v0.46.0-rc.9

What changed

• Merge pull request #178 from barockok/feat/owner-guardrails (608eb8e)
• docs: moving guardrails from sqlite to Postgres: the master key first, then a repair (d8f876b)
• fix(cli): guardrails import reads and raises the high-water mark in Redis when SLAUDE_REDIS_URL is set (4946f0d)
• fix(deploy): on Postgres without SLAUDE_MASTER_KEY a guardrail change is a 422 before the personas are applied (c574af4)
• fix(gateway): a queue dispatch without Redis (tests, injected infra) keeps the high-water mark local (21fd7b4)
• test(gateway): the gate guardrail case runs with a master key on Postgres (4697b7f)
• docs(spec): fail closed on oversize, the high-water mark and the repair path (f42ecca)
• docs(release): rc.9 review fixes and the console API change; field note review section (0386fb7)
• docs: guardrails reference: fail closed on oversize, write verification and repair, the high-water mark, key handling (00e50c4)
• test(gateway): the guardrail install listener, the sink, snapshot listeners and failure dedupe, reply window eviction (3621d7b)
• fix(guardrails): background passes resolve guardrails for their tenant; console firing reads are tenant-filtered (e5ae40b)
• fix(guardrails): the files hook compares paths case-insensitively where the volume is, and refuses Read, Grep and Glob of the signing key (fe51a67)
• fix(guardrails): a rule that fails to parse refuses the deploy (422), the import and the render; a host-file slug taken over by git is reported (207466b)
• fix(guardrails): rule parse problems are marked as blocking a write (788e4d7)
• fix(gateway): node guardrail reports take the action from the gateway's rule; a per-session bucket and per-job dedupe bound them (ed5365f)
• fix(queue): a job that needs the guardrails capability is re-pinned by the reaper to a live capable node, never the label queue (9874c39)
• fix(gateway): the high-water mark lives in Redis on cluster deployments; the console never reads or creates the key (27f7c97)
• test(guardrails): laundering refused, repair, high-water mark, read-only home, empty key file; Postgres legs run with a master key (69c5c5a)
• fix(guardrails): a write verifies the stored set first; slaude guardrails import --repair re-signs it, audited (8280470)
• fix(guardrails): a high-water mark (memory, a file beside the key, Redis) fails closed on a deleted or rolled-back set (54e0e73)
• fix(guardrails): the signing key is read or created only when a set exists; Postgres requires the master key; an empty key file is retried (b9ffc8f)
• fix(gateway): an unverifiable guardrail set drops inbound messages with the unavailable notice; long messages checked whole (b46c53a)
• fix(agent): remote threads match owner tool rules on the alias and the builtin name (2164eba)
• fix(guardrails): padding cannot hide a value; past any bound, deny and approve rules fail closed (86964b9)
• fix(agent): the owner guardrail hook holds its boot's snapshot, never the shared map (be7de31)
• fix(gateway): a guardrail change signals nodes without rebuilding the persona registry (65cbbea)
• test(agent): remote sessions count the two guardrail hooks (9e71e65)
• test(gateway): the decision gate never sees, posts or records an inbound guardrail drop (47d9a57)
• test(agent): a guardrail version change reloads warm sessions after their turn (3d53c02)
• chore(release): bump version to 0.46.0-rc.9 (44afa3e)
• docs(release): v0.46.0-rc.9 notes (4280629)
• docs: the guardrails reference documents owner guardrails; console page and settings (d8555c2)
• docs: owner guardrails field note and its Findings Log line (df22d43)
• refactor(soul): drop the baseline splitter that only fed the removed console section (9cb5e20)
• test(console): Playwright for the guardrail list, detail, agent tab and switch; runtime-layer tests removed (331b50e)
• feat(console): a Guardrails tab on each agent page (e64817d)
• feat(console): Resources > Guardrails lists the owner's guardrails, with a detail page and the enable switch; soul and access settings fold away (ff1a821)
• chore(console): dev stub fixtures for owner guardrails; the runtime-layer fixtures go (b9ad94a)
• test(guardrails): self-edit: file tools refused, planted files inert, no MCP tool writes rows (25003c7)
• feat(panel): owner guardrails API: list, detail, agent tab, and the superadmin enable switch (08721bb)
• refactor(panel): the runtime-layer API fields leave the console; the registry stays as code (31367c2)
• chore(queue): plain punctuation in the nodecaps key comment (68349d5)
• test(guardrails): leave no guardrail rows behind for later files; order-free audit checks (9aed650)
• feat(dispatch): nodes advertise the guardrails capability; an agent with enforced rules waits for a capable node, then the thread is told (b7d3740)
• feat(node): owner guardrails in the runtime bundle (version in the ETag), capability-gated, firings recorded by the gateway (210983f)
• feat(gateway): inbound owner rules as a pre-turn drop with a rate-limited reply; boot snapshot and reload (9e6f8c2)
• feat(background): owner tool rules in background passes (97c8335)
• feat(agent): sessions boot with an owner guardrail snapshot; Guidance after the soul, once-per-session delivery, fail closed (a7b36f9)
• feat(agent): hook.pre-tool.owner-guardrails and hook.pre-tool.guardrail-files, tagged and in the registry (3b4b22c)
• feat(deploy): payload v5 carries the deploy repo's guardrails; sync keeps overrides behind source (5eba4c7)
• feat(cli): slaude guardrails import stores GUARDRAIL.md folders, audited (8401586)
• feat(guardrails): effective set per agent and channel, prose cap and on-match index (7bbea25)
• feat(db): guardrails, overrides and a signed manifest in both dialects; verified snapshot (3485264)
• feat(guardrails): GUARDRAIL.md parser, re2js patterns and rule matching (9dcc79f)
• chore(deps): add re2js for guardrail patterns (linear-time regex) (60c22bb)
• docs(spec): owner-defined guardrails design (ce2a403)

Full diff: v0.46.0-rc.8...v0.46.0-rc.9

v0.46.0-rc.8

What changed

• Merge pull request #177 from barockok/fix/node-guards (200825c)
• docs: rc.8 review fixes (coalescing kinds, mono route resets, voice after a wake) (1dfc6ff)
• test(node): e2e: a wake job refuses an auto-allowed tool, the next job allows it (9532beb)
• fix(node): a wake is either the signed claim or the job's wake flag (7d764ab)
• fix(node): bind a job's token only once the session's config is current (42c5b19)
• fix(gateway): mono resets the Stop guard state on reused routes (83ec8fa)
• fix(queue): never coalesce turns of different kinds (b222e4d)
• chore(release): bump version to 0.46.0-rc.8 (b19e4e1)
• docs(release): v0.46.0-rc.8 notes (d0c4c97)
• docs: the guardrails survey's two node gaps are fixed in rc.8 (4e54293)
• feat(console): guardrails registry: nodes install the Stop guard and refuse wake tools (f651ed5)
• test(node): e2e: a silent node turn is sent back once (ddbcbd1)
• fix(node): refuse every tool in a wake before the node's local policy (e0bc532)
• fix(node): install the must-reply Stop guard on node workers (a98fde8)
• refactor(agent): share the must-reply tool rule and instruction (eb5ada3)

Full diff: v0.46.0-rc.7...v0.46.0-rc.8

v0.46.0-rc.7

What changed

• Merge pull request #176 from barockok/feat/guardrails-runtime-layer (8d9ae68)
• docs: list the two node behaviour gaps the guardrails survey found as follow-ups (c431917)
• fix(soul): a baseline code fence closes only on its own marker (27dc9c7)
• fix(guardrails): show the node caveats for the wake refusal, allow-list, wall clock and remote rows (1b3d845)
• chore(release): bump version to 0.46.0-rc.7 (7d69bd6)
• docs(release): v0.46.0-rc.7 notes and the guardrails page in the console docs (b2550e2)
• docs: guardrails runtime layer field note (b62a2ca)
• feat(console): guardrails page shows the system prompt, hooks and gates, and limits above the soul settings (8f53afa)
• chore(console): dev stub fixtures for the guardrails runtime layer (212dff5)
• feat(panel): guardrails API adds the prompt stack, baseline blocks, built-in skills and registry states (eccd299)
• feat(agent): guardrail registry and its agreement test against built session options (da17218)
• feat(soul): split the rendered runtime baseline into its ## blocks (132c67d)
• feat(agent): mark each hook callback with its guardrail registry id (e17d81d)
• docs(spec): guardrails as the runtime layer design (a2ccb81)

Full diff: v0.46.0-rc.6...v0.46.0-rc.7

v0.46.0-rc.6

What changed

• Merge pull request #175 from barockok/fix/console-smoke-rc6 (868ce11)
• docs(release): describe the rc.6 bundled skill refresh as shipped (8ff89e0)
• fix(ui): re-announce a repeated copy result (84fad91)
• fix(skills): refresh only exact release copies, never through a symlink (206093e)
• chore(release): bump version to 0.46.0-rc.6 (0a3c295)
• docs(release): v0.46.0-rc.6 notes and console docs (a93aaff)
• fix(ui): visible and announced feedback from the copy button (ea52654)
• fix(skills): refresh an unedited bundled skill seeded by an older release (79d97fb)
• fix(portal): surface-neutral wording for linked identities (9ed42d8)
• fix(portal): resolve workspace and user names when the team has several apps (9b0df2c)
• fix(console): name an agent actor by its agent, not its bot user id (93cea8b)

Full diff: v0.46.0-rc.5...v0.46.0-rc.6

v0.46.0-rc.5

What changed

• Merge pull request #174 from barockok/fix/embedding-provider (e65fc75)
• fix(brain): retire a probe from a boot that finished during close (4d1db86)
• fix(brain): spread probe samples across sources first (939e40e)
• fix(brain): a probe answering during a close never writes to the engine (b608709)
• docs: embedding probe sampling and background run (a11862b)
• test(brain): probe sampling cases; one PGLite initdb per guard test file (0dabc74)
• fix(brain): spread the embedding probe, never adopt a mixed brain, keep it off the boot path (9b06862)
• docs: embedding guard probe, adopt and the upgrade case (e151801)
• feat(brain): reembed --adopt; safe, resumable --model-mismatch (0a678d4)
• fix(brain-import): mark carried chunks, label them with the shared bundle model (fdefa0d)
• fix(brain): probe before refusing, labels describe the vector (c65ed28)
• chore: v0.46.0-rc.5 (embedding model label and guard) (1d26989)
• docs: embedding provider field note (359421c)
• feat(brain): slaude brain reembed --model-mismatch repairs mislabelled chunks (27d2d8e)
• fix(brain): label chunk writes with the configured embedding model, refuse to embed on a mismatch (c6c0add)

Full diff: v0.46.0-rc.4...v0.46.0-rc.5

v0.46.0-rc.11

What changed

• v0.46.0-rc.11: owner guardrails phase B (console editing, Test box) (#180) (02e3289)

Full diff: v0.46.0-rc.10...v0.46.0-rc.11

v0.46.0-rc.10

What changed

• v0.46.0-rc.10: owner guardrails phase A2 (approval cards, reply rules) (#179) (56f9e11)

Full diff: v0.46.0-rc.9...v0.46.0-rc.10

v0.46.0-rc.4

What changed

• Resources (skills, guardrails), markdown, surfaces and smoke fixes (v0.46.0-rc.4) (#173) (c3de655)

Full diff: v0.46.0-rc.3...v0.46.0-rc.4

v0.46.0-rc.3

What changed

• Console polish (v0.46.0-rc.3) (#172) (1b8d365)

Full diff: v0.46.0-rc.2...v0.46.0-rc.3

v0.46.0-rc.2

What changed

• Merge pull request #171 from barockok/fix/session-watch (399f248)
• chore(release): v0.46.0-rc.2 notes and version (e659a29)
• panel: history lines carry a stable id; the console keys earlier turns by it (50048ae)
• gateway: keep suppressed and voice-turn messages off the console's live tail (9f30397)
• panel: say when a session's history is cut at gbrain's row cap (6e7b6ea)
• persona: one resolver for a persona's agent slice, shared by the brain gate and history (792e439)
• panel: batch the session list's liveness reads; read a small stream window first (37a1316)
• agent: a reply joins the turn record only once its result says it was delivered (158190a)
• agent: the noted prompt is used once per record (c29cf7a)
• console dev stub and smoke tests: history, replies, Slack messages, pairing by id, activity (eb07af3)
• console: replies, Slack messages and earlier turns in Timeline and Chat; activity status (1b5a4dc)
• gateway: inbound Slack messages and mono agent events reach the console's event stream (b7fd176)
• panel: GET /sessions/:id/history serves earlier turns from the conversation record (a1f4561)
• panel: session activity from the warm registry, not the stored status (98d8339)
• agent: tool events carry the tool_use id; results name their tool; reply text joins the turn record (feb386f)
• agent: measure the context fill from the last model call, not the turn's summed usage (1b0bf78)

Full diff: v0.46.0-rc.1...v0.46.0-rc.2