v0.16.1

• Explain that next_vmid is an unreserved candidate and document its result in the MCP description.

v0.16.0

Security and observability (BREAKING)

• BREAKING: Writes now require a durable audit intent before contacting the upstream platform. If the audit database cannot accept the intent, the write fails closed; a failed final audit update leaves an unresolved pending intent.
• Real writes now commit a durable pending audit intent before the upstream call. If audit storage is unavailable, the write does not start; a failed final update leaves a visible pending intent and blocks further writes in that process.
• Audit rows retain outcome metadata instead of full business responses. AIOPS_WORKFLOW_ID links calls across a workflow; optional AIOPS_TELEMETRY=1 emits metadata-only JSON events and AuditEngine.health() reports audit failures and pending intents.

v0.15.0

Fixed

• The MCP server moved from a top-level mcp_server package to
  proxmox_aiops.mcp_server. Every AIops tool used to ship its own top-level
  mcp_server, so installing two of them into one environment merged the two
  into one package: proxmox-aiops-mcp could start another tool's server, and
  proxmox-aiops undo wrote audit and undo rows into the other tool's home
  directory. Installs through uvx, the Claude Code plugin or the OpenClaw
  bundle were isolated and unaffected. The proxmox-aiops-mcp command is
  unchanged; only code that imported mcp_server directly must now import
  proxmox_aiops.mcp_server.

v0.14.0

Added

• MCP tool annotations derived from each tool's governance risk_level, so
  clients can gate approval from tools/list alone. low tools advertise
  readOnlyHint: true; every other tool advertises readOnlyHint: false and
  destructiveHint: true. The medium tier includes deletes and hard
  power-offs, so a tool is never advertised as non-destructive on the strength
  of its tier. idempotentHint only repeats an explicit declaration. The exact
  level is published in _meta under io.github.AIops-tools/riskLevel. These
  are hints for the client; audit and undo are unchanged.

v0.13.3

Fixed

• CLI commands that read the engine without calling an MCP tool now write an
  audit row, as every MCP call does: they run through the same @governed_tool
  harness, budget and runaway guard included. Before, an operator's CLI reads
  left no trace in audit.db, contrary to the documented guarantee that MCP
  and CLI are audited alike. A test fails if any engine command escapes it.

v0.13.2

Changed

• The ClawHub bundle plugin moved from @aiops-tools/proxmox-aiops to
  @zw008/proxmox-aiops, matching the publisher the skill has always been under.
  ClawHub cannot move a package between scopes — the scope is the publisher
  identity — so this is a republish under the new name; the old name is
  withdrawn. Install with:
  openclaw plugins install clawhub:@zw008/proxmox-aiops. Nothing about the Python
  package, the CLI, the MCP server or the Claude Code plugin changes.

v0.13.1

Added

• The OpenClaw install path is documented. The ClawHub bundle channel went
  live but neither the README nor this skill said how to install from it:
  openclaw plugins install clawhub:@aiops-tools/proxmox-aiops. States the uvx
  prerequisite (without it the skill installs but reports Visible to model: no) and that the MCP server is pinned to this exact release.
• Where an exported master password lives is now stated next to the
  instruction to export it: readable by every process the shell starts, and
  kept in shell history.

v0.13.0

Added

• Installable as a Claude Code plugin. .claude-plugin/plugin.json plus a
  root .mcp.json make this repo a plugin, so /plugin install proxmox-aiops@aiops-tools
  delivers the skill and registers the MCP server in one step. The server is
  pinned to the exact package version the manifest declares, so an audit row
  stays traceable to the code that produced it. Nothing about the tool itself
  changed — the CLI and the standalone MCP server work exactly as before.
• Installable from ClawHub as an OpenClaw bundle plugin (@aiops-tools/proxmox-aiops): one install delivers the skill and its MCP
  server, pinned to this exact release. clawhub.ai/plugins.

Fixed

• The skill was invisible to the model in OpenClaw. Its metadata
  declared requires.config (OpenClaw reads that as config keys, not file
  paths, so it can never be satisfied), requires.env and requires.bins
  naming our own CLI — which a plugin user never has on PATH — plus a
  primaryEnv that turned a config path into an API-key prompt. Measured on
  OpenClaw 2026.6.35: Visible to model: no. It now requires
  anyBins: [proxmox-aiops, uvx] — either one suffices — with every variable kept
  in optional.env (still declared, no longer a load gate), which the same
  command reports as Visible to model: yes.

v0.12.0

Fixed

• An undetermined outcome no longer exits as a plain failure. A write whose response was lost carries both error and outcomeUnknown, and the harness deliberately judges unknown first when writing the audit row — the change may have taken effect, so a blind retry could apply it twice. The CLI guard judged error first, so the audit said "may have taken effect" while the exit status told a script it had not happened. The two layers now agree (exit 2, not 1), and a test pins the ordering so it cannot silently flip back.

v0.11.0

Fixed

• undo apply replays against the target the original write ran on. It dispatched the inverse against whatever target the caller named — in practice the config's first entry — while the write's own target sat unused in the undo record. On a multi-target config the inverse therefore ran against the wrong host; it only looks harmless because the resource usually is not there, but two hosts holding the same name and the inverse succeeds on the wrong one, silently. An explicitly named target still wins. Line-wide: all 24 copies had the identical defect. Caught live in container-host-aiops, where a stop recorded against a Podman target replayed against a Portainer one.