v0.7.0

Changelog

• 22f980e feat(release): ship the desktop app signed, notarized and stapled
• 013ab45 docs(site): add the desktop app and model picker to the feature list
• 07d30b9 Merge branch 'feat/model-picker' into main
• 99ad9fc Merge branch 'main' into feat/model-picker
• f139821 docs: record this branch's work in the changelog
• 28954cc feat(freellm): meter every turn, not only the CLI's one-shot path
• b01ff77 feat: wire wave assignment and the revision breaker into the run loop
• 5a559c7 fix(modelcat): report a corrupt settings file instead of swallowing it
• 813a3a4 fix(freellm): stop a failed odometer read from destroying the reading
• c4769d3 fix(phaseflow): keep a contract task in wave 0 through AssignWaves
• f19f613 feat(serve): make the pipeline dashboard actually live
• f26622f test(phaseflow): make the Save-vs-Update guard actually exercise Save
• 49a9007 fix(modelcat): apply the exclusion list to the model already in use
• 285ea73 fix(desktop): give each session turn its own client for its own model
• 8ac4599 test(desktop): pin that concurrent turns keep their own model
• 478d11f fix(modelcat): stop LoadSettings failing open on an unreadable file
• c488249 fix(tui): stop rendering a contract flag as a success
• 1481317 fix(desktop): refuse gated tool calls on the one-shot run routes
• f847688 fix(serve): let Ctrl-C reach the graceful shutdown path
• bcaadf6 fix(phaseflow): let a contract flag stop the run, not just the pass
• 4644b19 fix(desktop): stop typed text from deciding a pending approval
• 56bed65 fix(llm,orchestrate): stop two paths that misreport which model ran
• 5c4ed57 fix(phaseflow): hold a wave slot until the task's side effects are on disk
• 39f7716 fix(orchestrate): keep candidate models on the endpoint that can serve them
• 351d339 fix(freellm): meter each model against its own published quota
• cda17ce fix(serve): escape the dashboard's text last, and add a CSP
• d34549b security(tools): strip GIT_* from both shell tools' environments
• f07fddb fix(phaseflow): keep pre-revision attempts so the run report can see them
• b345d50 feat(serve): add the live pipeline dashboard at GET /pipeline
• 38b1f39 feat(serve): add pipeline state and live event routes
• 7fca813 feat(phaseflow): add end-of-run model performance summary
• 98ad142 fix(orchestrate): give each task agent its own client, not a shared one
• 8b50df5 feat(orchestrate): add LLMReviser, an LLM-backed phaseflow.Reviser
• ea38984 feat(phaseflow): wire the revision circuit breaker into the run loop
• dce3293 feat(phaseflow): add the Reviser seam and ApplyRevision
• 5d89780 docs: plan pipeline piece 5, live view and run summary
• 6bc6b98 docs: plan pipeline piece 4, the revision circuit breaker
• 5a73801 refactor(phaseflow): report attempts through a callback, not a shared field
• ba89363 feat(phaseflow): add the contract flag and Task.IsContract
• 40851bd feat(phaseflow): run each wave's tasks concurrently, bounded by a limit
• 368d76b feat(phaseflow): add AssignWaves, a pure DependsOn -> wave computation
• e8c2a77 docs: plan pipeline piece 3, waves and parallel execution
• 2cf599e fix(phaseflow,tui): stop reporting an exhausted task as a success
• 2aa9370 feat(phaseflow,orchestrate): persist attempts and wire model-picker fallback
• 8b16bc4 fix(phaseflow): keep round retries away from needs_revision/escalated tasks
• 680c1c9 feat(phaseflow): add FallbackRunner for sequential per-task model fallback
• 0430cc5 docs: plan pipeline piece 2, per-task model fallback
• 694ec78 fix(phaseflow): lock Save too, so it cannot clobber a concurrent Update
• e544d20 feat(phaseflow): add wave, dependency, candidate-model and attempt history fields to Task
• 65b22a8 fix(phaseflow): make the assignments store concurrency-safe
• f5a6d6c refactor(lockfile): extract the file-claim pattern for reuse
• d50597f docs: plan pipeline piece 1, task model and a safe store
• d0e1b65 docs: design for the contract-first task runner pipeline
• 41a67e0 feat(desktop-ui): model picker dropdown and settings panel
• d2cadb1 feat(desktop): apply the model picker's policy before each turn
• 055e02f feat(modelcat): add Next, the pure model selection policy
• 6ee7ed5 fix(modelcat): do not derive a model link from a routing variant
• a1620f7 feat(serve): expose the model catalogue and settings over HTTP
• 8b38e6a feat(modelcat): assemble the model catalogue
• dcca922 feat(modelcat): settings store for model preference and links
• 2e7828d docs: plan model picker phase 3, selection policy and UI
• d602cc2 docs: plan model picker phase 2, catalogue and settings API
• befdfc1 fix(freellm): meter the model that served the turn, not the configured one
• 50d42a8 feat(freellm): per-model trip meters, and record the model per turn
• f288041 feat(freellm): meter usage per model, additively
• 1ff718b test(freellm): pin odometer backward compatibility before adding per-model
• 2ea12e8 docs: plan model picker phase 1, per-model metering
• 42ca4b3 fix(release): disable winget/scoop, document the ambiguous-identity trap
• d52655a fix(release): notarize before publishing, not after
• 6f5a9fc docs: custom model and provider URLs, and one settings object
• 8df6266 docs: make every model-picker judgment call a setting
• 7bb9543 docs: spec the model picker, per-model metering and proactive cycling
• 53b3b93 fix: stop inherited GIT_DIR from redirecting git subprocesses
• 872a517 feat(desktop): wire real human approval into the embedded server
• 0f46363 security: drop the author email from desktop/wails.json
• 6cc97e3 fix(desktop): allow the WebView's real origin so the app can reach its server
• c7616b8 fix(desktop): stop the 5-minute startup hang, fall back to a free LLM provider
• 26650bd feat(desktop): scaffold the Wails shell with an embedded serve instance and a working Chat screen
• 3037b7f refactor(serve): split NewMux from Serve, add graceful shutdown
• a58985f refactor(serve): move the HTTP serve layer to internal/serve
• 1269ce6 docs: plan the internal/serve extraction (desktop app Phase 0)