v0.67.0

Added

• Added the managed GitHub App design for hosted
  cross-PR file-scope conflict prediction. It pins the boundary: the prediction
  reuses the existing local-core conflict finder, while webhooks, GitHub auth, the
  checks API, and hosting stay out of the local core as a separate managed layer.
  Advisory only, not implemented, and gated on a local adoption signal.
• Added a VS Code / Cursor extension stub (clients/vscode/, separate from the
  core Python package): a status bar with hub health and own-claim count,
  claim/release-current-file commands, a board tree view, and overview-ruler marks
  for claimed files. The editor-agnostic logic (fleetModel.ts) is Vitest-tested;
  extension.ts is the thin editor glue. CI builds, type-checks, and tests it.
• Added a public-surface taxonomy (surface_taxonomy.py, docs):
  every CLI subcommand is classified into a stability tier — stable core, adapters,
  read-only analysis, advisory governance, or experimental — and design-preview
  documentation pages are tracked separately. A regression test asserts the
  taxonomy and the live parser agree, so a new subcommand cannot ship unclassified
  and a removed one cannot linger. Makes the daily-safe surface obvious while
  keeping the pre-1.0 honesty.
• Added an operator risk view to the dashboard (dashboard_risk.py): the
  snapshot.json now carries a risk section, and the cockpit shows a Risk panel
  with a red/amber/green verdict, a priority-ordered signal list (stale leases and
  advisory branch conflicts as red, blocked tasks as amber), and a safe-next-work
  queue drawn from the ready set. It is derived strictly from the existing fleet
  snapshot — it invents no new signal — and stays read-only and local-first.
• Added a bounded streaming-response path (core/streaming.py) for incremental
  worker replies and long-running progress: an open/chunk…/done (or abort)
  frame sequence carried over the existing WebSocket chat path, tagged with one
  stream id. A StreamBounds ceiling (chunk count, per-chunk and total bytes,
  TTL) is enforced by both the producer (StreamProducer, agent.stream_reply)
  and the consumer (StreamConsumer), so a runaway stream is refused at the
  source and a malformed or oversized one is rejected on receipt. Streams are
  transient, not durable task state; the retention boundary is documented. See
  docs/streaming.md.

Fixed

• synapse send (and syn say), synapse accounting record, and synapse approval request/decide no longer silently drop their message when the sender
  name conflicts with a live identity. The hub accepts the welcome handshake and
  only then closes a name-conflicting socket (close code 4009), so a "ready"
  connection could already be doomed and the message was written into a dying
  socket and lost with no error — which read as "messages between terminals never
  arrive". A shared connect_failures.closed_after_ready now detects the
  post-welcome close so every one-shot send and emit reports the conflict with an
  actionable message instead of failing silently. (Operator note: a waiter must
  arm as <identity>-rx, never the bare <identity>, or an agent's own sends
  conflict with its own presence.)

Added

• Added the sandboxed tools and marketplace research
  design: a capability-limited WebAssembly sandbox (no ambient authority;
  deny-by-default filesystem, network, and resource grants as ACL scopes) as the
  precondition for any tool marketplace, which would gate on signed capability
  cards, a declared permission manifest, and run receipts. Not implemented; no
  untrusted code runs without the sandbox, and no executable marketplace ships
  before all preconditions exist.
• Added the multi-hub sync (CRDT) research design that
  asks whether several hubs could synchronise state while keeping claim safety and
  local-first. Its honest core: the append-only event log, presence, and progress
  merge conflict-free, but claims are mutual exclusion and not a CRDT — they are
  routed by single-owner-per-namespace and fail closed on a partition. Not
  implemented; adds no cross-hub service to the local core.
• Added a cross-agent adapter kits design: a
  planned synapse adapters step that detects installed coding tools (Claude
  Code, Codex, Cursor, Aider, Copilot) and writes a thin claim-aware adapter into
  each tool's native config, plus thin client shims for Python frameworks.
  Adapters carry only "claim before edit, release on commit, reach the hub";
  Synapse stays persona-neutral and adds no new coordination primitive. Not
  implemented yet.
• Added a federated trust model design that pins
  how independent operator-managed domains could peer — out-of-band,
  deny-by-default bundle exchange composing identity, signed events, mutual TLS,
  ACLs, and receipts across a domain boundary. It is a design boundary only: not
  implemented, not a certificate authority, and unchanged local-first default.
• Added the Agent Air Traffic Control architecture
  document that names how the shipped parts compose into one control loop —
  separation (claims), merge-risk radar (conflicts), evidence-gated completion
  (receipts, policy-check, approval), post-incident replay (postmortem,
  reliability), and memory (the ingest seam). It is an architecture, not a
  scheduler: only claims gate a mutation, everything else is read-only or advisory.

Changed

• synapse event-query now reads selectively instead of loading the whole event
  store for every query: each query pushes its sequence/time window and required
  event kinds into SQLite (EventStore.read_window), so memory is bounded by the
  query window rather than the log size. Results are unchanged — the loaded
  window is always a superset of the events a query keeps. Added --limit N to
  cap printed output to the most recent N records and conflict pairs.