AgentGit v0.2.0-rc.3

Added

• Home now supports searching visible work, filtering by repository and category, manual refresh and a last-successful-refresh timestamp. Partial reads and truncated summaries are explicitly marked; failures never imply that the work queue is clear.

• Change-request search and role-aware links to editing files or giving an agent work; glossary hints in repository navigation and table headers.

• A focused beta programme with public acceptance gates, pilot reporting, contributor entry points and a launch kit. Alpha status remains until external evidence meets the gates.

• ag remote explain PROPOSAL reports a server proposal's blockers, reasons and next commands with machine-readable output and distinct ready/blocked/refused exit codes.

• Policy regression coverage for preset actor/author restrictions, provenance, file limits, approval explanations and validation age formatting.

• Load scenarios verify acknowledged stream updates and read back each worker's last successfully written files
  after concurrent integrations. Empty write runs, zero duration and zero workers are rejected. Performance smoke
  runs also cover server/core pull requests and fail on execution or integrity errors without timing thresholds.

• Zero-setup start. ag-server dev makes a data directory, an administrator with a fresh 8-hour credential (replaced
  and the old one revoked at every start), the demo repository demo/welcome with the agents preset, and a reviewer
  user:reviewer, then prints a link that signs you in (...#token=...; the Web UI takes the credential out of the
  address bar at once) and the exact commands. Loopback only unless --allow-non-loopback. ag login URL --token-file FILE / ag logout URL keep a credential per server in credentials.json (mode 0600), which clone, fetch, pull,
  push and ag remote find on their own after AG_TOKEN*. The link is not one-time (that needs a new endpoint).

• Policy presets solo, team, agents, strict, as data in ag-policy: ag policy preset list|show|apply,
  ag init --preset, ag remote policy --preset, ag-server admin policy-preset. ag policy explain [FILE|current] and
  ag remote policy --explain read any policy document in plain words; a test fails when Policy gains a field without a
  sentence.

• ag explain [PROPOSAL] turns a refusal into plain words and the exact next commands (one explanation per refusal
  code, checked against the variants); the hints under ag integrate and ag remote integrate|prepare use the same
  strings. The remote workflow also supports ag remote explain PROPOSAL.

• A Web UI a first-time user can use (docs/design/web-ux-review.md): Home ("needs your attention") and navigation by
  job (Overview, Change requests, Agents & work, Code, Settings); plain labels with the AgentGit word in a tooltip
  (lib/glossary.ts, checked against the guide); every blocker carries its fix as an action (request validation, ask a
  reviewer, take the lease) and a "Next:" line; guided flows (new-repository wizard, getting-started checklist, "Give an
  agent work" that grants the role and mints the credential); a rules editor with presets and sentences, raw JSON under
  Advanced; editing a file and proposing it from the browser, with a conflict resolver; empty states that say what to do.
  Proven by e2e/jobs.spec.ts: a fresh user does each of the five jobs in a real browser against a real server, using
  only what the screen says. No server change.

• Tests that cannot pass by not testing. A shared helper per language (ag-testkit, Go testutil, ag_testkit.py,
  e2e/support/components.ts): a missing component fails when AG_REQUIRE_COMPONENTS names it (or all), otherwise it
  skips with an AG-SKIP marker and a JSON report. scripts/check_skips.py fails a CI job on a skip not in
  tests/skip-allowlist.toml (reason, owner and where it runs for real are mandatory) and, with --scan, on any raw
  skip outside the helpers; every test job runs it. Inventory: docs/architecture/test-skips.md.

• ag agent reap --remote [NAME] [--timeout D] [--dry-run]: reaps the silent runs of a server from the command
  line (AgentService.ReapRuns, needs agent.operate, audited under the caller as run.abandon); the local form
  gained --dry-run. The periodic reaper takes a run-reaper lease in the control database before each pass, so one
  replica of several reaps (the lease is time-based; two replicas briefly reaping together is harmless because a
  reap is idempotent). ADR-0011.

• Metadata schema 3: three indexes so that every page of list_proposals is read in index order without sorting,
  and idempotency records written before they carried a time are dated once by the first sweep and then expire.
  Metadata schema 3 is not readable by builds that only know schema 2: in a rolling upgrade start the new build
  first (ADR-0007). The control schema stays at 3.

• Decoded-tree cache with a memory budget (repos.tree_cache_bytes, default 256 MiB; 0 switches it off) and
  metrics agwp_tree_cache_*. At 100 000 files a fast-forward went from about 330 to about 180 ms, a three-way merge
  from 880-1 050 to about 200 ms and the publish of one file from 86 to 32-38 ms; peak RSS of that run grew from
  168 to 714 MiB with a 512 MiB budget (numbers).

• Bounded retry of same-stream contention inside the call (repos.integrate_attempts, default 24;
  repos.integrate_backoff_ms, default 32; 1 means one attempt). aborted answers at 16 writers went from 14-16 %
  to 3-4 %; the tail is longer because losers now wait inside the call (p99 0.5-0.6 s to 0.8-1.5 s).

• Job-claim fencing token (ADR-0012): optional fencing_token on job
  heartbeat, complete and fail, no schema change; a stale claimant of the same worker name is refused. ag-worker
  sends it; the OpenAPI document, both SDKs and the Web UI types are regenerated. It is opt-in per request: an old
  worker is as exposed as before.

Changed

• The Go suite requires ag-server in CI (ag-server-binary) and finds it through cargo metadata; the Keycloak Rust
  tests are no longer #[ignore] (they skip in plain cargo test and are required in the identity-provider job); the
  scripts run on Python 3.9 (scripts-py39 job, from __future__ import annotations). The Web UI opens on Home; the
  old words (proposal, integrate) became Change requests and Land, with the old word in a tooltip.
• An integration costs 3 durable commits instead of 7 (fast-forward) or 8 (merge): the intent is written ready,
  tokens only if they changed, one derive commit. ag-bench load streams (16 clients over HTTP, 3 alternating rounds):
  87.6 to 100.0 integrations/s (+14 %, on a shared VM where less than 30 % is noise). Crash recovery at every step and
  recovery of an operation left prepared by an earlier build are unchanged and tested.
• Storage API: Tx::job_heartbeat/complete/fail take a claim: Option<u32> argument;
  Repository::with_tree_cache, with_contention_policy and Meta::committed_writes are new; the tree-size estimate
  lives in agentgit-storage (approx_tree_bytes).
• The README (English and Russian) and the release documents state the published v0.2.0-rc.2 and what was verified
  about it; docs/operations/releasing.md records the owner's gh attestation verify of both images.

Fixed

• Include the shipped ag-mcp executable in the release SBOM inventory.

• Reject incomplete archives before replacing installed binaries and explain when an older GitHub CLI cannot verify attestations.

• Keep readable proposals when another detail or the agent-run list cannot be loaded.

• Python and TypeScript SDK integration harnesses enable the startup log used to discover ephemeral ports;
  an inherited RUST_LOG=error no longer causes false server-start timeouts.

• The orchestrator's process-group timeout test distinguishes a running child from a dead, unreaped Linux
  child, avoiding false failures in containers whose PID 1 does not reap orphans.

• Server log-capture tests share a persistent subscriber with per-thread buffers so concurrent tests do not
  invalidate each other's tracing callsite cache. The startup-warning test also ignores inherited log filters.

• Update ctutils to 0.4.4 in both Cargo lock files (RUSTSEC-2026-0385) and the UI's happy-dom to 21.0.4
  (GHSA-834v-8h66-3h79). Remove the obsolete tinypool exceptions after both npm dependency trees became clean.

• Found by the new gate: the PostgreSQL + S3 backends job never lifted the AppArmor restriction on user namespaces, so
  every namespace-sandbox test had been silently skipping there; it does now and requires namespace-sandbox.

• Test flakes: replicas of one test cluster could be given the same port ("Address already in use"); the ag-server dev
  tests expected a clean exit from a killed process on Windows.

• Dependencies: rustls-webpki 0.103.16 and webpki-roots 1.0.10 (RUSTSEC-2026-0381, -0382), certifi 2026.10.19 in
  the Python SDK lock; a CodeQL alert in the rules-change sentence of the Web UI.

• Test races found by CI (no product code changed): ag-mcp's closing_stdin_ends_the_process_cleanly waited for
  nothing and raced the stderr drain thread; the server's log-capturing tests lost a line to the shared tracing
  callsite and sigterm_and_sigint_stop_the_server_gracefully sent SIGINT before tokio had installed its handler
  (the server now installs the stop-signal handlers before it listens).

Known limitations

• Browser editing is one text file per change request (no rename, delete or multi-file); some tab labels and table headers still need glossary hints; Home is polled every 15 s, not live; the rules form leaves protected-path approvers and check timing in
  the raw JSON; no screen-reader pass. The Docker one-liner for ag-server dev is not verified (no Docker daemon here), and neither dev, login nor explain
  is in the v0.2.0-rc.2 archives. The root-only halves of the sandbox tests run in no CI job, and the four scripts
  that read TOML need Python 3.11 and are not in the 3.9 job.
• The tree cache clones a tree on every hit (7 ms at 100 000 files); the disk backend and PostgreSQL were not
  measured with it. Batching and the cache were not measured on PostgreSQL or S3. The reaper lease is not tested with
  real replicas on PostgreSQL and S3. Schema 3 adds three index entries per proposal write (not measured as a load).
• Fencing for job claims is not required by any server option yet (an old worker is as exposed as before).

Watch the workflow and join a pilot

Watch the three-minute exact-tree demonstration: a real namespace worker, separate reviewer approval, an old passing check rejected after the target changes, revalidation, integration and a verified Git export. The page includes the captioned video, commands, recorder and verification limits. One operator controls the scripted workspaces; it is not a live model run or an independent pilot.

We are looking for external developers and small teams to test the focused beta workflow. AgentGit remains alpha until the published pilot gates have evidence.