lode v1.6.0

Features

• JIRA connector detects bare issue keys (PROJ-123) in note text, gated on an explicit jira_projects allowlist (lode-2o45)
• TUI: Ctrl+N opens a bare JIRA key under the cursor as a browse link (lode-dube)
• Editor no-egress toggle in the command palette, with a red body border on Capture and Edit screens (lode-pky9)

Fixes

• Background work queue no longer wedges when a failed refresh job collides with a live one (lode-8a37)
• update-deps.sh gates against the candidate lock, restoring the old lock on failure (lode-2zi9)
• land-lock.sh ages its lock by uptime and boot id, so a clock jump can't reclaim a live lock (lode-3874)
• Land isolation replay activates the venv and reports a missing nox as a machine fault (lode-04zb)
• Test suite never does real DNS lookups; fixes a flaky tool-turn Q&A test (lode-azkh)

Improvements

• Migrated lode's HTTP clients from httpx to the maintained httpx2 fork, including the anthropic 1.0 upgrade (lode-6wly, lode-06ws)
• Atlassian connector HTTP clients retry connection setup (atlassian_connect_retries, default 1) (lode-lq9u)
• HTTP connection pools are reused across fetches; shared client factory for guarded fetches (lode-s54x, lode-tvrb)
• Live-job uniqueness index covers failed jobs, via a versioned schema migration (lode-uri7)

Internal / workflow

• Docs-index lookup: AND→OR fallback on zero hits, usage logging and stats, and guidance single-sourced in docs/docs-index.md (lode-qcp0, lode-dozi, lode-i5ww, lode-4z0g, lode-wtk2, lode-w02s, lode-zk7e)
• Docs-nits collector pipeline: shared bd-docs-nit.sh, collector lifecycle policy, routing from every stage, and --file path normalization (lode-y86u, lode-ayfm, lode-t551, lode-z1n5, lode-9e5o, lode-v4ks, lode-4xj1, lode-f8ec, lode-1gpc)
• /code reclaims harness-locked launch worktrees through a tested script (lode-7ndi, lode-rdm9)
• Scripts load sibling modules without a per-caller bootstrap (lode-7l68)
• Shared test helpers for fake bd and fenced-bash bodies (lode-ww8o, lode-2r1q)
• Documented the platform floor: the app must run on macOS; dev tooling is Linux/WSL-only (lode-dz92)
• docs/settings.md rows stand on their own, with a gate test (lode-0teo)
• Docs wording-nit batches (lode-59da, lode-61w6, lode-z9hz, lode-dcsu)
• Dependency lock refreshes (anthropic 1.4.0, click 8.5.0, lancedb 0.38.0, typer 0.27.2, and others)

lode v1.5.0

lode brand: name resolution, visual identity, and a docs site (lode-fhql)

Brand identity settled and a published docs site shipped end to end.

• Brand brief: positioning, name story, palette, type, voice (lode-fhql.3); clear-space rule restated for the assembled lockup (lode-wqw2)
• SVG logo mark + wordmark under docs/assets/, with a dark-theme lockup so the README logo is visible on GitHub dark mode (lode-fhql.4, lode-fhql.19)
• ASCII/Unicode wordmark in lode version and the TUI help overlay (lode-fhql.5)
• Favicon (legible against dark browser chrome) and OG/social card derived mechanically from the mark (lode-fhql.6, lode-fhql.22, lode-fhql.17)
• README carries the identity and a working Install section (wheel from GitHub releases; a PyPI lode warning) (lode-fhql.7, lode-fhql.2)
• Docs site: MkDocs-Material chosen (lode-fhql.8), GitHub Pages publish workflow (lode-fhql.9), landing page (lode-fhql.10), GitHub-compatible heading slugs and anchor fixes (lode-fhql.21, lode-rmsf), strict docs-link gate (lode-fhql.20)
• Generator-derived keymap and runtime-settings reference pages, published on the site (lode-fhql.15, lode-7uze, lode-gecm)
• Docs CI fixed (package install, toolchain deps) and scoped to docs-affecting paths (lode-fhql.23, lode-xx46, lode-ui7m); one pinned mermaid-cli image everywhere (lode-3ld8, lode-pi9y); published-set drift gates (lode-zznx)
• Distribution renamed to lode-kb (CLI and import package stay lode) (lode-w3wt)

Backport the harness-export improvements into lode (lode-s9xe)

The /land workflow's destructive shell moved out of prose into tested scripts.

• Extracted, tested scripts: land-heartbeat, stacked-graph, drop-from-accepted, land-merge-batch, land-replay, worktree-gc-sweep, harness-doctor (lode-s9xe.1–.6, .13, .14)
• /land SKILL.md invokes the scripts; the fenced destructive bash is gone (lode-s9xe.6)
• tests/README.md survey of the test suite (lode-s9xe.7); CLAUDE.md non-interactive-shell + glossary sections (lode-s9xe.8, lode-ohya); AGENTS.md keep-decision recorded (lode-s9xe.9)

Features

• lode stats: read-only corpus-inspection CLI — tombstone breakdown and corpus metrics (lode-tyhy)
• Per-note no_egress: lode no-egress --note, a TUI browse toggle with confirmation on clearing, and visible markers (lode-82wt, lode-a50f)
• TUI theme config: [tui.theme] base + per-colour overrides, and lode theme export printing round-trippable TOML (lode-cwyk)
• CLI theme config: [cli.theme] semantic style names, validated at config load (lode-mk9j)
• Fenced code blocks coloured in TUI note bodies; note-body markdown palette retuned off the terminal ANSI range (lode-lab1, lode-dmbc)
• Browse: BM25 quick search rebound to /, retiring the summary-only progressive search (lode-wdm0)

Fixes

• Settings.no_egress_default now actually applies to new notes and new externals rows (lode-a43n, lode-ge8w)
• A broken config.toml no longer takes down lode <cmd> --help or lode theme export (lode-moq7, lode-rtcx, lode-bmpg)
• Privacy-bearing settings fallbacks log a WARNING instead of silently using library defaults (lode-xa5d)
• lode backfill with no connector is a uniform usage error (full help, exit 2); jira registers its connector explicitly like confluence (lode-pk54, lode-6hi3, lode-2uil)
• lode status dead-letter hints: split by job type, accurate self-healing claims, softened severity when all dead letters self-heal (lode-8vcq, lode-tix0, lode-tr3i)
• TUI help binding works under the Kitty keyboard protocol (Ctrl+Minus variants) (lode-av50)
• LLM provider: context-window-exceeded stop reason named explicitly in error hints (lode-cai6)
• CLI resolves settings once per invocation instead of twice (lode-bsga, lode-stxz, lode-up3w); EditScreen opens one DB connection per note open (lode-nnqp)

Internal / workflow

• TUI dedup: shared YesNoConfirmScreen and one .confirm-dialog tcss frame across eight modals (lode-1ip2, lode-f0qf)
• Nox gate buckets: three blessed tags with a registration gate and a staged builder/reviewer gate policy (lode-6ldh, lode-b9qy)
• Coding conventions: parenthesized multi-exception except fiat with a corpus-scan gate (lode-buay, lode-z1ig, lode-hk72); comment-style fiat plus the /comment-audit pipeline (auditor → veto → groomer) and a src/lode comment sweep (lode-e7tb, lode-js5g, lode-15qh, lode-fu4g, lode-zdqt)
• /land hardening: replay baselines nox -t fix and the everything-else bucket, machine faults stop the replay instead of bouncing innocent branches, MISTAKES.md filing reachable on every pass, lock token idiom harmonized (lode-lmu9, lode-mps0, lode-om7o, lode-k6h0, lode-fdod, lode-3cda, lode-xlcm)
• SHA-fabrication guards: validate-sha40.sh required at every review_head/land_head write site, mechanically gated (lode-0a4n, lode-uvjr)
• /sweep: full actionable list every pass; dependency-blocked human tickets surfaced report-only and excluded from the digest and statusline count (lode-8xl2, lode-csxh, lode-48gj, lode-7guf)
• Autonomous MISTAKES.md filing wired into every workflow stage (lode-v1rk); dangling-cross-reference checks pre-handoff (lode-nbh1)
• Test-suite hygiene: live-checkout escape hatches closed (lode-6hl9), xdist flakes fixed (lode-o7rt, lode-887o, lode-d7xw), CI runs without beads (lode-fqob), stale spike tests retired (lode-lr0y, lode-d1dt), shared git-repo helpers hoisted (lode-9egu)
• Link/docs gates: every tracked *.md scanned, slug regex drift fixed, one text cache per check (lode-act5, lode-6e9c, lode-d3k0)
• worktree-gc-sweep: --base-ref dropped; predicate divergence recorded as correct-by-design (lode-0867, lode-2132)
• update-deps.sh files a churn-evaluation ticket on green promotes (lode-i642)

lode v1.4.0

Lookup without loading: a derived, never-committed index over docs/ (lode-t6o1)

Answering "what did we decide about X" no longer means pulling a 400K-line design doc into
context. A new lookup tool rebuilds an FTS5 index over docs/*.md on every invocation and prints
ranked path:line_lo-line_hi pointers with a snippet — never a full doc, never a synthesized
answer.

• Chunker that splits on the deepest heading or bullet, holds a 16 KB size invariant, detects
  CommonMark fences correctly, and emits exact 1-based line ranges that tile each file (lode-t6o1.1)
• FTS5 index built per invocation into an XDG cache path outside the worktree, stdlib sqlite3
  only (lode-t6o1.2)
• scripts/docs_index_query.py: Typer CLI returning ranked pointers, with FTS5 input escaping
  (lode-t6o1.3)
• Gate test proving the index can never become a tracked file (lode-t6o1.4)
• CLAUDE.md routes decision lookups to the tool first (lode-t6o1.5)
• Chunker lives in scripts/ as repo tooling rather than in src/lode/ (lode-1fzq)
• One importable CommonMark fence parser (src/lode/fence_parsing.py), with the private-fence AST
  gate widened to src/lode (lode-ee7b)

CLI --help: user-facing text split from maintainer rationale (lode-ii25)

Every registered command now carries concise, reader-facing help= text while its docstring stays
verbatim as the design record — and a corpus gate keeps it that way.

• New coding convention recording the help=/docstring split (lode-ii25.1)
• Concise help= across the CLI: reindex-lexical (lode-ii25.2); reembed/reenrich
  (lode-ii25.3); status/backfill (lode-ii25.4); work/dump-html/verify/show
  (lode-ii25.5); the remaining nine mid-length commands (lode-ii25.6); models pull (lode-ii25.11)
• Clean one-line summaries in the lode --help command list (lode-ii25.7)
• Every help= footnote into docs/ now resolves, and the maintenance-command gap is filled with
  docs/how-to/maintenance-commands.md (lode-ii25.8, lode-ii25.10)
• Corpus-scan gate enforcing the help= rules over all 21 registered commands, with an allowlist
  that is now empty (lode-ii25.9)
• Gate widened to walk sub-app groups as well as leaf commands (lode-g0ck, lode-r51w)
• check_links.py gates anchor-less docs/<page>.md citations outside docs/ (lode-6lvu)

Keybinding help overlay, and the footer as a hint surface (lode-2bt3)

The TUI footer stops pretending to be the complete binding contract; a real help overlay takes that
job.

• HelpScreen modal composing Textual's BindingsTable over a live binding snapshot, opened with
  ctrl+_ or ? (lode-2bt3.2)
• Per-screen footer priority: screens hide the bindings they don't need, restoring readable labels
  (View content, Related, History, Quick) instead of abbreviations (lode-2bt3.3)
• Search direction retired on the browse screen so ? is free for help; / always restarts the
  scan from the top (lode-2bt3.1)
• Parametrized footer-width scan over all 11 footer-bearing screens, so "tightest screen" is derived
  rather than asserted (lode-2rv2)

docs/decisions.md landing bottleneck (lode-4jtc)

• Root .gitattributes declares docs/decisions.md merge=union, killing the append-at-EOF
  landing conflict — a git built-in, no per-clone config (lode-4jtc.1)
• Rationale, rejected alternatives, and the ours-side-only union caveat recorded (lode-fp9l)

Fixes

• Statusline: the build: count is now the complement of its sibling segments, so the /sweep
  digest no longer makes an idle fleet read build:1 forever (lode-9hqr)
• CLI help-corpus gate: strip ANSI escapes and force color off, so the plain-text parsers survive
  Rich's colorizing under CI (lode-pdtd, lode-g8ry)

Internal / workflow

• Correctness-review Workflow fully retired: JS deleted, runbooks stamped, decision recorded
  (lode-blrl)
• Escalation resolution can no longer strand a ticket at ready-for-code-review with no
  review_head (lode-uomo)
• run_tool_turns logs each run's total output-token spend against its bound (observational, no new
  knob) (lode-9594)
• CI: actions/cache bumped v4 → v6 (Node 20 deprecation)

lode v1.3.0

Ask-screen readability, offline search, and tool-augmented Q&A (lode-35nu)

The Ask experience gets citations you can actually follow, a non-AI quick search that works
without a model call, and — behind the sub-epic below — the ability to consult external
sources mid-answer.

• Every citation now resolves to a real note identity (note id + title), not a bare version id (lode-35nu.1)
• Cited results group by note and render surrounding context with the quoted span highlighted (lode-35nu.3)
• Jump straight from a cited result to the note it came from (lode-35nu.4)
• A live spinner and in-flight status replace the static "Thinking…" placeholder (lode-35nu.5)
• Browse: non-AI quick search over your notes via the FTS5 index (lode-35nu.6)
• Fix: selecting a tag on the Tags screen no longer filters out every note (lode-35nu.7)
• Fix: the related-notes panel no longer swallows the edit cursor line when it expands (lode-35nu.10)
• Spike: confirmed faithfulness.py's word-boundary tokenization is good enough to keep (lode-35nu.8)
• cli.py refactored into src/lode/cli/** as dispatch-only (lode-35nu.9)
• Empty tables across the TUI use LodeDataTable.empty_message instead of a blank grid (lode-ligf)
• Recorded the deliberate wont-do on per-claim LLM annotation in the answer schema (lode-35nu.12)

Tools for Ask: read-only external query, snapshot-then-cite (lode-35nu.11)

Ask can now reach read-only external sources mid-answer, snapshot what it read, and cite the
snapshot — so an answer stays verifiable after the source changes or disappears.

• Read-only JIRA, Confluence, and web query tools exposed to the Ask path (lode-8hsk)
• Snapshot-then-cite: a live tool result is persisted as an external snapshot before synthesis (lode-35nu.11.1)
• Tool-augmented Ask wired through the production cited_answer.ask path, with gate-eligible tool snapshots (lode-8vvp)
• "Ask about THIS note" — a per-note question entry point (lode-35nu.11.3)
• Save an ask answer as a new note, linked to its source, on user confirmation (lode-35nu.11.4)
• Multi-turn tool use on the LLMProvider seam (lode-35nu.11.6)
• Schema plus the first migration mechanism for tool-call egress and discovered_via (lode-35nu.11.7)
• Scope-level no_egress rules that cover not-yet-seen external sources (lode-35nu.11.8)
• Design settled for identity, persistence, and egress under tool-augmented Ask (lode-35nu.11.5)
• Fix: lode egress --purpose tool no longer rejects rows lode itself writes (lode-l87l)

Hardening around the new tool path

• web_fetch SSRF: redirect-chain and DNS-rebinding gaps closed at the webfetch layer (lode-xwah)
• Bounded where the model may point web_fetch (lode-ejfv)
• Defenses against prompt injection via tool results steering later tool calls (lode-80bv)
• run_tool_turns' max_tokens settled as a per-run budget (lode-3dh1)
• Verified jira_search's endpoint against Atlassian's removal of GET /rest/api/3/search (lode-6nwu)

Features

• lode reindex for the lexical (FTS5) index — notes saved before the lexical leg landed now surface in quick search (lode-x9lu)
• Lexical coverage gaps are no longer silent: a reconcile step plus a lode status hint (lode-fd2g)
• The enrichment inspector shows a note's externally-inherited tags (lode-f0m1)
• Table empty-state moved onto LodeDataTable instead of a sentinel row (lode-t7pw)

Fixes

• Search works for notes in any non-Latin script — build_match_query no longer drops non-ASCII text (lode-8irr)
• Faithfulness coupling no longer lets a negated span couple by ignoring extra span tokens (lode-w2y7)
• The coupling fast path no longer fails open on compound-identifier fragments (lode-1qxy)
• A repeated quoted span highlights the right occurrence — Support carries a body offset (lode-hruz)
• App-side Support.body_offset kept out of the LLM structured-output schema (lode-9nmk)
• Pinned-note ask context is bounded and no longer re-sends the same parent block (lode-ol2v)
• Dangling :func: docstring references after the _resolve_target rename repaired (lode-2hfd)

Internal / workflow

• Citation identity and as-of resolution moved out of lode.tui into a shared read module (lode-kuc7)
• cited_answer.ask batches target resolution into two IN(...) queries (lode-ekqh), re-cut as a whole-SQL {placeholders} seam with one shared placeholder builder (lode-oca9) over a shared batched polymorphic resolver (lode-r9z0)
• cli._retrieve moved into lode.retrieval, closing the cross-package CLI seam (lode-z3es)
• lode.cli.console seam collapsed to patch-where-used, removing the status.py special case (lode-1bfn, lode-nftw), with stale src/lode/cli.py pointers swept from source and tests (lode-1dmu, lode-j25e) and the console docstring/test cross-reference corrected (lode-gt5b, lode-tts0)
• jobs_read.list_egress returns a NamedTuple instead of an 8-wide positional tuple (lode-kl1i)
• New gate: Python :func: docstring refs must resolve to real symbols (lode-8oeu); docstringcheck's 81 standing wrapped-ref WARNINGs cleared so new ones are visible (lode-hg49)
• Worktree isolation enforced by a PreToolUse hook rather than markdown checkpoints alone (lode-p8zl), with hook cwd verified under isolation (lode-lnvi) and the stale payload premise corrected in docs/decisions.md (lode-5ido)
• Fix: a launch worktree deleted mid-session under /code fan-out no longer strands the agent on trunk (lode-6wgc)
• land_head/review_head validated as full 40-hex SHAs on write (lode-xdg3); the validate-sha40 call-site gate replaced its hand-maintained roster with a hazard-keyed corpus scan (lode-rby4)
• /land: an all-bounced or empty-accepted pass falls through instead of letting the lock age out (lode-0jan); the four $STATE_DIR load sites share one missing-vs-empty policy (lode-dc4n); /sweep adopts the same loader (lode-3oik)
• Re-entry table routes a land-review escalation needing an on-branch edit to ready-for-code-review (lode-2m93); stale review_head claims corrected (lode-8n4k) and the structurally-stale exit-(d) path fixed (lode-9b5n)
• docs/decisions.md marker gate: catches **AMENDMENT ( (lode-125q) and all-caps RETRACTED/OBSOLETE/FALSIFIED/OUTDATED lead-ins (lode-bv9o); silent in-place rewrites now detectable (lode-rl6s) and the checker actually runs somewhere (lode-d7pm)
• Test-suite consolidation: shared tool-turn Anthropic fake and stub Fetcher in conftest (lode-pw9o), remaining hand-rolled tool_use/text block sites swept onto it (lode-gyq3, lode-j5o1), the .claude markdown corpus glob and its cached fence-block parse hoisted into conftest (lode-2evf, lode-es1i), a flaky SHA-timing test stabilized under pytest -n 8 (lode-vaxe), and a stale PEP 649 eager-import rationale corrected (lode-t402)

lode v1.2.1

214 tickets landed on trunk since v1.2.0 (2026-07-24). This release is dominated by hardening the
unattended build/land/sweep autonomy loop and the shell gates around it, plus a broad test-suite
consolidation and a round of LLM-provider and indexing reliability fixes.

Features

• /sweep: list deferred-state tickets in its report (surface-only, never reviewed) (lode-1q2i)
• /sweep §2b: surface stranded in_progress tickets carrying no pipeline label (rebuild after land bounce) (lode-ppki)
• Derive lock-gen Python from .python-version (single source of truth) so requirements.lock can't flap (lode-sys4)

Epics completed

Adopt ruff 0.16's remaining default rules requiring rework (lode-cs5u)

Brings the repo onto ruff 0.16's full default rule set, adopting the rules that needed real code changes rather than suppression.

• Reconcile docs/stack.md's ruff section with the settled 0.16 policy (ju25's unpaid docs AC) (lode-cs5u.1)
• Adopt PLW1510 (subprocess-run-without-check): add explicit check=False repo-wide (lode-cs5u.2)
• Adopt six small mechanical ruff rules (ISC004, B008, B017, FLY002, C402, C408) (lode-cs5u.3)
• Adopt BLE001 (blind-except): add exc_info=True logging at all 9 sites (lode-cs5u.4)

Fixes and internal work

Landing pipeline — /land, /sweep, /code, /release

• /land's single-lander lock is inert: trap EXIT fires at the end of Section 0's own Bash block (lode-aps3)
• /land Section 1's $STATE_DIR wipe destroys the lock token Section 0 just persisted -- every pass's ownership checks run blind (lode-l7mj)
• /land: Section 3's merge loop depends on shell state that does not survive across tool calls (lode-sfnb)
• /land: $CONFLICTS still crosses a Bash-invocation boundary between its producer and the needs-rebase kick-back that consumes it (lode-rfon)
• Audit and fix land/SKILL.md's remaining cross-block shell-state instances (beyond lode-rfon's $CONFLICTS) (lode-p1r3)
• /land Section 3's isolation-replay block runs an unguarded 'git reset --hard origin/trunk' (same class as lode-pcee, one section over) (lode-gczf)
• /land Section 1: the -C "$(git rev-parse --show-toplevel)" idiom gives false assurance, and the destructive reset omits it entirely (lode-pcee)
• /land: two more cwd-assuming mutation blocks in land/SKILL.md are unguarded, and lode-gczf's scope rationale over-claims for one (lode-pxyt)
• land/SKILL.md Section 1's residue print uses rtk git log, which silently drops merge commits (lode-eza9)
• /land: a machine-fault stop leaves local trunk carrying unpushed merges (no pass-start reset) (lode-k9ef)
• /land: hoist the per-pass $STATE_DIR wipe out of Section 3a into Section 1, so no earlier writer has to be verbally ordered around it (lode-wjw4)
• Pin /land's gate-before-push ordering mechanically (lode-rlz8's declined option (b), re-costed) (lode-youi)
• Cover /land's two uncovered heartbeat gaps (Section 0->2a, Section 3->4 release) (lode-v4sv)
• /land's lock TTL measures acquisition age, not idle time: add a heartbeat (lode-m87j)
• /land's stale-lock reclaim is not atomic: two ticks can both reclaim the same lock (lode-ao95)
• land-lock: acquire's exit 1 conflates 'another lander' with 'this machine can never land' (lode-119w)
• land-lock.sh's reclaim path never re-checks gate ownership before the destructive rm -- lode-q9pm does not cover it (lode-78ih)
• scripts/land-lock.sh: a rev-parse failure escapes as git's bare 128, outside the script's documented 0/1/2 exit contract (lode-8qkb)
• scripts/land-lock.sh derives the lockfile from --git-dir, so a worktree-dispatched /land takes a DIFFERENT lock (mutual exclusion silently does not hold) (lode-xkpd)
• Wire an owner-token ownership check into land-lock.sh's heartbeat (rebuild after land bounce) (lode-kmrs)
• land-lock.sh's ownership check is opt-in per call site: consider making it a script invariant (lode-yuwt)
• land-lock reclaim: close the alive-but-stalled gate-holder hole (evaluate flock vs a gate-ownership check) (lode-y3dw)
• land-lock: a permanent MACHINE FAULT still only surfaces in per-tick output nobody reads (lode-oup2)
• land-lock.sh's stale reclaim-residual parenthetical, plus two blind spots in the stall-hook scan test (lode-78ih review follow-ups) (lode-qg6g)
• land-merge-one.sh's empty-own-token warning deserves a BEHAVIOURAL pin, not just a textual one (lode-sp9l)
• Collapse the triplicated land-lock owner-token threading explanation to one canonical block (lode-1n4x)
• Extract /land Section 4's worktree-GC predicates into a tested scripts/ helper (lode-9owc)
• land-escalated has no exit for 'amend an accepted branch held by a defect in already-landed code' (lode-wp2r)
• Reclaim leaked agent worktrees: 2.2 GB / 14 dirs, 8 permanently unreclaimable by /land's sweep -- and decide who owns machine-local leak detection (lode-yrtu)
• Consider moving the main-checkout assertion INTO scripts/land-merge-one.sh rather than guarding its two call-site fences (lode-1nty)
• scripts/assert-main-checkout.sh's exit-1 diagnostic narrates only Section 1's command set (lode-ibfw)
• land/SKILL.md 2c: 'qualifies by construction' for land-review's scratch worktree is falsified by lode-nt98 (lode-qv5t)
• Cross-reference scripts/recycled-worktree-guard.sh's undischarged premise into land/SKILL.md (or assert it) (lode-rlz8)
• land/SKILL.md guard coverage is pinned per-known-fence; nothing fails when a NEW unguarded mutation fence appears (lode-1d2y)
• land/SKILL.md's guard pins are per-fence and hand-anchored: a NEW unguarded cwd-resolved mutation fence is caught by none of them (lode-8p3c)
• /sweep §7 re-derives NEW_IDS after §6 already rewrote the digest, so it is always empty -- no push, no new-items report, ever (lode-fm7t)
• /sweep: §1/§2/§4 bd list queries silently truncate at bd's default --limit 50 (lode-hwbm)
• /sweep §1/§2: bd query failures are undetectable and silently empty the digest (lode-5qbi)
• /sweep §2b: persist $STRANDED to $SWEEP_TMP and read it back in §8 (lode-5qsv)
• /sweep §2a/§2b assign DEFERRED=/STRANDED= without persisting to $SWEEP_TMP (lode-lrg2)
• /sweep: a §2a/§2b query error is not actually reportable in §8 (lode-s6fg)
• /sweep §2b lists in-flight builds as stranded (no age discriminator) (lode-3k6x)
• /sweep §2b: no test executes the age-discriminator query (24h arithmetic is unpinned) (lode-42fh)
• /sweep §2b's pipeline-label roster is hand-maintained; §2a/§2b duplicate the report-only contract (lode-mm73)
• /sweep: decide whether a land-escalated + deferred ticket should still notify (lode-o7ai)
• Audit /land, /epic-audit, /code, /release for the same unbounded bd list --limit-50 truncation as lode-hwbm (lode-2gun)
• .claude/statusline.sh carries an unbounded bd list --json missed by lode-2gun's audit (lode-9bbq)
• Nothing gates --limit 0 on bd list call sites -- add a scanning test (lode-200t)
• Remove the correctness-review Workflow from the /code path (lode-rlyx)
• correctness-review workflow: a crashed VERIFY agent defaults its finding to 'refuted', silently discarding real bugs (lode-wtwb)
• release skill: bump-derivation snippet silently under-detects feat/fix (leading-newline bug) (lode-ns3r)
• /release skill: LATEST_TAG selection + version_gt() are untested inline shell, duplicated in scripts/release.sh (lode-b2bf)
• scripts/release-bump.sh: four grep call sites conflate 'no match' with a grep machine fault, and the result picks the release version (lode-umtc)
• Wire scripts/release-latest-tag.sh into the shared gate-lib.sh gate_could_not_run() helper (lode-25xp)
• recycled-worktree-guard.sh reads local trunk, which /land leaves un-pushed for the whole merge window (lode-isl3)
• Reconcile the 16 doc/script sites still describing recycled-worktree-guard.sh as reading bare local trunk (lode-isl3 fallout) (lode-opgw)
• Consolidate the duplicated recycled-worktree-guard prose (decisions.md re-narrations + 4 copy-pasted quick-card rows) (lode-zt62)
• Re-home the general recycled-worktree-guard material buried under agents-workflow.md's baseRef-fresh h4 (lode-9ag9)
• recycled-worktree-guard.sh's .claude/worktrees/ glob anchors are unpinned by its tests (asymmetry with isolation-guard.sh) (lode-v12j)
• Gate the skills' fenced bash blocks against cross-block shell state, and audit /sweep + /release (lode-x495)
• code-reviewer dispatched with NO isolation worktree -- cwd pinned to the main checkout on trunk (lode-ska2)
• Probe whether isolation: worktree frontmatter (vs call-site option) prevents the lode-ska2 no-worktree dispatch fault (lode-ojsr)
• Drop /land's call-site isolation param once land-review frontmatter isolation is confirmed (lode-p2vi)
• Run a top-level dispatch probe (mirroring lode-p2vi) to test isolation: worktree frontmatter for coding/code-reviewer (lode-09td)
• docs/agents-workflow.md's lode-p2vi paragraph makes the same single-variable overclaim lode-09td's limit (1) disclaims (lode-p1o4)
• Decide: mechanically enforce isolation:"worktree" on agent dispatches, or record why instruction-only is accepted (lode-kt6g)
• Agent docs' venv-activation step is unrunnable under worktree isolation (lode-6874)
• Agent-doc gate block: the restore/undo dance for a not-yet-landed scripts/nox.sh has a poisonable HEAD oracle (lode-828x)
• The 'git restore --staged .beads/issues.jsonl' cluster still hardcodes the path at four live sites (lode-2nw5)
• The two beads passive-export paths are hardcoded in three unrelated places, in three different syntaxes (lode-do3q)
• bd dolt push call sites were enumerated with a grep that misses unprefixed invocations (lode-bpl)
• Move Opus 4.8 model references to Claude Opus 5 (claude-opus-5) (lode-d1sr)
• land/SKILL.md's own-token read-back sites fail OPEN silently: an empty $MY_TOKEN disables the ownership check with no diagnostic (rebuild after land bounce) (lode-xyty)

Gate scripts & the shared shell library

• Extract the duplicated gate_could_not_run() exit-2 helper shared by scripts/*.sh (lode-090f)
• Extract the exit-1-is-content...

lode v1.2.0

Second minor release since v1.1.0. Headline: lode can now run its cloud LLM
calls through providers other than Anthropic (OpenAI via Azure), the Python
dependency set is fully locked and CI-verified, and model provenance is
recorded end-to-end. Plus new corpus-regeneration commands and the restored
multi-agent correctness review.

Support LLM vendors outside Anthropic (OpenAI via Azure) — epic lode-568v

Introduces a vendor-neutral LLMProvider seam and a second implementation, so
the cloud LLM (enrichment + Q&A) is now provider-selectable rather than
hard-wired to Anthropic. Embeddings stay local-only.

• Vendor-neutral LLMProvider seam pinned in the design docs (lode-568v.1)
• LLMProvider seam + Anthropic implementation, behavior-preserving refactor of every cloud-LLM call site (lode-568v.2)
• OpenAI-via-Azure provider behind the seam (lode-568v.3)
• Capture provider identity on enrichment rows for DB provenance (lode-568v.4)
• User-facing docs for selecting the provider (lode-568v.5)
• Provider-aware enrichment staleness in lode reenrich / lode status (lode-568v.6)

Dependency pinning: lock the Python package set and control updates — epic lode-g274

The runtime dependency set is now hash-locked in requirements.lock, installed
from the lock by default, and checked for currency in CI.

• Hash-verified requirements.lock; install from it, with an --unlocked escape hatch (lode-g274.1)
• Characterization test pinning trafilatura's extraction behavior (lode-g274.3)
• Record and verify the ONNX model revisions used for embedding (lode-g274.4)
• Record the enrichment model identity for DB invalidation (lode-g274.5)
• CI installs from the lock and fails on drift (lode-g274.6)
• lode reembed: regenerate the corpus when the embedding model changes (lode-g274.7)

Model provenance: pin, verify, and regenerate — epic lode-crh8

• Decide and document the model-provenance data shape and mismatch behavior: record + detect, never refuse (lode-crh8.1)

Features

• lode reenrich: targeted re-enrich of live heads whose AI annotations disagree with the current enrichment LLM (lode-14jr)
• Self-heal a schema-mismatched LanceDB vector table (drop + recreate) so recovery needs no manual rm (lode-t08v)
• lode status: flag enrichment as stale-vs-current-config, not just mixed-model (lode-o9k3)

Fixes

• Q&A model knobs qa_llm / qa_think_harder_llm are now actually consumed at runtime (lode-obms)
• Regenerate requirements.lock for Python 3.14 so lock-currency CI goes green (lode-gyag)
• Warm the model cache in the all-clear enrichment-footer test to stop a CI flake (lode-0d2i)

Internal / workflow

• Restore the multi-agent correctness review as a Workflow (lode-905v)
• correctness-review: K-round FIND union to reduce stochastic single-pass misses (lode-p5gf)
• correctness-review FIND: independently establish prior behavior instead of trusting a diff's self-claim (lode-eohb)
• Reconcile the correctness-review thread in docs/decisions.md (lode-4zpn)
• scripts/update-deps.sh: controlled dependency updates with gated promote/rollback (lode-fdjr)
• Extract the shared venv-install sequence into one sourced function (lode-02xy)
• Pin ruff to 0.15.22 to unblock repo-wide nox -t fix (lode-umh2)
• Docs: de-Anthropicize the enrichment/Q&A/egress narrative (lode-29id)
• Docs: how to rebuild the vector cache after a schema-mismatch crash (lode-2lu2)
• Docs: drop stale rm -rf lancedb guidance now that the table self-heals (lode-su17)
• Docs (research): local open-weight models feasibility note (worktree-research-local-models)

lode v1.1.0

This release is dominated by TUI markdown-editing, a CI/badge pipeline, TUI module
restructuring, and a large body of agent-workflow hardening (recycled-worktree root-cause,
/land and /code machinery). Highlights below; every landed ticket is traceable by its ID.

Epics

Keyboard-first markdown editing in the note TextArea (lode-ev5j)

Live markdown syntax colouring and keyboard link-opening in the note editors.

• Live markdown syntax colouring in the three note TextAreas, with a plain-text fallback (lode-ev5j.2)
• Open-link-under-cursor keybinding with a $BROWSER guard and status-line URL fallback (lode-ev5j.3)
• CaptureScreen markdown colouring plus the Ctrl+N open-link binding (lode-5ill; follow-ups lode-ngk2, lode-vx60)
• Feasibility spike and the design-decision record in docs/ (lode-ev5j.1, lode-ev5j.4)

E-UX — TUI/CLI UX improvements (lode-olmi)

• Browse row-select now opens the editor; the read-only note view is retired (lode-olmi.2)

Conform the TUI to one-Screen/Widget-per-module (lode-s5kp)

Split multi-class UI modules to one top-level UI class per file.

• Split browse.py into 7 screen modules (lode-s5kp.1)
• Extract DiscardConfirmScreen (lode-s5kp.2), RelatedNoteModalScreen (lode-s5kp.3), and pure render helpers into a leaf reuse module (lode-s5kp.4)

Restructure tui/ into app/screens/widgets/services (lode-zlmz)

Group modules by kind and kill three name collisions.

• Move widgets and five services into tui/widgets/ and tui/services/ in one pass (lode-zlmz.3)
• Dissolve the browse↔edit import cycle via a leaf content-view module (lode-2zj0)
• Layout + grouping-rationale records in docs/decisions.md (lode-zlmz.1, lode-zlmz.4)

CI / build pipeline and status badges (lode-qxdn)

Push/PR build, test, and coverage with README badges.

• Build the package (wheel + sdist), run the test suite, and measure coverage on push/PR (lode-qxdn.1, lode-qxdn.2, lode-qxdn.3)
• Build, tests, and coverage badges in README (lode-qxdn.4, lode-qxdn.5, lode-qxdn.6)
• Narrow the workflow push triggers to trunk + land/** (lode-bmvy)

Features

• lode verify: read-only preflight confirming a JIRA/Confluence connector is configured and reachable (lode-04lz)
• lode config: [REDACTED] presence indicator for env-resolved Atlassian credentials (lode-dx4r)
• Consolidate save onto one stack-aware Ctrl+S (Save&pop / Save&New); drop Save&quit (lode-bsmc)
• graph_expand follows note→external edges so a matched note pulls in its attached captured externals (lode-c4cd)

Fixes

• Fix TUI markup-eating at the seam so user text renders literally everywhere (lode-3dz2, lode-ix4i, lode-7abi)
• Add the missing lode backfill jira/confluence guidance for links pasted while the connector was inactive (lode-bcjv)

Internal / workflow

Recycled-worktree root-cause and remediation:

• Root-cause investigation of worktree.baseRef=head, then set it to explicit "fresh" and correct the "branched from local trunk HEAD" doc claims (lode-r7ow, lode-jzbz, lode-c3b2, lode-c5by)
• Fix the guard leaking on the DIRT axis, extract the guard into a shellcheck'd/tested script, add the fresh-build-site guard, and record CC 2.1.216 as a data point (lode-nt98, lode-3v1p, lode-ivth, lode-fptp, lode-ag7j)

/land and /code agent machinery:

• /land re-gate must be foreground-only with a real exit status; isolate land-review dispatches in worktrees; drop the call-site isolation param once frontmatter isolation is confirmed (lode-b8sr, lode-g387, lode-p2vi, lode-qv5t)
• Convert land-review from a skill to an isolated agent (lode-c6ir)
• Anchor and extract /code's concurrency-cap derivation into scripts/code-concurrency-cap.sh; record why isolation stays instruction-only (lode-4k7d, lode-54mo, lode-kt6g)

Inert /code-review gate (upstream regression) and its watch-item chain:

• Documented that code-reviewer.md mandated an uninvokable /code-review, plus the recurring re-check watch items (lode-axyq, lode-cbc0, lode-ebhk, lode-01tv, lode-fr6z)

Guards and hooks:

• Fabricated-SHA / retyped-identifier guard (lode-fpmi); bd inversion-guard /bin/sh compatibility fix (lode-9gm2); de-duplicate the guard test harness and drive it through dash (lode-zlg8)

CI internals and quality gates:

• Cost/tail-risk controls on push-triggered workflows; reuse nox -s build; single CI model-cache-key implementation; drop the package-data assertion from release.yml; correct the stale badge comment (lode-2ouz, lode-j6mj, lode-sx23, lode-zuqp, lode-nyp3)
• Fail validate-mermaid.sh honestly when the docker engine is down; add a markdown link/anchor checker to the gates (lode-9i2p, lode-dkdg)

Test infrastructure:

• Fix the intermittent xdist hang at ~98% (leaked root-logger state); stop nox silently testing the wrong source tree from a worktree (lode-kmes, lode-jh80)

Docs and enforcement:

• Refresh docs/tui.md counts and modal-footer rule; test-enforce the keybindings table against actual BINDINGS; remove the retired NoteViewScreen references; cross-doc pointers for the markdown-editing record; trim the snapshot-viewer docstring (lode-72x5, lode-trym, lode-d79b, lode-s4z5, lode-o8lc, lode-eshl)

lode v1.0.0

lode reaches 1.0.0 — the product is built end-to-end (notes, cited Q&A, TUI + CLI,
the web connector) and now ships structured, authenticated ingest for Atlassian Cloud.

Atlassian (JIRA + Confluence Cloud) connectors (lode-gpzn)

Structured ingest for auth-fronted sources: JIRA and id-bearing Confluence Cloud links
are recognized at paste time and ingested via authenticated REST APIs (structured JSON),
instead of scraping a login page. Behind default-off, per-product feature flags.

• Per-product feature flags + env-primary token/email credential resolution, config.toml fallback; secrets never logged (lode-gpzn.1)
• Atlassian link detection + source_type routing + semantic external_id with a persisted API base on the external row (lode-gpzn.2)
• Connector-neutral HTTP fetch-outcome classifier + source_type-generic dead-letter hook, reused by the web and Atlassian paths (lode-gpzn.13)
• JIRA Cloud fetch unit: REST v3 issue → structured snapshot, paginated comments, rendered-HTML body (lode-gpzn.3)
• Confluence Cloud fetch unit: REST page (body.view) → structured snapshot (lode-gpzn.4)
• Work-pass error visibility: API/auth failures name the source and reason (e.g. http_401) and tombstone per taxonomy, token never printed (lode-gpzn.5)
• Per-connector re-draw-down backfill framework (CLI lode backfill, --dry-run/--list/--retry-tombstoned) (lode-gpzn.9)
• JIRA backfill: migrate pre-existing URL-keyed JIRA links to the semantic-key connector, idempotent (lode-gpzn.10)
• Confluence backfill: same for pre-existing Confluence links (lode-gpzn.11)
• Offline fixture coverage + documented manual live-test procedure (lode-gpzn.6)
• Design docs: Atlassian connector section (externals.md) + resolved/deferred decisions (decisions.md) (lode-gpzn.7)
• Doc-truth pass: docs now say the product is built end-to-end (lode-gpzn.8)

Connector plumbing landed alongside the epic:

• Wire the JIRA + Confluence fetch units into refresh_external's dispatcher (lode-mfts)
• Dedup the JIRA/Confluence refresh legs into one parameterized _refresh_atlassian (lode-40zj)
• Extract the shared httpx fetch/classify ladder reused by web + Atlassian fetchers (lode-88iv)
• Crash-reclaim dead-letter path now logs the per-job source name (lode-ympb)

Fixes

• Immediate-enrich clock-domain fix: enqueue_derive_jobs stamps next_attempt_at from the ratcheted queue clock, not the raw SQLite DEFAULT — resolves an xdist flake (lode-0dnk)
• Surface tombstone_reason in the web leg's lode work outcome line, mirroring the Atlassian pattern (lode-pmx0)

Internal / workflow

• /code orchestrator claims resolved tickets before dispatch (lode-xr8v)
• Statusline improvements (no bd ticket): /usage 5h + 7d rate-limit meters, token meter measures used tokens, model-class truncation, dropped fetch_part
• Reduce pip version warnings in the env init path

lode v0.5.0

E-UX2 — UX polish round 2: TUI bars/screens + CLI readability (lode-l38d)

A full pass over TUI chrome and CLI legibility — colour, layout, help text and screen behaviour.

• Colour-code lode status and tell the user the next action to take (lode-l38d.6)
• Colour the id and date in lode notes, and separate notes with a blank line (lode-l38d.5)
• One shared rich Theme for the CLI — named styles, no ad-hoc colours (lode-l38d.11)
• Declare rich as a dependency and route the CLI through one shared Console (lode-l38d.1)
• lode dump-html: add --all and --file for bulk dumping to per-note files (lode-l38d.8)
• Tags screen: multi-column tag grid with PgUp/PgDn paging (lode-l38d.9)
• Rewrite every CLI help text for brevity and clarity; strip internal IDs and prose (lode-l38d.7)
• Ambiguous-prefix error now shows date and summary per candidate (lode-l38d.10)
• lode notes --deleted: mark tombstoned rows with a trailing [deleted] marker (lode-l38d.12)
• Fix Config screen scrolling past the bottom of the window (lode-l38d.2)
• lode config table now respects terminal width instead of wasting space (lode-l38d.4)
• Compact the Browse footer bar (lode-l38d.3)
• Constrain the height of two unbounded TUI DataTables (lode-efn2)
• Fix CaptureScreen footer overflowing 80 columns (lode-3rvw)
• Realign lode notes and the ambiguous-prefix listing that had diverged on colour (lode-l810)
• Colour tests now assert NO_COLOR in a subprocess so they actually run (lode-xgaa)
• Close the gap where two config tests overclaimed and the load-bearing fold case went untested (lode-1apg)

Features

• Ask (cited Q&A over your notes) is now reachable in the TUI via ctrl+l, and Escape pops back instead of quitting the app (lode-11io)

Fixes

• Deterministic row order in lode notes — created ties no longer reorder rows under load (lode-7h8j)
• Deterministic row order in lode notes --deleted, matching the same fix (lode-y1er)
• CLI tables now guard bare-string cells against rich markup injection via a shared SafeTable primitive, fixing dropped characters (lode-9tmd)
• Bring err_console in line with the hoisted-highlight convention (lode-9jmv, lode-re0s)
• /land no longer leaves a stale ready-for-land label on landed tickets (lode-myh6)
• /land epic-completion check now fires correctly (was dead code) (lode-v4rk)
• /land Bounce no longer silently swallows a bd runtime failure when re-pointing dependents (lode-xm1h, lode-verb)
• bd inversion guard now works under /bin/sh, not just bash (lode-9gm2)
• Fix stray stale bd DB seeded into producer worktrees from a committed issues.jsonl (lode-fzau)
• Harden the bd-dolt-push guard against a silent label swap stranding a ticket (lode-zz7x)

Internal / workflow

• Gate imports-vs-declared dependencies in CI instead of finding gaps one at a time (lode-mrdu)
• Declare pyarrow in pyproject (imported in src/ but undeclared) (lode-zcoz)
• Collapse ~14 hand-rolled TUI screen wrappers onto Textual's builtin push/pop actions (lode-pijc)
• Unify all 10 screen footers behind a shared LodeFooter at the new 100-column bound (lode-uczx)
• Extract /land's merge precheck to a tested scripts/merge-precheck.sh (lode-mh9g)
• /land now reports an incidental discovery instead of re-filing the same dupe ticket (lode-9t7u)
• One house pattern for settling flaky TUI tests under load, homed in conftest (lode-lcju, lode-9y68)
• Record that typer's vendored click parser makes tri-state flag options non-functional (lode-2pqj)

lode v0.4.0

TUI/CLI UX improvements across browse, edit, and tags screens, a wider config
surface, external-content viewing, and workflow/agent-machinery cleanup.

E-UX — TUI/CLI UX improvements, spec 06 (lode-olmi)

A wave of browse/edit/tags polish across the TUI plus supporting CLI surfaces.

• Browse keeps your row selection when you leave and return to the list (lode-olmi.1).
• Selecting a browse row now opens the editor directly; the read-only note view is retired (lode-olmi.2).
• Browse Summary column capped to two lines, wrapped and ellipsized (lode-olmi.3).
• Progressive, incremental search over note summaries in Browse (lode-olmi.4).
• Timestamps shown in local time across every TUI/CLI surface (storage stays UTC) (lode-olmi.5).
• Tags screen: multi-select tag filter (AND/intersection) over the notes list (lode-olmi.6).
• New CLI dump-html <note> [selector] prints a note's retrieved external raw HTML (lode-olmi.7).
• Decision record for surfacing retrieved external content in the edit screen (lode-olmi.8).
• Related-notes panel made interactive with a highlighted-context overlay (lode-olmi.9).
• lode work: logging parity between the one-shot and --wait paths (lode-olmi.13).
• New docs/keybindings.md central TUI keymap (lode-olmi.14).
• Progress/heartbeat instrumentation on long-running lode work operations (lode-olmi.15).

E-UX2 — TUI UX improvements, spec 08 (lode-juz8)

Follow-on TUI refinements: keybinding hygiene, one-line summaries, config surface.

• No-function-key policy; all F-keys remapped to Ctrl combinations (lode-juz8.1).
• Fix: browse search bar no longer pushed off-screen on a long notes list (lode-juz8.2).
• Browse-list summaries capped to a single line with visible ellipsis (lode-juz8.3).
• x toggles the highlighted browse row between its one-line and full summary (lode-juz8.4).
• Summary generation tuned so the lede leads and survives one-line truncation (lode-juz8.5).
• Config screen widened to show every runtime+tune knob with its current value (TUI + CLI) (lode-juz8.6).

Features

• Content-viewer modal + v addressing flow to view retrieved external content from browse/edit (lode-0sjj).
• Edit screen reuses the enrichment inspector modal (Ctrl+G) to surface retrieved-external metadata (lode-g5es).

Internal / workflow

• Consolidated the duplicated UTC-stamp parsing into one shared lode.timestamps.parse_stamp helper (lode-aswc).
• Removed the orphaned note_body() read helper, dead since the note-view screen was retired (lode-pyeq).
• Fixed a stale e | Edit keybinding row in docs/keybindings.md (lode-sdq0).
• /code auto-select now gated on the parent epic having been debated at least once (lode-bw5k).
• Renamed the /debate skill to /challenge (autocomplete collided with /debug) (lode-kran).
• Added specs/08-ux-improvements-contd.md, the spec behind the E-UX2 epic.
• Fleet-aware statusline (git divergence + fetch-age, live-agent gauge) with a shellcheck gate.
• Docs: corrected the --debug flag position in spec 07.
• Dropped dead Write() permission rules from .claude/settings.json.