v3.7.0 — Product Factory, ANKA & Wrapper Hardening

v3.7.0 — 2026-07-21

Added

• Product Factory (Phases 0-10): a full owner-bound, audit-logged product lifecycle layer — disabled-by-default typed config, workspace/product/intake/Charter drafting, Charter-backed requirement drafts, change-control and planning with approval-gated lifecycle cycles, evidence-gated stage completion, verified-release readiness, cycle pause/resume/cancel, dependency-aware evidence staleness, and a content-addressed (SHA-256) artifact store kept outside SQLite. Exposed via a bounded local TUI transport (/factory workspace|product|intake|answer|charter), new raios factory overview / raios factory execute CLI commands, and a policy-scoped MCP surface (factory_overview read-only, factory_execute blocking all human-only approval/cancellation/release actions).
• React Native/Expo Factory support: managed/prebuild/bare project detection, an idempotent closed-testing quality profile (TypeScript, Expo config, web export, dependency audit, Android/iOS device evidence), and quick/governed intake operating modes.
• ANKA (Agent Narrative Knowledge Archive): a separate, owner-only, redacted, rebuildable transcript cache (raios anka status|index|search|blame|forget) exposed read-only to agents as untrusted historical evidence via MCP anka_recall. Never writes to workspace.db, auto-injects context, or promotes records to curated memory.
• raios wrapper-note "<text>": lets a live raios run child (or a hook) record one explicit, project-bound follow-up note mid-session, over a loopback-TCP IPC path from the sandboxed child to the wrapper (an unguessable per-run UUID is the actual access-control boundary, not the transport). The wrapper validates run ownership, project match, length (≤500 chars), and secret-likeness before persisting to a new cp_wrapper_events table and the existing L0→L3 memory pipeline. Covered by a true end-to-end test over the real transport with two projects running in parallel, proving neither the note content nor the run-ID ownership check leaks across projects. A Unix domain socket was tried first and live-tested as unreachable from inside Codex's Landlock sandbox regardless of directory allow-listing; loopback TCP is reachable through that same sandbox once sandbox_workspace_write.network_access=true is set, so raios run codex (and the detached task runner) now always passes that override to every codex child it spawns — inert when Codex's effective sandbox is read-only or danger-full-access, but a deliberate, explicit widening of network egress for every shell command Codex's own agentic loop runs while wrapped, not just for wrapper-note.
• Wrapper launch-prompt capture: after a successful codex/opencode wrapper run, one explicit bounded positional launch prompt is persisted through the existing memory pipeline; flags, multi-argument invocations, oversized input, and secret-like text are rejected before capture.
• TUI numbered route tabs: the left-hand vertical route list is now a horizontal tab bar (1 NOW 2 WORK 3 EXPLORE 4 GOVERN) with direct number-key jumps; the header shows a two-line control-plane status band on taller terminals.

Changed

• Every codex child raios spawns now enables sandbox_workspace_write.network_access (via a single codex_command() builder shared by raios run and the detached task runner), specifically so wrapper-note's loopback-TCP channel is reachable without the caller needing to know Codex's sandbox internals. This is a real, security-relevant behavior change — it widens network egress for every shell command Codex's own agentic loop runs while wrapped, not just for wrapper-note — made deliberately after the transport-only fix (loopback TCP with default sandbox config) was live-verified to still fail identically to the original Unix-socket bug.
• RAIOS_DB_PATH environment override added to raios-core's database path resolution, so integration tests can run against a real isolated SQLite file instead of either mocking the DB or touching the live ~/.config/raios/workspace.db.
• Wrapper memory import scope narrowed: only Claude (project-bound) and AGY (workspace-bound) transcript histories auto-create project facts; Codex's and OpenCode's globally-scoped histories are intentionally skipped until their upstream formats carry trustworthy project/session identity.
• Periodic wrapper memory-sync shutdown now polls once per second instead of blocking session finalization for up to 90 seconds; informational --help/--version invocations no longer consume a pending handoff meant for an interactive session.

Fixed

• db_budget false-positive query match, VS Code extension CommandBridge HTTPS/loopback URL validation, and a sidebar DOM/textContent refactor (workspace and extension security hardening pass).
• Clippy single-char insert_str lint in anka.rs — full workspace cargo clippy --all-targets --all-features -- -D warnings is clean again.
• workspace.db maintenance under explicit approval: backed up (2.9GB), rebuildable trigram/BM25 search indexes purged and VACUUMed to 66MB (~98% reduction), with verified post-VACUUM integrity and 100% preservation of cp_*/mem_items/audit_log data.

Verification

• cargo test --workspace --lib: 732 passed, 0 failed.
• cargo clippy --workspace --all-targets --all-features -- -D warnings: passed.
• cargo audit: no vulnerabilities; 3 pre-existing unmaintained/unsound advisories (number_prefix, paste, lru), none new or blocking.
• The wrapper-note E2E test was mutation-checked twice (once per transport): confirmed to fail with the expected assertion when the run-ID ownership guard was temporarily removed, then verified green again after reverting, for both the Unix-socket and loopback-TCP versions.
• Live-tested raios wrapper-note from real codex children across five configurations to pin down the exact fix: no flag (Unix socket, rejected) → --sandbox workspace-write (TCP, still rejected) → --sandbox workspace-write -c sandbox_workspace_write.network_access=true (TCP, succeeded) → --sandbox danger-full-access (succeeded) → finally, the ordinary codex "<prompt>" invocation with zero explicit flags, the exact form a real user types, succeeding end-to-end once the network-access override was made automatic.

Post-release fix (included in this tag)

• Scheduled-job retry storm fixed: a failed agent spawn (e.g. binary missing
  from the daemon's PATH) now backs off next_run_at by the job's own
  interval instead of retrying every scheduler tick forever. Found live via
  a full paranoid audit — the "JSON Backup" job had been silently retrying
  every ~60s for 3 days.

---

Full diff: v3.6.0...v3.7.0