v3.9.0

v3.9.0 — 2026-08-18

• VS Code daemon ownership: Linux startup now delegates to aiosd.service and requires an authenticated TCP handshake before reporting readiness, preventing detached auto-spawn races with the systemd user service during desktop login.
• Audit-ledger concurrency integrity: standalone audit appends now acquire SQLite's writer slot with BEGIN IMMEDIATE before reading the predecessor hash, while callers already inside a larger control-plane or Product Factory transaction upgrade that transaction without opening a nested one. This prevents concurrent connections from selecting the same predecessor and forking the supposedly linear hash chain. A file-backed eight-writer regression test reproduces the old fork and verifies one linear chain; a separate test preserves transactional audit-call compatibility.
• HTTP/2 denial-of-service advisory: updated transitive h2 from 0.4.15 to 0.4.16, resolving RUSTSEC-2026-0258 (unbounded empty DATA frames). The lockfile change is intentionally limited to the patched crate and checksum; cargo audit reports zero known vulnerabilities.
• Tray graphical-session startup: the Linux user service is now enabled by graphical-session.target instead of default.target. After= alone did not pull the graphical target into the same boot transaction, so Qt could start several seconds before the Wayland socket existed, abort once, and recover only through Restart=on-failure. The unit remains ordered after and part of the graphical session, while a CI-backed service contract prevents regression to early boot ownership.
• Detached child lifecycle: the daemon's scheduler no longer drops spawned Child handles without waiting for them. A single process-wide reaper thread now polls all detached agent and extension children and consumes their exit status, preventing completed cron children from accumulating as zombies under aiosd; reaper startup/channel failure terminates and waits for the untracked child instead of leaking it.
• SQLite maintenance and recovery: added raios db check [--full], raios db checkpoint [--truncate], and raios db backup [--keep 1..=10]. Online snapshots are source- and destination-checked, SHA-256-recorded, owner-only on Unix, fsynced before success, and pruned to a bounded retention set without touching unrelated files. The recovery guide keeps restore offline and operator-controlled because workspace.db is shared by every agent and control-plane surface.
• 3.9.0 release: moved all six Rust crates to one inherited [workspace.package] version, prepared the CLI/daemon as 3.9.0 and the VS Code extension as 0.9.0, and finalized the signed release metadata.

v3.8.0

What's Changed

• ci: use supported Intel macOS release runner by @alazndy in #2
• feat: attach existing projects to Factory by @alazndy in #3
• fix: harden daemon/CLI against panic vectors, raise coverage floor to 42% by @alazndy in #4
• fix: audit and harden raios-tray.py (quoting, venv drift, dependency pinning, silent failures) by @alazndy in #5
• docs: regenerate SIGMAP.md by @alazndy in #6
• docs: rustdoc depth pass, CHANGELOG catch-up, raios-tray README section by @alazndy in #7
• feat(bootstrap): gate raios bootstrap behind plan+confirm, remove hardcoded personal data by @alazndy in #8
• chore(release): bump version to 3.8.0 by @alazndy in #9

Full Changelog: v3.7.1...v3.8.0

v3.7.1

What's Changed

• release: harden and package v3.7.1 by @alazndy in #1

Full Changelog: v3.7.0...v3.7.1

v3.7.0 — Product Factory, ANKA & Wrapper Hardening

v3.7.0 — 2026-07-21

Added

• Product Factory (Phases 0-10): a full owner-bound, audit-logged product lifecycle layer — disabled-by-default typed config, workspace/product/intake/Charter drafting, Charter-backed requirement drafts, change-control and planning with approval-gated lifecycle cycles, evidence-gated stage completion, verified-release readiness, cycle pause/resume/cancel, dependency-aware evidence staleness, and a content-addressed (SHA-256) artifact store kept outside SQLite. Exposed via a bounded local TUI transport (/factory workspace|product|intake|answer|charter), new raios factory overview / raios factory execute CLI commands, and a policy-scoped MCP surface (factory_overview read-only, factory_execute blocking all human-only approval/cancellation/release actions).
• React Native/Expo Factory support: managed/prebuild/bare project detection, an idempotent closed-testing quality profile (TypeScript, Expo config, web export, dependency audit, Android/iOS device evidence), and quick/governed intake operating modes.
• ANKA (Agent Narrative Knowledge Archive): a separate, owner-only, redacted, rebuildable transcript cache (raios anka status|index|search|blame|forget) exposed read-only to agents as untrusted historical evidence via MCP anka_recall. Never writes to workspace.db, auto-injects context, or promotes records to curated memory.
• raios wrapper-note "<text>": lets a live raios run child (or a hook) record one explicit, project-bound follow-up note mid-session, over a loopback-TCP IPC path from the sandboxed child to the wrapper (an unguessable per-run UUID is the actual access-control boundary, not the transport). The wrapper validates run ownership, project match, length (≤500 chars), and secret-likeness before persisting to a new cp_wrapper_events table and the existing L0→L3 memory pipeline. Covered by a true end-to-end test over the real transport with two projects running in parallel, proving neither the note content nor the run-ID ownership check leaks across projects. A Unix domain socket was tried first and live-tested as unreachable from inside Codex's Landlock sandbox regardless of directory allow-listing; loopback TCP is reachable through that same sandbox once sandbox_workspace_write.network_access=true is set, so raios run codex (and the detached task runner) now always passes that override to every codex child it spawns — inert when Codex's effective sandbox is read-only or danger-full-access, but a deliberate, explicit widening of network egress for every shell command Codex's own agentic loop runs while wrapped, not just for wrapper-note.
• Wrapper launch-prompt capture: after a successful codex/opencode wrapper run, one explicit bounded positional launch prompt is persisted through the existing memory pipeline; flags, multi-argument invocations, oversized input, and secret-like text are rejected before capture.
• TUI numbered route tabs: the left-hand vertical route list is now a horizontal tab bar (1 NOW 2 WORK 3 EXPLORE 4 GOVERN) with direct number-key jumps; the header shows a two-line control-plane status band on taller terminals.

Changed

• Every codex child raios spawns now enables sandbox_workspace_write.network_access (via a single codex_command() builder shared by raios run and the detached task runner), specifically so wrapper-note's loopback-TCP channel is reachable without the caller needing to know Codex's sandbox internals. This is a real, security-relevant behavior change — it widens network egress for every shell command Codex's own agentic loop runs while wrapped, not just for wrapper-note — made deliberately after the transport-only fix (loopback TCP with default sandbox config) was live-verified to still fail identically to the original Unix-socket bug.
• RAIOS_DB_PATH environment override added to raios-core's database path resolution, so integration tests can run against a real isolated SQLite file instead of either mocking the DB or touching the live ~/.config/raios/workspace.db.
• Wrapper memory import scope narrowed: only Claude (project-bound) and AGY (workspace-bound) transcript histories auto-create project facts; Codex's and OpenCode's globally-scoped histories are intentionally skipped until their upstream formats carry trustworthy project/session identity.
• Periodic wrapper memory-sync shutdown now polls once per second instead of blocking session finalization for up to 90 seconds; informational --help/--version invocations no longer consume a pending handoff meant for an interactive session.

Fixed

• db_budget false-positive query match, VS Code extension CommandBridge HTTPS/loopback URL validation, and a sidebar DOM/textContent refactor (workspace and extension security hardening pass).
• Clippy single-char insert_str lint in anka.rs — full workspace cargo clippy --all-targets --all-features -- -D warnings is clean again.
• workspace.db maintenance under explicit approval: backed up (2.9GB), rebuildable trigram/BM25 search indexes purged and VACUUMed to 66MB (~98% reduction), with verified post-VACUUM integrity and 100% preservation of cp_*/mem_items/audit_log data.

Verification

• cargo test --workspace --lib: 732 passed, 0 failed.
• cargo clippy --workspace --all-targets --all-features -- -D warnings: passed.
• cargo audit: no vulnerabilities; 3 pre-existing unmaintained/unsound advisories (number_prefix, paste, lru), none new or blocking.
• The wrapper-note E2E test was mutation-checked twice (once per transport): confirmed to fail with the expected assertion when the run-ID ownership guard was temporarily removed, then verified green again after reverting, for both the Unix-socket and loopback-TCP versions.
• Live-tested raios wrapper-note from real codex children across five configurations to pin down the exact fix: no flag (Unix socket, rejected) → --sandbox workspace-write (TCP, still rejected) → --sandbox workspace-write -c sandbox_workspace_write.network_access=true (TCP, succeeded) → --sandbox danger-full-access (succeeded) → finally, the ordinary codex "<prompt>" invocation with zero explicit flags, the exact form a real user types, succeeding end-to-end once the network-access override was made automatic.

Post-release fix (included in this tag)

• Scheduled-job retry storm fixed: a failed agent spawn (e.g. binary missing
  from the daemon's PATH) now backs off next_run_at by the job's own
  interval instead of retrying every scheduler tick forever. Found live via
  a full paranoid audit — the "JSON Backup" job had been silently retrying
  every ~60s for 3 days.

---

Full diff: v3.6.0...v3.7.0

v3.6.0 — Typed Control Plane & Windows Install

Highlights

• Typed TUI control plane with serialization-only contracts, coherent daemon snapshots, typed commands/events, idempotency caching, transactional audit logging, and Now/Work/Explore/Govern routes.
• Native Windows 10/11 installation through install-system.ps1, including locked release builds, %APPDATA%\\raios configuration/policy setup, user PATH registration, and the RAIOS_Daemon Scheduled Task.
• Windows runtime parity with Scheduled Task daemon management, netstat.exe PID lookup, PowerShell lifecycle hooks, PowerShell agent wrappers, and portable tray startup paths.
• Cross-platform CI covering the full Cargo workspace on Windows, macOS, and Linux with the lockfile enforced.

Verification

• cargo test --workspace: 678 passed, 2 ignored, 0 failed.
• cargo clippy --workspace --all-targets --locked -- -D warnings: passed.
• pnpm audit --audit-level=high: no known vulnerabilities.

See the full change history in CHANGELOG.md.

v3.5.0 — Locate rename, MCP semantic_search daemon delegation, Dart support

Changed

• raios grep renamed to raios locate (MCP grep_search → locate_search), including the core engine (trigram::grep → trigram::locate, GrepMatch → LocateMatch) — the command name no longer collides with "grep" as a concept.

Fixed

• MCP semantic_search now delegates to the resident Cortex daemon, same as the CLI's raios search since v3.4.0. It previously paid a full in-process Cortex::init() + index_project() + HNSW rebuild on every single call — measured >60s per call, never completing within a 60s timeout. Now: ~1s warm.
• Duplicate search results from stale git worktrees — SKIP_DIRS now skips worktrees (Claude Code isolated-worktree checkouts under .claude/worktrees/<id>/ were being walked as live source).
• tool_pin (MCP tool-manifest tamper detection) was blocking all tools/call requests after grep_search/semantic_search were added without re-pinning. Verified the drift was legitimate, re-pinned.

Added

• Dart/Flutter support: dart added to INDEXED_EXTS, verified on two real Flutter projects with exact-parity results via both CLI and MCP.
• .fastembed_cache/ added to SKIP_DIRS.
• raios-policy.toml explicitly allow-lists locate_search/semantic_search and loopback domains for the resident-daemon TCP client.

Full diff: v3.4.0...v3.5.0

v3.4.0 — Trigram Grep & Resident Cortex

Added

• raios grep <pattern> — trigram-indexed exact/regex search ([--dir <path>] [-i] [--reindex]). Every file's content is indexed as lowercased 3-character windows in the shared workspace.db; queries extract the literal substrings a pattern requires, intersect candidate files in SQL, then regex-verify only those candidates. Exhaustive within scope (grep semantics, not top-k), measured at 0.015s warm on this repo, with proven set-identical output to grep -rn over the same scope. Patterns yielding no usable ≥3-char literal (alternations, short wildcards) fall back to a full scoped scan — always correct, just slower. New MCP tool grep_search exposes the same engine to agents (200-match response cap).
• Resident Cortex in aiosd — semantic search is now sub-second. A dedicated worker thread owns ONE long-lived Cortex (embedding model + HNSW), serving requests over an mpsc/oneshot channel with lazy dirty-flag rebuilds (file-change events mark dirty; the next search rebuilds once). raios search transparently delegates its vector half to the daemon (300ms connect timeout, AUTH handshake) and silently falls back to the full in-process path when the daemon is unreachable — measured: ~1.0s daemon-warm vs ~4-6s fallback, identical results. New daemon command CortexReindex; VectorSearch responses gain an additive vector_hits field (existing results shape untouched for TUI compatibility).

Fixed

• Daemon's VectorSearch handler previously ran Cortex::init() — full model load + HNSW rebuild — on every single request; the file-watcher worker did the same per changed file, and its incremental index_file writes never triggered an HNSW rebuild at all (silently useless indexing). All three replaced by the resident-worker design above.

Notes

• Built as two parallel agent worktrees (Codex: trigram; Antigravity: daemon residency) with an explicitly partitioned file surface; merged sequentially with a rebase. Combined suite: 634 tests, 0 failures (619 → +10 trigram, +5 daemon).

v3.3.0 — Layered Memory & Lineage, Operational Hardening

Added

• Layered memory (L0→L3), ported from TencentDB-Agent-Memory's semantic pyramid: mem_nodes (immutable evidence: raw transcript lines, archived body revisions) + mem_lineage (derived-from/revision edges) give mem_items real traceability for the first time. mem_items.layer discriminates L1 atomic facts (deterministic hash-slugged, deduped), L2 daily scene digests (cumulative same-day merge with [[slug]] backlinks), and L3 a rolling persona (background + working rules, rebuilt from the newest L1 facts). All distillation is local/deterministic — no LLM calls.
• raios mem history <slug> and raios mem list --layer <n> — inspect a memory item's revision chain and filter by pyramid layer.
• raios sessions --canvas <session_id> — folds a session's session_events stream into a compact Mermaid flowchart; consecutive same-type events collapse into one node with a se:<id> back-reference to the full, untruncated payload — compression is never irreversible.
• raios usage now reports live Claude Pro/Max quota remaining. The statusLine script caches rate_limits.five_hour/seven_day usage percentages (from Claude Code's own stdin JSON) to ~/.claude/raios-usage-cache.json; raios usage reads that cache (with a 24h staleness cutoff) and shows 5h:XX% 7d:YY% remaining plus formatted reset times instead of a hardcoded "unknown".

Fixed

• mem_items.body unbounded growth: mem_upsert previously concatenated every write onto the same row forever. It now replaces the body and archives the previous version as an immutable mem_nodes revision — the full history is still recoverable via raios mem history, but the live row stays bounded.
• A second instance of the same bug, caught only by a whole-branch review: the 90-second periodic memory-sync thread re-scans the entire session transcript on every tick (fixed start timestamp), and was inserting a fresh, undeduplicated mem_nodes/mem_lineage row per matched fact on every pass — silently recreating unbounded growth one layer down. Fixed with content-addressed dedup on (project_key, kind, content) for l0_raw nodes (revision nodes are correctly exempt — each is a genuinely distinct snapshot).
• mem_upsert's archive-then-replace sequence (revision node + lineage edge + item update) now runs inside a single SQLite transaction instead of three unguarded autocommit statements.
• raios security / raios refactor output now discloses its own limitation inline ("pattern-based scan — a clean result is not proof of absence") instead of only in internal docs — both are regex/heuristic scanners, not semantic analysis.
• gen-context.config.json used an unrecognized customOutput key that sigmap silently ignored, so it never wrote SIGMAP.md (it was defaulting to .github/copilot-instructions.md instead). Corrected to the real output key.

Changed

• session_memory.rs (974 lines after the memory-layering work) split into a session_memory/ directory module — transcript_io.rs, heuristics.rs, distillation.rs, plus a thin mod.rs orchestrator. Pure move, no behavior change; full external call surface (auto_sync_agent_memory, collect_transcript, decision_lines_from_transcript, etc.) preserved.

v1.5.0 — Intelligence & Architecture Edition

What's New in v1.5.0

Phase 5 — Agent Swarm Mesh

Parallel agent development in isolated git worktrees (create→dispatch→approve→merge).

• raios swarm start|list|approve|reject CLI
• TCP: CreateSwarmTask / GetSwarmTask / ListSwarmTasks / ApproveSwarmTask / RejectSwarmTask
• MCP: create_swarm_task, list_swarm_tasks, approve_swarm_task

Phase 6 — Edge Intelligence

Cosine-similarity semantic routing: natural-language → best raios capability.

• raios route "<query>" CLI + route_capability MCP tool

Phase 7 — Evolutionary Intelligence

Learns instinct candidates from job success/failure outcomes.

• raios evolve list|promote|prune CLI
• MCP: list_evolution_candidates, promote_evolution_candidate

Phase 8 — Recursive Reasoning (Task DAG)

Agents submit a DAG of dependent shell commands; independent nodes run in parallel.

• TCP: CreateTaskGraph / ExecuteTaskGraph / GetTaskGraph
• Max 50 nodes, cycle detection, 10-min timeout, 5 unit tests

---

Architecture Refactor

File	Before	After
cli.rs	3001 lines	src/cli/ — 11 submodules (max 329L)
mcp_server.rs	1667 lines	src/mcp/ — 7 submodules (max 380L)
hybrid_search + indexer	root	src/search/
edge + evolution + instinct + router	root	src/intelligence/

33 clippy warnings → 0 | 143/146 tests green

v1.4.0 — Universal Kernel Edition

🌐 Universal Kernel Edition

R-AI-OS evolves from a CLI toolkit into a true Universal Agent Operating System Kernel — bridging Claude, Gemini, Codex, and Antigravity through a tri-protocol architecture.

🆕 Universal Agent Kernel (2.0)

Module	What it does
Tri-Protocol Interface	Daemon TCP :42069 + MCP-over-TCP :42070 + CLI concurrent, shared event bus
Lock Manager	File/task locks, User > Agent > Automation priority, 30s timeout, deadlock prevention
Radar Whisper Stream	Real-time compile errors, security vulns, arch violations → all connected agents
Factory Mode	Heavy jobs queued async, instant job_id return, SQLite inbox + webhook notification
Universal Proxy-Store	One capability name → Rust/Python/Shell/MCP bridge backend

💾 Storage Overhaul

• Cortex Store — cortex_store.json → SQLite BLOB (1536 bytes/chunk, transaction-safe, auto-migration)
• BM25 Index — Persisted in SQLite, mtime-based invalidation, no cold-start rebuilds
• Session Memory — Per-agent SQLite sessions, event log, memory.md auto-append on disconnect

📡 New MCP Resources & Tools

• raios://session/current — active session + events
• raios://session/recent — last 10 completed sessions
• session_note tool — write structured notes from any MCP client

📦 Install

git clone https://github.com/alazndy/R-AI-OS.git && cd R-AI-OS
cargo install --path . --force
aiosd  # starts tri-protocol kernel

114 tests passing · Rust 2021 · MIT License