v0.10.0

What's Changed

• Make the dead-letter path visible and recoverable (vikunja#557) by @TadMSTR in #18

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• .gitignore setuptools build artifacts by @TadMSTR in #16
• feat: make notify self-terminal, add manual-then-auto mode (v0.9.0) by @TadMSTR in #17

Full Changelog: v0.8.2...v0.9.0

v0.8.2 — identity binding and capability scoping

Closes the unauthenticated MCP tool path and makes actor / completed_by mean something.

One release covering v0.7.0 → v0.8.2, all of which merged in a single build session. Cutting four tags for one build would be noise, but noting it explicitly rather than letting the intermediate versions disappear — the CHANGELOG has a full entry for each.

v0.7.0 — authenticate the MCP tool path (vikunja#387)

The transport had no auth. Only the seven HTTP control routes were gated; a comment referred to "the MCP auth middleware", but none was ever configured. An unauthenticated initialize returned HTTP 200 with a session id, so any caller could invoke any tool while asserting any actor — including operator, which every ownership check exempts.

Each agent now gets a distinct bearer token via TASK_QUEUE_TOKEN_<AGENT>, so the token both authenticates the caller and identifies it. No separate identity header on purpose: an agent holding a token can set any header it likes on a direct request, so a header-derived identity would be a weaker second channel competing with the token-derived one.

Fails closed on every misconfiguration — no tokens, an empty value, a token under 16 chars, a token shared by two agents, or one minted for the reserved operator identity.

v0.8.0 — bind identity, gate the operator-only tools

actor is derived from the token's sub claim. A mismatch is refused, not silently corrected. source_agent on submit_task is bound too — the auto-close decides whether to fire from it, so binding only actor would have left a route to terminally closing another agent's task without ever calling update_task.

set_task_status and cancel_task become operator-only. park_task/unpark_task get an ownership rule instead, so an agent can pause its own work and nobody else's. actor is pinned to operator on all six control routes rather than defaulted.

Adds POST /tasks/{id}/update — an audited operator sweep with on_behalf_of, verified against the task's real target_agent and recorded alongside it in history. It replaces the dishonest sweep that binding actor removed.

Adds an adversarial suite: every route agent A has to act on agent B's task, each of which must fail, with the honest paths asserted alongside.

v0.8.1 — stop hiding open work

list_tasks TTL-filtered everything except parked, so open work silently vanished from listings while still on disk. That is how a sweep found 17 stranded tasks where this tool reported 13. Non-terminal statuses are now exempt; terminal records still age out.

The auto-close note now carries the return task's summary — it always wins the race against the answering agent's own close, so its note is what history actually records.

v0.8.2 — audit remediation

Single source of truth for the operator identity, which had been spelled independently in three places. Guarded by a source-level test, because the obvious runtime check is vacuous: CPython interns identifier-like literals, so is passes even with two separate definitions.

Deploying

Requires per-agent tokens before the server starts demanding them. A bearer header sent to a server with no auth is ignored, so client rollout is safely additive; only the server restart closes the gate.

Scope

This contains a mistaken or prompt-injected agent acting through its own tool surface, and makes the audit trail mean what it says. It is not a boundary against an agent that goes looking for credentials — that needs per-agent OS users or a credential broker.

Security audit 2026-08-16: 2 findings (1 Medium pre-existing/deployment, 1 Low fixed here). All six flagged judgment calls independently attacked; no bypass found. 209 tests, 92% coverage.

v0.6.1

What's Changed

• security: .gitignore the *.core core-dump spelling too (SC-02) by @TadMSTR in #11
• v0.6.1 — auto-close only on the return shape, not on forward requests by @TadMSTR in #12

Full Changelog: v0.6.0...v0.6.1

v0.6.0

What's Changed

• v0.6.0 — close request tasks from the return task; reject bogus status filters by @TadMSTR in #10

Full Changelog: v0.5.0...v0.6.0

v0.5.0

What's Changed

• fix(queue): close update_task ownership gap, admit routing-failed by @TadMSTR in #9

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• chore: add Release workflow (tag push → GitHub Release) by @TadMSTR in #7
• feat: park status, append-only amendments, and schema cleanup (v0.4.0) by @TadMSTR in #8

Full Changelog: v0.3.1...v0.4.0

v0.3.1

What's Changed

• Point set_task_status rejection at update_task when applicable by @TadMSTR in #6

Full Changelog: v0.3.0...v0.3.1

v0.3.0

task-queue-mcp 0.3.0

Task-dismissal lifecycle + shared-secret HTTP control API + Baseline repo polish.

Added

• Lifecycle: cancelled terminal status; set_task_status (operator transitions + audited allow_override); cancel_task; quarantine_task / restore_task (recoverable isolation, no hard-delete). Four new MCP tools.
• HTTP control API: FastMCP custom routes on port 8485 — POST /tasks/{id}/{approve,cancel,status,quarantine,restore}, gated by X-Task-Queue-Secret (constant-time, fail-closed). The single validated mutation path for the CloudCLI plugin and Matrix bot (ends the three-writer divergence).
• workflow_mode task field (semi-auto | auto).

Changed

• get_task resolves quarantined tasks; Baseline polish (ruff, coverage gate, SHA-pinned CI, README).

Security

• Byte-operand secret compare → clean 401 on non-ASCII header (L-02); documented loopback trust model (L-01).

82 tests, 90.7% coverage. Security audit: PASS (0 Critical/High).

See CHANGELOG.md.

v0.2.0

Changes

New

• originating_task_id field on submit_task — optional UUID of the parent task. When set, the dispatcher looks up the parent and inherits its workflow_mode, keeping auto-mode pipelines in auto across agent handoff boundaries (fixes TQMCP-2).

Infrastructure

• GitHub Actions CI: matrix test on Python 3.10–3.13, triggers on push and PRs to main

Tests

• 38 unit tests covering all queue.py validation paths, transitions, TTL, archiving, adversarial YAML, and the new originating_task_id field