v0.18.1

What's Changed

• fix(memory,llm): correct BFS ESCAPE clause and persist bandit state (#2393, #2394) by @bug-ops in #2395
• fix(classifiers): use Metal/CUDA device when available in candle classifiers by @bug-ops in #2399
• fix(memory): consolidation prompt isolation, Update in-place semantics, concurrent embeddings by @bug-ops in #2400
• feat(skills): semantic confusability mitigation — category grouping, two-stage matching (#2268) by @bug-ops in #2402
• fix(classifiers,core): sha2 0.11 hex format + catch_unwind for RuntimeLayer hooks by @bug-ops in #2405
• fix(skills): wire two_stage_matching and confusability_threshold at startup; migrate legacy bundled skills by @bug-ops in #2410
• feat(acp): update agent-client-protocol 0.10.2→0.10.3, schema 0.11.2→0.11.3 by @bug-ops in #2423
• feat(acp): implement session/close handler and capability advertisement by @bug-ops in #2429
• fix(memory,core): eliminate Qdrant upsert timing race and add RuntimeLayer tests by @bug-ops in #2430
• fix(acp): populate authMethods, add /agent.json endpoint, eliminate IPI duplication by @bug-ops in #2431
• feat(security): MCP→ACP confused-deputy boundary enforcement and security model audit by @bug-ops in #2436
• chore(deps): update github-actions by @bug-ops in #2439
• fix(security): extend MCP env var blocklist and fix audit logger silent drop by @bug-ops in #2446
• feat(memory): ACON category guidelines, Memex tool archive, RL admission control by @bug-ops in #2440
• fix(security): scrub credential env vars from ShellExecutor subprocess environment by @bug-ops in #2452
• feat(acp): expose current model in SessionInfoUpdate and session/list (#2435) by @bug-ops in #2453
• feat(mcp): implement MCP Roots protocol and cap tool descriptions (#2445, #2450) by @bug-ops in #2454
• feat(tools): adversarial policy agent — pre-execution LLM validation of tool calls by @bug-ops in #2457
• security(mcp): harden validate_roots() and truncate_instructions() by @bug-ops in #2458
• feat(core): /new command — reset conversation preserving memory and MCP connections by @bug-ops in #2464
• feat(memory): Kumiho belief revision and D-MEM RPE routing for graph memory by @bug-ops in #2465
• feat(routing): BaRP cost_weight dial and MAR memory_hit_confidence signal by @bug-ops in #2466
• feat(tools,orchestration): utility-guided tool dispatch and cascade-aware DAG routing by @bug-ops in #2470
• fix(tools): adversarial policy exempt list and /status display by @bug-ops in #2471
• security(mcp): tool poisoning detection and per-tool trust metadata (#2459, #2420) by @bug-ops in #2472
• feat(tools): transactional ShellExecutor with snapshot+rollback (#2414) by @bug-ops in #2473
• feat(tools): add max_snapshot_bytes limit to transactional ShellExecutor by @bug-ops in #2476
• feat(skills): add ARISE trace evolution, STEM pattern-to-skill, and ERL heuristics by @bug-ops in #2482
• fix(tools): prefer memory_search over search_code for user-provided facts by @bug-ops in #2490
• feat(memory): benchmarking harness, cost-sensitive store routing, goal-conditioned write gate by @bug-ops in #2485
• fix(db): force max_connections=1 for in-memory SQLite pools by @bug-ops in #2491
• release: v0.18.1 by @bug-ops in #2494

Full Changelog: v0.18.0...v0.18.1