v0.2.0

Features

• mcp: agent-to-agent messaging over MCP (6e49efb)
• mcp: orient agents with server-level instructions (a45cfe6)
• mcp: refine the MCP surface for tool-biased clients (bdbc405)

Bug Fixes

• api: correct package docstring and expose version (caf99c8)
• install: keep the daemons runnable under executable-stack interpreters (f3d35d0)
• mcp: conform the tool and notification surface to strict MCP clients (3c29e19)

Documentation

• add AGENTS.md, llms.txt, and an agent doc-QA loop (b1d077d)
• add Context7/DeepWiki indexing and copy-edit prose (d45e365)
• code: repoint stale doc pointers and add usage examples (a69f646)
• examples: correct the waitbus repository URL in example READMEs (b865c7c)
• mcp: describe output schema fields and add input examples (0a170db)
• messaging: add public agent-messaging guide and examples (77e8e31)
• readme: point at the live MCP specification URL (bb5a897)
• skill: link the agent-messaging guide by relative path (68d3420)
• tighten agent-facing wording and headings (eddb283)

v0.1.5

Added

• Agent-to-agent messaging over MCP. A new emit_agent_message tool sends a
  message to a named agent (or * for everyone), and the recipient reads it
  with the cursor-paginated read_agent_messages tool. A waitbus://agent/{name}
  resource acts as a doorbell that pings when a message arrives, so the agent
  reads only when there is something to read. Messages share the event store but
  stay out of the default tail_events and waitbus://current views; tail_events
  gains an event_types filter so a client can opt into them. Agent identities are
  cooperative and self-asserted — the bus is single-user and same-UID, so this is
  not a security boundary.

v0.1.4

Fixed

• MCP tool outputSchemas are now top-level object-type JSON Schemas instead of
  bare $ref wrappers. The Python SDK resolved the $ref transparently, but the
  official TypeScript SDK validates the schema strictly, so MCP clients built on it
  (the MCP Inspector, and likely Claude Desktop) rejected tools/list. The schemas
  now pass strict cross-implementation validation.
• The MCP server no longer sends notifications/resources/updated for the
  non-subscribable waitbus://event/{id} URI. That notification is reserved for
  resources the client has explicitly subscribed to; the unsolicited push could
  trip a strict client's protocol checks.
• Server-to-client notifications are held until the client completes the initialize
  handshake (notifications/initialized) rather than being flushed when the session
  opens.
• The notifications/claude/channel extension is sent only to clients that
  negotiated the claude/channel experimental capability, so a non-Claude client is
  never sent the vendor notification.

Added

• The four read tools carry readOnlyHint annotations (the three point reads also
  carry idempotentHint), so MCP clients can recognize them as safe, side-effect-free
  calls.

v0.1.3

Changed

• Secrets are stored in a single 0600-mode secrets.json under the user
  state directory and read with a stdlib JSON parse, replacing the
  systemd-creds encrypted-credential backend. At-rest protection of the file
  is delegated to host full-disk encryption (FileVault / LUKS); local access is
  bounded by the file's owner-only permissions and, for the broadcast socket,
  the kernel's same-UID peer-credential check. install-credentials reads the
  value from --file or stdin and merges it with an atomic replace; the
  --value flag is gone because it leaked secrets into shell history.
• The webhook listener is now opt-in. A default install ships secret-free; the
  broadcast and wait paths need no secret. Staging the GitHub webhook secret
  (install-credentials github-webhook-secret) is what enables the listener.

Removed

• The broadcast subscribe protocol no longer carries a bearer token. The
  AF_UNIX broadcast socket is already restricted to the connecting user by the
  kernel's peer-credential check, so the token guarded nothing a same-UID peer
  could not already reach. The subscribe frame's token field and the
  subscribe_rejected reason="token" reject are removed. This is a breaking
  wire-protocol change (acceptable pre-1.0).

v0.1.2

Fixed

• The systemd daemons failed to start under an interpreter with an executable
  stack. uv and pyenv standalone Python builds ship the interpreter without a
  non-executable GNU_STACK header, so the kernel assumes an executable stack
  and glibc allocates writable-and-executable thread stacks; the units'
  MemoryDenyWriteExecute setting blocks that, so thread creation failed with
  "can't start new thread". install-systemd now detects an executable-stack
  interpreter and writes a drop-in that disables only that protection for the
  affected units, with a notice on how to restore it. Interpreters with a
  non-executable stack are unaffected and keep the protection.

v0.1.1

Added

• MCP Registry listing: the package-ownership metadata (mcp-name) is now
  carried in the project README so waitbus can be discovered and installed
  through the Model Context Protocol registry. No code or API changes.

v0.1.0

waitbus v0.1.0 — first public release