ingress path by @kungfuk3nnyyy in #1222
• feat(recipes): prompt for missing required vars over MCP elicitation by @kungfuk3nnyyy in #1223
• fix(drivers): drop unsupported codex --ask-for-approval, expand /v1 endpoints by @kungfuk3nnyyy in #1224
• fix(dashboard): render inbox bodies statically, hide frontmatter, unstick edit rail by @kungfuk3nnyyy in #1225
• chore: untrack local-only research/config files, ignore demo bundles by @kungfuk3nnyyy in #1226
• docs(adr): ADR-0017 — decision-record actor + a third terminal gate state by @kungfuk3nnyyy in #1227
• feat(identity): workspace members, roles and segregation of duties by @kungfuk3nnyyy in #1228
• fix(gate): refuse unknown gate actions instead of reporting or queueing them by @kungfuk3nnyyy in #1229
• feat(gate): attribute decisions to an actor, and correct ADR-0017 by @kungfuk3nnyyy in #1232
• feat(identity): load the workspace roster at bridge startup by @kungfuk3nnyyy in #1230
• feat(workers): forbidden-action policy predicate by @kungfuk3nnyyy in #1231
• feat(gate): forbid — a third terminal state no approval unlocks by @kungfuk3nnyyy in #1233
• docs: record the forbid terminal state and the identity model by @kungfuk3nnyyy in #1234
• feat(gate): attribute autonomous allows to the worker that acted by @kungfuk3nnyyy in #1235
• feat(workers): previewActions — prospective evaluation of the control boundary by @kungfuk3nnyyy in #1236
• feat(dashboard): the three-column control boundary by @kungfuk3nnyyy in #1239
• docs(adr): correct a stale approval-TTL claim in ADR-0017 by @kungfuk3nnyyy in #1237
• docs(adr): ADR-0018 (Proposed) — durable approvals by @kungfuk3nnyyy in #1238
• feat(workers): derive a default candidate set for the boundary view by @kungfuk3nnyyy in #1240
• feat(workers): boundaryForRecipe — resolve a live worker's control boundary by @kungfuk3nnyyy in #1241
• feat(workers): GET /workers/boundary — HTTP route for the control boundary by @kungfuk3nnyyy in #1243
• feat(dashboard): wire the control boundary into the recipe detail page by @kungfuk3nnyyy in #1244
• docs: record the control boundary (prospective gate evaluation) by @kungfuk3nnyyy in #1242
• feat(workers): durable approval requests — ADR-0018 first slice by @kungfuk3nnyyy in #1245
• feat(dashboard): make unowned approvals visible — ADR-0018 point 4 by @kungfuk3nnyyy in #1246
• docs: sweep the in-flight ledger — every Active entry had merged by @kungfuk3nnyyy in #1247
• docs: correct two stale approval claims in CLAUDE.md by @kungfuk3nnyyy in #1248
• feat(workers): a configuration surface for forbidden actions by @kungfuk3nnyyy in #1249
• chore: ignore demo bundles by pattern instead of by name by @kungfuk3nnyyy in #1250
• chore(deps): bump ip-address from 10.2.0 to 10.4.0 in /services/push-relay by @dependabot[bot] in #1251
• chore(deps): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #1252
• chore(deps): bump fast-uri from 3.1.4 to 3.1.5 by @dependabot[bot] in #1253
• fix(dashboard): match connector namespaces as tokens, not substrings by @kungfuk3nnyyy in #1254
• docs: scope the governed workspace, draw the open-core boundary by @kungfuk3nnyyy in #1255
• fix(recipes): run or reject compound steps, never silently skip by @kungfuk3nnyyy in #1256
• fix(config): honour PATCHWORK_HOME for config.json and recipesDir by @kungfuk3nnyyy in #1258
• feat(recipes): fan_out agent sub-steps, budget-admitted per iteration by @kungfuk3nnyyy in #1257
• test: fail loudly when a test reaches a real model by @kungfuk3nnyyy in #1259
• chore(deps): patch undici and brace-expansion in the dashboard lock by @kungfuk3nnyyy in #1260
• chore: union-merge docs/in-flight.md by @kungfuk3nnyyy in #1261
• fix(workers): key value-bearing action classes by magnitude band by @kungfuk3nnyyy in #1267
• fix(recipes): stop discarding compensation identifiers; register 3 unreachable inverses by @kungfuk3nnyyy in #1268
• docs(plans): scope the Mr. Butler walking skeleton by @kungfuk3nnyyy in #1269
• fix(workers): surface magnitudeBand on the decision record and in CLI help by @kungfuk3nnyyy in #1270
• feat(butler): durable fact store + memory tools (walking skeleton phase 1) by @kungfuk3nnyyy in #1271
• feat(butler): ambient memory card in the MCP instructions block by @kungfuk3nnyyy in #1272
• feat(butler): task-management action classes + errands worker (phase 3) by @kungfuk3nnyyy in #1273
• fix(butler): sanitise fact text before it reaches the system prompt by @kungfuk3nnyyy in #1274
• fix(workers): carry step params into trust evidence; de-binary 3 source files by @kungfuk3nnyyy in #1275
• docs(plans): scope the Butler UI build in the large-print direction by @kungfuk3nnyyy in #1277
• fix(butler): make the trust tiers mean what the docstrings claim by @kungfuk3nnyyy in #1276
• feat(butler): HTTP surface for the fact store (phase A) by @kungfuk3nnyyy in #1278
• feat(butler): standing permissions (phase B) by @kungfuk3nnyyy in #1279
• feat(butler): the large-print page (phase C) by @kungfuk3nnyyy in #1280
• fix(recipes): evaluate == / != in when, refuse the rest loudly by @kungfuk3nnyyy in #1281
• chore(docs): licensing + security documentation pass, and three gates to keep it by @kungfuk3nnyyy in #1282
• chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in /dashboard by @dependabot[bot] in #1283
• fix(gitignore): stop publishing an index of private work by @kungfuk3nnyyy in #1285
• fix(ci): the CVE gate audited one of four lockfiles by @kungfuk3nnyyy in #1286
• chore(ci): remove the Pages workflow that never published anything by @kungfuk3nnyyy in #1287
• docs: retire the demo bridge instance section by @kungfuk3nnyyy in #1288
• fix(deploy): deploy scripts aimed credentials at a hardcoded address by @kungfuk3nnyyy in #1289
• fix(recipes): stop the digest inventing links between entity tokens by @kungfuk3nnyyy in #1290
• fix(recipes): one resolver for the local model and endpoint by @kungfuk3nnyyy in #1291
• fix(butler): the approvals section could not render, and reject lied by @kungfuk3nnyyy in #1292
• fix(ci): two advisory checks that reported success while drifting by @kungfuk3nnyyy in #1293
• fix(recipes): fan_out ran in silence and an inert budget looked enforced by @kungfuk3nnyyy in #1294
• docs(adr): bound ADR-0020 by the open-core boundary by @kungfuk3nnyyy in #1295
• fix(butler): undo was a trust escalator by @kungfuk3nnyyy in #1296
• docs: a real third-party licence inventory, and a gate to keep it by @kungfuk3nnyyy in #1297
• test(butler): widen the a11y guarantees before any new UI can break them by @kungfuk3nnyyy in #1298
• fix(workers): the shadow gate disagreed with the gate it shadows by @kungfuk3nnyyy in #1299
• fix(workers): the shadow gate now honours the worker's own forbids by @kungfuk3nnyyy in #1300
• docs: the architecture doc claimed a guarantee the code does not give by @kungfuk3nnyyy in #1301
• fix(docs): the quickstart told users to run a command that does not exist by @kungfuk3nnyyy in #1302
• refactor(workers): name the dial-trajectory harness for what it does by @kungfuk3nnyyy in #1303
• fix(cli): --help advertised a verb that does not exist, and two that do by @kungfuk3nnyyy in #1304
• chore(identity): drop a capability this runtime cannot enforce by @kungfuk3nnyyy in #1305
• docs: public docs quoted a plan the reader cannot buy here by @kungfuk3nnyyy in #1306
• feat(workers): trust evidence that survives the run log by @kungfuk3nnyyy in #1307
• fix(paths): the audit ledgers ignored PATCHWORK_HOME (#1265) by @kungfuk3nnyyy in #1308
• chore: sweep the in-flight entry for #1307 by @kungfuk3nnyyy in #1309
• docs: stop naming a prospective partner in a public repo by @kungfuk3nnyyy in #1310
• feat(ci): stop the action-class gap from growing (#1311) by @kungfuk3nnyyy in #1312
• fix(workers): connector reads were gated as irreversible (#1311 batch 1) by @kungfuk3nnyyy in #1313
• fix(workers): give irreversible writes a real domain (#1311 batch 2) by @kungfuk3nnyyy in #1314
• fix(connectors): Todoist targeted a retired API version by @kungfuk3nnyyy in #1315
• fix(butler): three things the first real errand run found by @kungfuk3nnyyy in #1316
• feat(dashboard): Simple mode lands on Butler, not the Overview deck by @kungfuk3nnyyy in #1317
• feat(workers): key outcomes on the action, not on a URL that never existed by @kungfuk3nnyyy in #1318
• feat(workers): silence stops counting as approval by @kungfuk3nnyyy in #1319
• fix(workers): a thought is not evidence by @kungfuk3nnyyy in #1320
• chore(docs): sweep the in-flight ledger by @kungfuk3nnyyy in #1321
• fix(workers): an unidentifiable action is not an approved one by @kungfuk3nnyyy in #1322
• chore(docs): sweep the in-flight ledger (#1322) by @kungfuk3nnyyy in #1323
• fix(init): ship the approval hook init writes into the user's CC config by @kungfuk3nnyyy in #1324
• fix(cli): init means the same thing whichever bin the user typed by @kungfuk3nnyyy in #1325
• chore: raise engines.node to the version CI actually tests by @kungfuk3nnyyy in #1326
• chore(docs): sweep the in-flight ledger — #1324/#1325/#1326 merged by @kungfuk3nnyyy in #1327
• chore(release): bump to 1.2.0-beta.1 by @kungfuk3nnyyy in #1329
• fix(test): npm 12 changed the pack --json shape, breaking the release by @kungfuk3nnyyy in #1330

Full Changelog: v1.1.0-beta.1...v1.2.0-beta.1