v0.9.5 — Workspace, voice mode, and the DigitalOcean install

v0.9.5

Released: 2026-09-17
Tag: v0.9.5  ·  Diff: v0.9.0...v0.9.5

405 commits · 1,570 files (+253k/−32k) · 152 public + 76 private-tracker issues · enterprise submodule 65182c1 → 08cd4dd · release candidates rc1–rc4 cut from dev along the way.

Freeze plan and coherence review: v0.9.5-freeze-plan.md. Includes the post-v0.9.0 sanitizer hotfix promoted to main on 2026-08-26 (#2406, for #2398).

Highlights

• Workspace becomes where the work happens. The agent workspace merged into
  Workspace and every agent gets a canvas (ent#438). A conversation rail sits
  beside the chat with Info, Loops, Files and Canvas tabs, and all three columns
  are resizable and remembered per user (ent#474/#475/#492/#608, #2617). An agent
  holds several topic-scoped chats as tabs, with a pinned Main chat and Reset
  (ent#451/#523). Running work shows up in the chat: a live execution card
  that says in one line what the agent is doing, plus a Work tab history
  (ent#457/#525/#620), and loops can be started, stopped and watched from chat
  (ent#458). Agents can ask a named person a question, answered inline on any
  of three surfaces, and an answer can wake the agent back up (ent#364/#428–#430,
  ent#329). Also: deliverables as first-class objects, message and deliverable
  ratings with report-a-problem (ent#365/#366/#499), multi-file drag-and-drop and
  a file preview (ent#524/#548), unread markers (ent#557), chat rename
  (ent#473), agent search and recency ordering (ent#402/#491), a model dropdown
  (ent#403), a light/dark/system switch (ent#625), Escape/Stop cancels a turn
  (ent#155), and multi-agent rooms moved into OSS core (ent#443).
• Voice mode in the Workspace. A real-time call runs over the current chat:
  the orb takes the conversation, the canvas stays in the right column, and the
  transcript is written back into the thread (ent#440/#534). The call acts as the
  agent with a per-agent tool manifest (ent#535). A long task runs in the
  background while you keep talking, and the result is brought back when it lands
  (ent#551), with spoken etiquette for the whole tool cycle (ent#576).
• Canvas. One rich block vocabulary (charts, images, diagrams) rendered the
  same everywhere (ent#536), a platform design kit plus a canvas library skill
  (ent#537), canvas lifecycle with sort, search, pin and bulk delete (ent#553),
  read-only share links and PDF export (ent#554), and the open canvas is shared
  context the agent can see and operate on (ent#555).
• DigitalOcean install. A guided installer
  (scripts/deploy/trinity-do-create.sh) takes you from your own terminal to
  Trinity on its own Droplet, behind HTTPS, in about ten minutes. You install and
  authorise doctl, create a Claude subscription token, choose the admin
  password, and run one command. Guide:
  Deploy on DigitalOcean.
  Underneath it: prebuilt GHCR images, a pull-only hosted compose
  (start.sh --hosted, pinned by TRINITY_IMAGE_TAG) and an unattended
  cloud-init first boot (#2280). The DigitalOcean Marketplace image also ships;
  its listing follows vendor review. Marketplace installs record their provenance
  and show a first-run hardening guide (#2380/#2692). First-run setup happens in
  the browser: a Marketplace admin is claimed there (ent#580), one setup overlay
  (ent#581) configures the Claude, GitHub, email and Gemini keys (ent#582), a
  front-desk agent demonstrates the primitive (ent#319), and the Trinity plugin
  really is pre-installed in agents now (ent#411, #2305).
• Subscription usage you can see. A 5h/7d usage dashboard with per-agent
  breakdown and rate-limit history (#471), a Subscription pressure grid tile
  (ent#259), durable headroom history (ent#433), and an operator alert at ≥75% of
  the weekly limit (ent#434). Auto-switch now ranks alternatives by headroom
  (#2409). A sweep fixed subscriptions misreported as rate-limited and gaps in the
  switch-and-retry path (#2352/#2353/#2396/#2419, ent#447, #2638/#2643/#2789,
  #2572, #2766).
• Opt-in instance telemetry. Anonymised operational signal from self-hosted
  installs, off until an admin consents (ent#437). Product-update consent gets a
  Settings home (ent#463), the send log records where each share went (#2571),
  and the sharing heartbeat survives daily restarts (#2618).
• Pull dispatch keeps maturing (still opt-in). Scheduled work can reach the
  durable queue (#2391), loops are terminal-driven (#2523), fan-out joins
  asynchronously (#2524), and a pulled turn once again carries its model, tools,
  turn cap, timeout and session (#2317).
• Reliability. Agent containers come back after a host reboot (#2541).
  Fixed: agent-server event-loop starvation (#2398) and the reader-thread drain
  deadlock (#2455); watchdog mislabelling and overflow (#2433/#2434); background
  work killed at CLI exit leaving no trace (#2467); headless runs being offered
  wake-ups and loops that never fire (#2454/#2468); the sync-health poller taking
  .git/index.lock (#2742); PostgreSQL int4 overflows in agent_sync_state
  (#2240/#2800/#2827); multi-agent rooms going dead after ~6h (#2610); missing
  gateway-timeout receipts on sync /task and fan_out (#2661/#2670). Also:
  an integrity contract for deploy_local_agent (#2060), Codex API-key auth
  that works (#2208), and Push no longer untracks committed files (#2529).
• Security. Fixed: on a fresh install, an unauthenticated setup endpoint
  could overwrite the admin password (#2381). New: machine identities for
  admin/ops APIs that survive enforced 2FA (#2323), and /token no longer returns
  an unusable token while a 2FA challenge is pending (#2322). Credential settings
  are encrypted at rest (ent#435, rotation needed, see upgrade notes). Git
  asks a credential helper for the token, so it is no longer in agent remote
  URLs, .git/config or process listings (ent#615). Guardrail hooks are out of an agent's reach
  (ent#345). /ws activity is scoped to the agents a user can access (ent#467).
  Audit attribution is honest, and denied calls are logged as refusals (ent#614,
  #2807). run_agent_loop enforces the permission edge (ent#628). Approval
  integrity: a mobile Deny no longer records as an approval, and responses are
  validated against the offered options (#2370/#2375/#2376). The platform and
  Workspace sessions now agree (#2261/#2791), and an agent can no longer switch on
  its own paid wake-ups.
• Engineering health. task_execution_service.py decomposed (#2314), the
  remaining oversized backend modules split (#1028), ~2,800 lines of dead Vue plus
  a dead-module sweep removed (#2492/#2493), and architecture.md split into a
  lean core plus on-demand area files (#2306/#2642). A user-journey test tier
  arrives with a per-PR journey-smoke gate and Journey Impact declarations
  (#2335–#2339/#2349/#2350). Loading states use skeleton placeholders, and
  background polls no longer re-flash content (#1921/#1927/#2540, ent#253).

Features

• #471 Subscription usage observability — 5h/7d usage dashboard, per-agent breakdown, and rate-limit event history
• #848 MCP inline email auth — frictionless onboarding without a pre-existing Trinity account
• #2277 escape-first markdown→HTML converter — headers/links/blockquotes/code-language, entity-safe splitting
• #2280 prebuilt images + pull-only hosted compose + unattended cloud-init first boot — the gate for every hosted / marketplace install channel
• #2335 tests/journeys/ tier + run-full.sh --tier journeys
• #2336 per-PR journey-smoke gate — first agent turn + start/stop against a prebuilt stack
• #2338 journey catalog (intent only) + generated JOURNEYS.md
• #2349 J10: Agent calls agent — journey harness
• #2350 Journey Impact declaration on epic + PR templates, enforced at merge
• #2380 record install provenance (DO Marketplace) + first-run HTTPS/VPN hardening guide
• #2391 let scheduled work reach the durable queue — Option 2 deferred from #2048
• #2523 make loops terminal-driven so they can run on the durable queue
• #2524 async fan-out join + sync edge adapter — the last blocking dispatch caller

Private tracker (trinity-enterprise):

• ent#155 Chat: Escape key + Stop button cancel the in-flight turn and restore the message to the input field
• ent#253 Consistent data-refresh treatment across all polled surfaces — invisible background refresh, standard first-load motion
• ent#259 Grid tile: Subscription pressure — per-subscription 5h/7d usage, headroom estimate, rate-limit events
• ent#319 first-run front desk — one agent that demonstrates the primitive and routes the three doors
• ent#329 operator-queue respond → re-trigger dispatch (async human-gate resolution re-entry)
• ent#364 Workspace: agent-initiated asks — one item, three renderings
• ent#365 Workspace: deliverables as first-class objects in chat and on the agent page
• ent#366 Workspace: rate a message and rate a deliverable
• ent#386 Assign and unassign skills from the Library — the write half split out of ent#384
• ent#387 Workspace: where do room budgets get set, now that the Sessions page is gone?
• ent#402 Workspace sidebar search should filter agents, not just chats
• ent#403 Workspace chat: user-friendly model dropdown
• ent#411 deploy-as-is → onboard-in-place — pre-install the trinity plugin in the agent base image so any bare repo can make itself Trinity-compatible
• ent#413 Dashboard Grid: make layouts user-specific and server-persisted (not browser-global localStorage)
• ent#428 addressed asks — the column, its roster validation, and the portal read/answer path (ent#364 slice 1+2)
• ent#429 render an ask in all three surfaces, attach it to a chat, and show it expiring (ent#364 slice 3+4)
• ent#430 wire an answered ask to the ent#329 res...

v0.9.5-rc4 — release candidate

Release candidate for v0.9.5, cut from dev at 3a47f74.

Published to GHCR as v0.9.5-rc4 and 0.9.5-rc4. latest is deliberately not moved.

Not a release: no issues are closed by this tag and main is untouched. The full cut
runs the normal /release path when the release floor is met.

v0.9.5-rc3 — release candidate

Release candidate for v0.9.5, cut from feature/ent580-582-first-run at c114c64 (not dev) to test the marketplace browser admin claim, the first-run overlay and the in-browser credential steps on a real 1-Click snapshot before their PR opens.

Published to GHCR as v0.9.5-rc3 and 0.9.5-rc3. latest is deliberately not moved.

Not a release: no issues are closed by this tag and main is untouched.

v0.9.5-rc2 — release candidate

Release candidate for v0.9.5, cut from dev at bb31eef.

Supersedes v0.9.5-rc1, which published no v-prefixed image tag and so could not build the marketplace snapshot (#2505). rc1's tag and images are left in place — an RC tag is immutable.

Published to GHCR as v0.9.5-rc2, 0.9.5-rc2 and sha-bb31eef across all five images.

TRINITY_IMAGE_TAG=v0.9.5-rc2 ./scripts/deploy/start.sh --hosted

latest is deliberately not moved.

Not a release: no issues are closed by this tag and main is untouched. The full cut runs the normal /release path when the release floor (trinity-enterprise#441) is met.

v0.9.5-rc1 — release candidate

Release candidate for v0.9.5, cut from dev at 0f4d54d.

Published to GHCR as 0.9.5-rc1 and sha-0f4d54d — note the tag has no v prefix. docker/metadata-action's pre-release rule extends only {{version}}, so the v{{version}} alias every doc tells you to type is NOT published for a candidate. Use:

TRINITY_IMAGE_TAG=0.9.5-rc1 ./scripts/deploy/start.sh --hosted

TRINITY_IMAGE_TAG=v0.9.5-rc1 fails with manifest unknown. Tracked separately.

latest is deliberately not moved — verified: it does not exist on any of the five packages (this is the first publish of them all).

Not a release: no issues are closed by this tag and main is untouched. The full cut runs the normal /release path when the release floor is met.

v0.9.0 — Workspace, fresh-install provisioning, and the multi-source skills library

v0.9.0

Released: 2026-08-17
Tag: v0.9.0  ·  Diff: v0.8.5...v0.9.0

499 commits · 1,367 files (+220k/−38k) · 155 public + 62 private-tracker issues (+21 enterprise PRs closed at merge; see the commit-reconciled addendum) · enterprise submodule e898cef → 65182c1.

Freeze plan and coherence review: v0.9.0-freeze-plan.md.

Highlights

• Workspace — the client surface, now in every build. The client portal moved
  from an entitled module into OSS core (trinity-enterprise#356) and became
  Workspace: one click from the platform (ent#357), the Session tab absorbed
  into it (ent#358), an agent page per agent (ent#360), sidebar IA with agents,
  starred and dated chats (ent#359), chats with one or more agents and @mention
  to bring an agent in mid-chat (ent#361/#362, rooms-engine, entitlement-gated),
  a / playbooks + @ agents composer typeahead (ent#392), skill hints in chat
  (ent#380), streaming turns (ent#286), sliding session renewal (ent#375),
  client sign-out and re-entry blocking (ent#281), per-client rate limits
  (ent#287), delegated identity via token exchange (ent#163), the Sessions page
  retired (ent#381) — plus a sweep of roster, load-time, layout, readability,
  voice-mode, timeout and sign-out fixes (#2196/#2198/#2211–#2214/#2258).
• Fresh-install provisioning (trinity-enterprise#122 slice): the agent
  catalog now resolves through a remote template registry (ent#14), a
  GitHub-repo import wizard with fork / copy / clone-own intents (ent#15),
  install a system from a manifest in the UI (ent#126), guided per-agent
  credential setup (ent#127) on the new Trinity-installable agent standard
  (ent#128), bind an agent to a repo you own from Agent Detail (ent#109), and
  template.yaml schedules materialized at creation (ent#89).
• Skills platform, phase 2 (trinity-enterprise#182): the Skills tab rebuilt
  (ent#235), library lifecycle automation — scheduled auto-sync, fleet re-inject,
  removal-on-unassign (ent#236), a multi-source library with a bundled
  community repo + per-instance custom repos (ent#237), vendor-neutral layout
  (ent#332), the Templates page renamed Library (ent#263) with a tabbed
  Skills section that shows which agents hold each skill (ent#384).
• A2A, bidirectional: an inbound A2A server — public Agent Card + JSON-RPC/SSE
  task endpoint, per-agent opt-in (ent#157) — with a config UI (ent#158) and MCP
  control tools (ent#160), plus outbound call_a2a_agent to operator-
  registered external endpoints (#736).
• Dashboard: the Agents page folded into a List view (ent#260),
  type-to-filter across all views (ent#261), a grid widget chassis with the
  first data tiles — Executions by trigger, Recent failures (ent#325/#96/#100
  over the new GET /api/executions/timeline, ent#326), an org overlay of
  departments and reporting lines (ent#305), the scanline data-loading motion
  language (ent#245), the seven Base* design-system primitives (#2122) and a
  dark ink-ladder sweep (#1922).
• Agent Reports, complete (Epic #1534): prompt guidance (#1535), Excel/PDF
  export (#1536), large-payload paging (#1537), MCP read-back (#1538), search &
  filter (#1539).
• Reliability at scale: automatic database backups for SQLite and
  PostgreSQL (#2216), bounded container logs (#1871 — the disk-full/dockerd
  wedge class), rebuilt base images now actually adopted on cold start, fleet
  restart and by trinity-system (#1809/#1860/#1816), the terminal-activity
  close contract (#1804), a first-run seeding race fixed (#2215), orphan
  containers reclaimed on failed creation (ent#313), log archival un-wedged
  (#2205), one shared single-flight lock primitive (#1920), and a canary harness
  that runs on prod compose, elects one leader, names its instance, retries lost
  Slack alerts, reports its own run-state, and stops paging on four false-positive
  classes (#1878/#1881/#1987/#1897/#2217/#1813/#1880/#1990, ent#335/#337/#372).
• Security: require_admin/assert_admin reject agent-scoped principals
  (ent#297 — root cause of four prior escalations, incl. ent#293/#346), hardened
  YAML everywhere author-controlled input is parsed (ent#314, #1884, #1965), a
  path-traversal fix in template resolution (#1900), per-spawn execution
  environments so a removed credential stops reaching executions (#1999/#2114),
  PAT-scrubber under-match fixes (ent#292/#347, #2052), SSRF fixes on Slack and
  WhatsApp media downloads and the CGNAT range (#1951, #1932, ent#393/#394),
  durable audit hash-chain (#2015/#1984), portal sign-in brute-force and
  enumeration protection (ent#309/#311, #308), first-class agent MCP keys with
  verification and rotation (#1854), and the A2A outbound edge sweep
  (#2174/#2175, ent#395–#399).
• Channels & agent runtime: Telegram in-progress indicator (ent#264) and
  long-task report-back (ent#265), ZIP uploads in chat (ent#391), ask_trinity
  docs Q&A over MCP (ent#328), .mcp.json.template finally rendered for
  github: agents (#2007), a committed self-healing plugin manifest (#1704),
  Codex runtime model/auth fixes (#1971/#2207), and behavioral-evaluation
  foundations — the referee surface (ent#267) and a cross-model referee (ent#277).
• Abilities marketplace: structure for agentic systems. This release cycle
  pairs the platform with a marketplace cycle that introduces a new level of
  organization into agentic systems — the structural primitives fleets need to
  collaborate: a shared canon (a canonical-data layer with
  publish/consume/reconcile, deterministic linting, and per-counterpart
  relations — add-canon 1.0→1.6), system-aware orchestration with
  install-time divergence detection, a bundle-wide --autonomous run mode and
  event choreography, playbooks as the unit of inter-agent work
  (playbook-call), and repository-first creation & in-place onboarding —
  the marketplace half of the platform's pre-installed Trinity plugin
  (ent#411/#1704), a tighter integration of the plugin marketplace and the
  platform. Full list in the Abilities Marketplace
  section below.

Features

• #736 call_a2a_agent MCP tool — outbound A2A protocol calls to registered external agents
• #925 client-side cron validation + warning icon for invalid schedules
• #1534 Epic: Agent Reports — richer creation, export, scale, read-back & search
• #1535 report-tool guidance injected into the agent platform prompt
• #1536 download & render reports as Excel / PDF
• #1537 reports at scale — 5 MiB payload cap + row-windowed table reads
• #1538 agents read back their own reports over MCP
• #1539 search & filter reports (fleet + per-agent)
• #1813 canary H-01: fail loud when a SQL-tier collector reads zero rows on a provably non-empty fleet
• #1854 first-class agent-scoped MCP keys — visibility, verification, regeneration, self-heal
• #1987 canary Slack alerts name the instance that fired them

Private tracker (trinity-enterprise):

• ent#14 remote template registry — the agent catalog served from an external, self-updating repo
• ent#15 GitHub-repo import wizard — fork / archive-copy / clone-own with inline compatibility check
• ent#89 materialize template.yaml schedules at agent creation (disabled by default)
• ent#96 grid tile: Executions — hourly chart by trigger type (24h)
• ent#100 grid tile: Recent failures — latest failed executions fleet-wide
• ent#109 bind an agent to a GitHub repo you own — post-creation ownership retrofit from Agent Detail
• ent#126 install a system from a manifest via the UI — paste/upload/pick → dry-run → deploy
• ent#127 guided per-agent credential setup — required-credentials checklist with status and how-to-get
• ent#128 "Trinity-installable agent" standard — per-variable credential setup metadata in template.yaml + contract doc
• ent#157 A2A inbound server — public Agent Card + JSON-RPC/SSE task endpoint
• ent#158 A2A config UI — per-agent exposure, card URL, skill curation, inbound allow-list & outbound endpoint registry
• ent#160 A2A control over MCP — exposure, card, allow-list & outbound endpoints as MCP tools
• ent#163 Workspace: delegated identity — a trusted backend acts as an end user via token exchange
• ent#199 benchmark selection decision — Terminal-Bench 2.1 + TRB + borrowed-host scorer
• ent#235 Skills management surface — the Skills tab rebuilt (library browse, assignment, injection status)
• ent#236 skills library lifecycle automation — scheduled auto-sync, fleet-wide re-inject, removal-on-unassign
• ent#237 multi-source skills library — bundled public community repo + per-instance custom repos
• ent#245 scanline loading animation — the app's default data-loading motion language
• ent#260 dashboard List view replaces the standalone Agents page (timeline · grid · list)
• ent#261 hotkey type-to-filter across dashboard views
• ent#263 Templates page renamed Library — one surface for agent templates + the skills library
• ent#264 Telegram: in-progress status indicator while a task runs
• ent#265 Telegram: long-running task reports back to the originating chat on completion
• ent#267 behavioral-eval referee surface + Completion relabel (foundation)
• ent#277 cross-model validation — an independent second-model referee
• ent#281 Workspace: log out a signed-in client (revoke sessions) + block re-entry
• ent#286 Workspace: portal-session streaming path
• ent#287 Workspace: per-client rate limits on portal chat and upload
• ent#305 grid view org overlay — department zones + reporting lines
• ent#325 grid widget chassis — InfoTile, GRID_WIDGETS registry, layout v2, Tiles menu
• ent#326 GET /api/executions/timeline — bucketed execution rollups for the grid data tiles
• ent#328 ask_trinity docs Q&A tool in the Trinity MCP server
• ent#332 vendor-neutral...

v0.8.5 — Skills platform, shared sessions, and ghost agents

v0.8.5

Released: 2026-07-26
Tag: v0.8.5  ·  Diff: v0.8.0...v0.8.5

773 commits · 619 files (+97.7k/−14k) · 78 public + ~17 private-tracker issues.

Highlights

• Skills as a first-class platform capability (trinity-enterprise#182): full-directory
  skill packages with a hardened frontmatter contract, tree-SHA versioning, and
  manifest-based pruning (trinity-enterprise#183); a stateless skill-runner agent
  executing library skills over MCP with per-skill permissions (trinity-enterprise#139,
  entitlement-gated); configurable exposed skills on the A2A card (trinity-enterprise#180).
• Shared sessions (rooms) — multi-agent rooms with a mention-wake turn engine, budgets,
  MCP tools, and a dashboard Sessions view (trinity-enterprise#169/#170, entitlement-gated).
• Agent display names — a human-facing label separate from the immutable slug, settable
  at creation, rendered across the UI, pickers, search, and operator surfaces
  (#1639–#1643, trinity-enterprise#181).
• Telemetry, two-tier: Tier-1 local product events, default-on, never leave the box
  (trinity-enterprise#184); Tier-2 opt-in fleet sharing with benchmarks (#1723,
  trinity-enterprise#12 — hosted benchmark service still pending).
• Ephemeral "ghost" agents — disposable budgeted agents that hard-discard at their
  execution/TTL budget (trinity-enterprise#69, entitlement-gated).
• Voice replies v2 — voice as a per-message agent capability with agent-level settings
  and a platform ElevenLabs key (trinity-enterprise#117).
• First-run experience: default system manifest seed on fresh installs
  (trinity-enterprise#124), PAT-free clone of public github: templates
  (trinity-enterprise#123), per-user GitHub PATs (trinity-enterprise#162) with gh CLI
  wiring (#1574).
• Async orchestration: system-emitted agent.task.completed/failed events wake
  subscribed callers at execution terminal (#1578); agent self-reminders (#1296);
  re-delivery caps + operator-queue human-gate lever (#1402).
• Fleet hygiene at scale: git bloat root-caused and bounded (#1595/#1596), Docker
  volume lifecycle + orphan reclaim (#1581, #1664/#1665/#1667/#1671), retention
  blast-radius guard with an in-product approval path (#1638/#1644/#1709).
• Trinity Helper MCP server — docs Q&A via Vertex AI Search as a dedicated MCP
  surface (#1459).

Features

• #1077 canary: execution-row integrity invariants E-04, E-03, G-03 (Phase 4)
• #1142 operator_queue retention sweep in cleanup_service
• #1164 CI: gitleaks secret-scanning so embedded API keys (incl. re_-prefixed) cannot reland
• #1167 configurable loop failure policy: fail-fast vs continue-on-error
• #1296 agent self-reminders — agent-callable one-shot deferred self-trigger
• #1402 MAX_REDELIVERY cap + async operator-queue human-gate lever (lease-reaper backstop)
• #1459 dedicated Trinity Helper MCP server (docs Q&A via Vertex AI Search)
• #1574 wire the agent GitHub PAT for the gh CLI + REST API (not just git)
• #1575 one-click copy MCP connection config (embedded scoped key) for an exposed agent
• #1578 system-emitted agent.task.completed/failed events at execution terminal
• #1609 configurable proactive channel-message rate limits (Slack/Telegram/DM)
• #1639 agent display_name — schema, API, and MCP surface
• #1640 set an agent's display label at creation time
• #1641 render agent display name on the nine roomy UI surfaces
• #1642 agent display name in pickers, search, and sort
• #1643 agent display name across remaining surfaces — operator, monitoring, executions

Private tracker (trinity-enterprise):

• ent#69 ephemeral "ghost" agents — disposable budgeted containers, auto-discarded
• ent#117 voice replies v2 — per-message voice choice, agent-level settings, platform ElevenLabs key
• ent#123 PAT-free clone of public github: templates (source-mode, read-only)
• ent#124 first-run seed of a default system manifest — starter fleet on fresh install
• ent#125 resilient system-manifest deploy — continue-on-error + partial-success report
• ent#139 skill-runner agent — stateless skill execution over MCP with per-skill permissions
• ent#144 portal: attach/upload a file directly in the portal chat composer
• ent#162 per-user GitHub credentials — each user supplies their own PAT
• ent#169 shared sessions core — room store, mention-wake turn engine, budgets + MCP tools
• ent#170 Sessions view — rooms rail, multi-party transcript, participants rail
• ent#180 a2a: configurable exposed skills on the agent card
• ent#181 rename the label, not the slug — editable display name, immutable agent id
• ent#183 skill package format — full-directory library sync/injection + frontmatter contract
• ent#184 telemetry Tier-1 local product events — activation funnel, default-on, local-only
• ent#186 (+ent#216) portal: LLM-generated thread titles + agent avatars on history rows, with subscription-OAuth fallback
• ent#212 portal: per-user memory injected into portal/delegated chat answers

Fixes

• #1474 schedule-triggered executions stored naive started_at — UI showed wrong relative time
• #1485 Config Validation: 4 critical config issues (2026-07-06)
• #1486 OPERATOR_INTAKE_ENABLED / DO_NOT_TRACK privacy kill switch was inert (not forwarded by compose)
• #1487 DISPATCH_BREAKER_ENABLED global gate unwired — breaker un-enableable, UI toggle no-op
• #1488 PUBLIC_ACCESS_REQUESTS_ENABLED documented but not forwarded by compose
• #1525 operator-queue create_item KeyError on missing created_at caused infinite sync-retry loop
• #1526 CI: frontend-e2e only ran on ui-labeled PRs — specs rotted silently
• #1533 Sharing-tab client roster showed 0 messages for every client
• #1540 canary invariant harness was blind on PostgreSQL (read stale SQLite)
• #1557 disabling agent autonomy forced circuit breaker DORMANT, blocking all inbound responses
• #1558 tests: conftest api_client fixture deleted every live agent named test-*
• #1559 soft-delete recovery dead-ended when the container was gone
• #1560 stale circuit-breaker Redis keys survived agent delete/recreate — fresh agents fast-failed
• #1561 sync-health poller hammered soft-deleted agents and poisoned their breakers
• #1562 Agent Permissions Matrix: bigger labels + no grid jump on grant/revoke
• #1577 proactive messaging toggle lost in Access tab redesign
• #1581 Docker volumes were never deleted — agent purge now reclaims workspace/public/shared volumes
• #1582 tests: TestAcquireCeilingClamp order-dependent flake (sys.modules stub leak family)
• #1593 operator intake delivery failures were logged at debug — outage invisible for 3 weeks
• #1595 git auto-gc could never complete inside agent containers — silent multi-GB .git bloat
• #1596 git-sync workspaces grew unboundedly — auto-committed data churn bloated .git
• #1598 platform Help widget overlapped the portal chat composer Send button
• #1600 proactive messages (send_message) never persisted to channel session history
• #1601 ephemeral budget gate counted the execution's own row — max_executions=1 ghosts could never run
• #1615 password ssh-access was broken end-to-end — removed (key-based BYOK only)
• #1616 injected SSH public keys were silently wiped on container recreate
• #1617 /api/telemetry/containers cold cache reported running_count 0
• #1629 pull-claimed turns bypassed platform system prompt composition
• #1631 operator_queue global-id cross-agent collision silently swallowed requests
• #1632 operator-queue create path had no rate limit or size caps (flooding surface)
• #1636 Enterprise pages lost the top nav bar
• #1638 retention floor silently deleted pre-existing execution history on upgrade
• #1644 retention prunes had no blast-radius guard
• #1646 Cornelius template advertised semantic_search/skills the bundled template didn't ship
• #1649 proactive group messages never persisted to channel session history
• #1653 enterprise except ImportError reported real registration bugs as "submodule not present"
• #1660 Fable 5 / Sonnet 5 missing from platform default-model dropdown + channel whitelist
• #1661 agent-server leaked a busy-spinning reader thread (100% CPU) on stdout-pipe-race
• #1664 orphan-volume sweep could destroy a live renamed agent's home volume
• #1665 renamed agent's soft-delete recovery mounted a fresh empty workspace volume
• #1667 agent creation silently reused a pre-existing Docker volume of the same name
• #1671 agent rename now gated on volume-base ownership (one-row-per-base invariant)
• #1672 'Continue as Chat' (EXEC-023) validated across the full trigger matrix
• #1673 agent-server masked error_during_execution as a successful context: fork placeholder
• #1702 .claude/plugins/ added to the fleet-wide gitignore (plugin caches were auto-committed)
• #1709 retention blast-radius guard gained an in-product approval path (agent purge could never run)
• #1712 per-agent circuit-breaker toggle no longer reports success while the global gate is off
• #1713 src/scheduler/utils.py byte-parity vendoring claim now test-enforced
• #1714 bulk watchdog sweeps now emit task-completion events (#1578 residual)
• #1743 fleet execution totals reconciled with per-agent view (soft-deleted agents' spend)
• #1745 security: deleting an agent now revokes its MCP API keys
• #1747 an agent whose container is gone is no longer invisible/undeletable
• #1768 deploy-local 500 — create_agent_internal facade dropped adopt_existing_workspace

Private tracker:

• ent#196 security/reliability: telemetry module import-order bug disabled ALL enterprise modules
• ent#213 security: deploy-local now validates archive-supplied .mcp.json
• ent#220 (partial) rooms: moderator-only lifecycle mutations + participant cap enforced

Refactors

• #1310 auth: consolidated duplicated auth/dependency patterns behind factories (INV-8)
• #1449 reliability: callback-path chat-session persist...

v0.8.0 — Voice, Brain Orb, and enterprise identity

v0.8.0 — Voice, Brain Orb, and enterprise identity

Released: 2026-07-08 · Tag: v0.8.0 · Previous: v0.7.0
Diff: v0.7.0...v0.8.0

▶ Watch the release tour — a video walkthrough of this release.

The headline of this release: agents can now speak — outbound voice replies land
across Telegram, Slack, and WhatsApp — and Cornelius-class agents get the Brain
Orb, a self-rendering 3D mind page with live voice, knowledge-base search, and
capture-to-graph writes. On the platform side, v0.8.0 ships the enterprise
identity layer (2FA/TOTP, SSO, operator Access tab, fleet-wide permissions
matrix) and a substantial security & reliability hardening pass.

110 issues across both trackers — the largest Trinity release to date. Full
grouped notes: docs/releases/0.8.0.md.

---

🗣️ Outbound voice across channels — the theme

Agents reply with real spoken voice notes, not just text (ElevenLabs TTS, per-agent
voice + toggle, graceful text fallback):

• Telegram — voice replies via sendVoice (OGG/Opus)
• Slack — inline audio clips via the Files upload flow
• WhatsApp — audio/ogg voice notes over the Twilio media path

Configure per agent under Settings → Voice replies (requires a platform
ELEVENLABS_API_KEY).

🧠 Brain Orb — the self-rendering mind page

A capability-gated 3D knowledge-graph page for second-brain agents: static render,
live scope mount/unmount, a client-held Gemini Live voice tile (browser ↔ Google
directly — Trinity only mints a locked ephemeral token), read-only KB search, and
owner-gated capture/link writes with the full write → re-export → refetch loop.
Fresh installs auto-seed a default Cornelius agent so the orb renders
out-of-the-box, and fork-to-own creation copies the template into the user's own
repo at agent creation.

🔐 Enterprise identity & access

• Two-factor authentication (2FA/TOTP) — mandatory for admins, optional for users
• SSO (SAML/OIDC) for enterprise identity providers
• Access tab — manage which Trinity operators can reach an agent, active vs pending
• Fleet-wide agent-to-agent permissions matrix in Settings (caller × target grid)
• Client roster — see external channel users (Telegram/WhatsApp) per agent
• Client Portal (first slice) — configurable exposure for an external-client web surface over public links

🛡️ Security hardening

• #187 JWT tokens are revoked on logout (Redis jti blacklist) — an exfiltrated 7-day token now dies with the session
• #186 Enumeration-uniform 404s — agent/user existence can no longer be probed via differential responses
• #267 Credential encryption-key rotation — online dual-key decrypt + re-wrap runbook
• #1353 23 Dependabot alerts remediated on the default branch
• Webhooks: optional per-schedule HMAC signature auth, pre-auth rate limit, body cap, soft-deleted-agent guard
• CodeQL-driven hardening: repo-URL hostname parsing, Brain Orb XSS + vendored three.js alerts, path-containment guard at the file write/unlink sink

⚙️ Reliability

• #1085 Correlated-failure / thundering-herd controls — jitter, re-delivery caps, shared-cause pause on the async callback path
• #1084 Effect-scoped idempotency keys — outbound side effects (messages, calls, payments, shares) dedup at the sink
• #1401 Structured recovery trace injected into re-delivered executions
• #1463 / #1464 Circuit-breaker false-opens on busy agents fixed; fleet monitoring no longer double-probes under multi-worker
• #1472 Stale next_run_at silently skipping cron fires — root-fixed plus a new canary invariant (E-06)

🔁 Agent loops get guardrails

• #1155 Hard cost budget (max_cost_usd)
• #1156 Wall-clock deadline (max_duration_seconds)
• #1157 Doom-loop detection — stop after K identical responses (default on for new loops)

🖥️ UI

• #1112 Chat + Session unified into one Chat tab with a session-mode toggle (continuity by default)
• Grid dashboard — magnetic tile canvas as a third fleet view alongside Graph/Timeline
• Guided onboarding — streamlined first-run setup wizard (setup token removed) + purpose-picked first agent
• #1416 / #1418 Trinity branding + per-route browser tab titles
• #1266 Skeleton loading states for Dashboard & timeline
• Sharing tab reframed around external-client channel sharing; costs display in one standardized format across the UI
• Slack channel identity + proactive group messaging — agents see who/where and can post proactively into bound channels
• Gacrux added to the Gemini Live voice picker

🧰 Ecosystem — Abilities toolkit

The abilities plugin marketplace moved alongside this release:

• /add-orchestrator (agent-dev, new) — turn any agent into a system-aware orchestrator: /discover-agents scans repos for Trinity specs into a fleet map, /compose-system turns the map into a Trinity SystemManifest and deploys it, /orchestrate routes, fans out, and runs ephemeral agents over Trinity MCP — plus fleet reconciliation and an ownership matrix.
• Trinity report publishing scaffolded into new agents (create-agent) — agents generated by the wizards ship ready to publish structured reports to the new dashboard surface.
• /trinity:sync safety fix — local changes are stashed, never blanket-discarded.
• Long-running-task rule (playbook authoring) — jobs longer than ~10 minutes must decouple from headless runs to OS-level cron/sidecar with a done-marker; onboarding and playbook templates now teach the correct shape.

/plugin marketplace add abilityai/abilities

---

Upgrade notes

• 2FA is mandatory for admin accounts once the enterprise module is entitled — admins are prompted to enroll TOTP on next login.
• First-time setup changed: no setup token; the wizard requires an admin email. Deploy the first-run window behind a tunnel/VPN until setup completes.
• Re-login after upgrade (JWT secret rotates on backend restart); reconnect MCP clients (/mcp).
• Carried from v0.7.0: PostgreSQL is the recommended production backend (SQLite EOS 2026-09-01 — migration guide).

Full notes (all 110 issues, grouped): docs/releases/0.8.0.md
Contributors: Eugene Vyborov, Claude Code, dependabot

v0.7.0 — PostgreSQL goes to production

v0.7.0 — PostgreSQL goes to production

Released: 2026-06-23 · Tag: v0.7.0 · Previous: v0.6.1
Diff: v0.6.1...v0.7.0

The headline of this release: Trinity now runs on PostgreSQL as the recommended
production database. SQLite stays the zero-config default for local development
and evaluation, but production instances should move to Postgres. This release adds
the configurable backend, Alembic-managed Postgres migrations, a dated SQLite
end-of-support path, and a gated SQLite→Postgres migration flow shipped in the
Trinity Ops Agent.

Alongside Postgres, v0.7.0 lands a pluggable Codex harness beside Claude Code,
a body of execution-correctness work (fire-and-forget dispatch, status-as-projection),
agent-server inbound-auth hardening, and credential hot-reload rotation.

---

🐘 PostgreSQL — the theme

• #300 Configurable database backend — SQLAlchemy Core abstraction over SQLite + PostgreSQL. Set a single DATABASE_URL and both the backend and the scheduler switch over. Selection is non-sticky and non-destructive: comment the variable out and you're back on SQLite on the next restart.
• #1183 Adopted Alembic for PostgreSQL migrations (dual-track alongside the SQLite bespoke runner; a schema change lands in both until SQLite is retired).
• #1278 SQLite end-of-support dated 2026-09-01 — PostgreSQL is the forward path for production, with migration notes in the docs.

Migrating an existing SQLite instance? Use the Trinity Ops Agent's
/migrate-to-postgres skill (abilityai/trinity-ops-public) —
a gated validate-then-cutover flow that stands up a parallel Postgres container,
copies and validates your data, then cuts over in a short downtime window. Your
SQLite file is never written, so rollback is always one line.

• Stand up a new instance on Postgres → docs/POSTGRESQL_SETUP.md
• Migrate an existing SQLite instance → Ops Agent /migrate-to-postgres

# Opt in to the bundled PostgreSQL container
DATABASE_URL=postgresql://trinity:your-password@postgres:5432/trinity
docker compose --profile postgres up -d

---

Features

• #1187 Codex harness MVP — pluggable agentic execution engine alongside Claude Code
• #1169 Agent runtime data volumes — declared data_paths with snapshot/restore and portable export
• #1089 Credential rotation via hot-reload, not container recreate
• #668 Agent deployment compatibility validation — server-side checks with auto-fix offers
• #1115 Per-schedule performance scorecards on Agent Detail (Overview + Schedules tab)
• #1116 In-app bug reporting from the floating Help widget (hosted intake → GitHub issues)
• #1104 Respond to / resolve Operator Queue items over MCP (#1101 follow-up)
• #1315 WhatsApp outbound media attachments — deliver ChannelResponse.files via Twilio MediaUrl
• #82 Email verification for admin login (email code + password)
• #679 Plumb cancel signal into the agent task-runner reply (#671 defense-in-depth)
• #1095 Transactional agent executions — discard workspace changes unless validated as success (research-gated)
• #941 Enterprise: audit log dashboard — admin viewer for compliance review (v1: list/filter/detail) + entitlement seam
• trinity-enterprise#5 (enterprise) Two-factor authentication (2FA) via TOTP

Fixes

• #1159 🔒 agent-server HTTP API was unauthenticated on the shared agent network (cross-agent credential theft) — now a per-agent HMAC X-Trinity-Agent-Token
• #1160 Migration runner — close the DROP-rebuild data-loss window + add cross-process serialization
• #1201 Agent-side timeout (504) no longer drops execution cost/context/tool-call telemetry
• #858 First-time setup token silently lost — block-buffered print() broke fresh installs
• #1165 First-time setup token was per-worker — prod (--workers 2) onboarding still ~50% flaky after #858
• #1199 GET /api/ops/auth-report 500 — SQLAlchemy auto-correlation (v0.6.1 regression)
• #1200 GET/PUT /api/agents/{name}/capabilities 500 — facade delegation (v0.6.1 regression)
• #1267 Boot-time NameError in lifespan transport startup (misleading Telegram/WhatsApp error on every boot)
• #1264 Per-agent GitHub PAT never propagated to an existing container — all pushes failed
• #1265 Dashboard & timeline took 20s+ to load metrics with 10+ agents
• #1022 Scheduler wrote status='failed' with empty error on a 30s dispatch timeout
• #799 SUB-003 auto-switch had no per-agent lock — concurrent 429s raced the restart
• #1197 Agent creation crashed with an opaque ValueError on non-integer CPU in template resources
• #1230 Backend Docker healthcheck flapped to "unhealthy" under batch load (10s timeout too tight for 2 workers)
• #1231 Agent /tmp tmpfs filled and silently broke autonomous git commits — size now configurable
• #1237 CI: path-filtered required checks bricked unrelated PRs
• #1260 Fixed test-suite bugs surfaced by the full integration run (fixtures, stale mocks, isolation, flakes)
• #722 Config validation: 5 critical config issues
• #767 CB probe executions left open until backend restart inflated failure duration on the timeline
• #953 Freshly deployed agents reported M .gitignore against origin/main (startup.sh append)
• #954 Agent Detail panel width jerked when switching to/from the Chat or Session tab (scrollbar gutter)
• #957 "Failed to generate avatar" now classifies image-gen failures with actionable detail
• #958 Build Info dialog displayed "unknown" for every field in local development
• #960 Visual artifact on the Agents list row hover in light theme

Refactors

• #1083 Fire-and-forget dispatch — a hung turn holds zero backend resource
• #1082 status-as-projection — schedule_executions.status is never read as authoritative for "is running"
• #1025 Harden headless drain/finalize — daemon-thread exception capture + finalize snapshot isolation
• #1027 Split db/schedules.py; replace 15+ param insert signatures with request objects
• #1088 Unify the failure classifier into one shared package

Breaking Changes

None.

Upgrade Notes

• Database: PostgreSQL is now the recommended production backend (#300). Opt in with a single DATABASE_URL; SQLite remains the default. SQLite end-of-support is 2026-09-01 (#1278) — migrate with the Ops Agent /migrate-to-postgres skill.
• #1159 introduces AGENT_AUTH_SECRET (auto-generated by start.sh, like SECRET_KEY). Existing agents do one self-reconciling recreate pass to pick up their injected token.
• #1187 adds the AGENT_RUNTIME selector (Codex / Gemini / Claude Code); existing agents default to Claude Code.

CLI

trinity-cli auto-publishes 0.2.7 via the main-push path (license → Apache 2.0
#1192; credential + email-send removed from trinity init #1162).

---

Contributors: Eugene Vyborov, dolho, andrii.pasternak, vybe, obasilakis,
oleksandr-korin, Pavlo Shulin, Oleksii Dolhov, Alex, dependabot, chrisyangxiaoqi,
webmixgamer.