v0.22.1

What's Changed

• fix(session): route hydrate_from_event_log through bounded replay by @bug-ops in #5861
• docs(orchestration): correct llm-planning feature flag default claim by @bug-ops in #5858
• fix: correct workspace license declaration to MIT OR Apache-2.0 by @bug-ops in #5865
• chore: bump MSRV to 1.97 by @bug-ops in #5872
• feat(llm,commands,core): add runtime /think-tokens and /reasoning-effort commands by @bug-ops in #5876
• fix(skills): wire group_structured/similarity/injection-score at cold start by @bug-ops in #5877
• fix(llm): resolve OllamaProvider::name() hardcoding and embed misrouting by @bug-ops in #5879
• fix(init): require confirmation before overwriting ZEPH_DURABLE_KEY by @bug-ops in #5880
• fix(tools): scale adversarial policy timeout by provider type by @bug-ops in #5881
• fix(a2a,config): give --connect its own client-side TLS/SSRF policy by @bug-ops in #5884
• fix(gateway): expose Error::source() on GatewayError variants by @bug-ops in #5888
• fix(llm): delegate think-tokens/reasoning-effort through routed providers by @bug-ops in #5890
• ci: migrate lint-warning gate from RUSTFLAGS to build.warnings by @bug-ops in #5891
• fix(llm): sweep stale Claude model IDs and generalize staleness warning by @bug-ops in #5901
• fix(acp): scope persisted session listing/loading to owning client by @bug-ops in #5907
• fix(llm): populate provider_name across all remaining LLM backends by @bug-ops in #5908
• feat(plugins,skills,config,cli): add opt-in skill/plugin discovery-and-install marketplace by @bug-ops in #5910
• fix(tools): forward checkpoint and confirmation methods through executor wrappers by @bug-ops in #5930
• fix: resolve build.warnings gate fallout from #5891 migration by @bug-ops in #5960
• fix(mcp): rehydrate input_schema for Qdrant-matched MCP tools by @bug-ops in #5972
• fix(skills): wire trust config and RL routing head into ACP/serve/daemon by @bug-ops in #5976
• fix(core,acp,tools): wire memory maintenance and capability governance into ACP/daemon/serve by @bug-ops in #5978
• fix(commands): require trusted session for /image path reads by @bug-ops in #5988
• fix(subagent): deliver resolved vault secret value to sub-agents by @bug-ops in #5990
• fix(tools): forward checkpoint methods through Arc by @bug-ops in #5998
• fix(config,llm): redact secrets from Debug output on 7 config structs by @bug-ops in #6004
• fix(commands): require trusted session for /mcp and /plugins by @bug-ops in #6002
• fix(config,mcp,a2a): redact three more secret-bearing Debug/Serialize leaks by @bug-ops in #6005
• fix(serve): wire trust/policy/adversarial gate chain into serve-sessions by @bug-ops in #6007
• fix(tools): forward requires_confirmation/is_tool_speculatable/execute_tool_call_confirmed through remaining ToolExecutor wrappers by @bug-ops in #6011
• fix(db): redact_url no longer leaks part of password containing '@' by @bug-ops in #6013
• fix(subagent,core): replay journaled result on durable subagent resume by @bug-ops in #6014
• fix(config): stop migrate-config from duplicating advisory blocks and false-reporting orchestration inserts by @bug-ops in #6017
• fix(commands): close requires_auth() fail-open gap in 19 CommandHandler impls by @bug-ops in #6033
• fix(vault)!: default vault backend to age and reject unknown backend strings by @bug-ops in #6025
• fix(tools): ToolExecutor forwarding gaps, symlinked checkpoint drop, checkpoint tests by @bug-ops in #6036
• fix(serve,gateway): dispatch recognized slash commands before sanitization by @bug-ops in #6039
• fix(durable): enforce encryption_gate INV-8 policy at runtime by @bug-ops in #6040
• fix(acp,daemon,serve): wire SelfCheckPipeline, TrajectorySentinel, and SkillInvokeExecutor into all entry points by @bug-ops in #6047
• fix(worktree): reconcile detached-HEAD worktrees, run prune on clean, clamp zero timeout by @bug-ops in #6051
• fix(tui): clear durable overlay and distinguish gate-rejection status by @bug-ops in #6053
• fix(config): wire dead validate() functions and fix migrate idempotency guards by @bug-ops in #6058
• fix(tui): clear fleet/task-registry overlays and fix Display padding in fleet panel by @bug-ops in #6060
• fix(skills): gate load_skill through the same trust pipeline as invoke_skill by @bug-ops in #6062
• fix(tools)!: remove permissive defaults on ToolExecutor/ErasedToolExecutor by @bug-ops in #6067
• fix(mcp): drop input_schema on MAX_SCHEMA_DEPTH cap hit by @bug-ops in #6075
• fix(worktree): gate force-removal on git prunable marker, add --force flag by @bug-ops in #6076
• fix(mcp): pin SSRF-validated addresses on connect and add missing OAuth timeout by @bug-ops in #6078
• fix(config): validate hot-reloaded config before applying to live agent by @bug-ops in #6083
• fix(mcp): close three gaps in the MCP tool trust pipeline by @bug-ops in #6088
• fix(skills): wire requires_trust_check setter and route CLI invoke through SkillTrustGate by @bug-ops in #6090
• fix(security): consolidate duplicated sanitization and redaction logic by @bug-ops in #6091
• fix(mcp): pin cross-origin OAuth discovered-issuer requests per-request by @bug-ops in #6092
• fix(mcp): pin DNS resolution for OAuth redirect-hop targets by @bug-ops in #6097
• fix(channels): add 429 retry-with-backoff and Telegram send_status by @bug-ops in #6100
• fix(core): offload hot-path blocking fs I/O to spawn_blocking by @bug-ops in #6101
• fix(acp): wire shutdown-summary, channel identity, help/model registry, and code-RAG into ACP by @bug-ops in #6102
• fix(plugins): route add_remote/download_archive through anti-downgrade HTTPS client by @bug-ops in #6104
• chore(build): disable sccache and enable incremental compilation locally by @bug-ops in #6105
• fix(plugins): cap archive size in add_remote/download_archive by @bug-ops in #6112
• fix(channels): bound send_status timeout and add Telegram 429 retry by @bug-ops in #6113
• fix(scheduler): correct daemon_status recency, RTW-A provenance tiers, and eval_provider by @bug-ops in #6116
• fix(core): offload trace-file writes and fix MetricsBridge clobbering by @bug-ops in #6117
• fix(db): fix Postgres LIMIT=0 crash and collapse DbConfig pool fields by @bug-ops in #6121
• fix(subagent): live TTL re-check for delivered secrets and per-task secret-request lookup by @bug-ops in #6123
• fix(scheduler): harden provenance trust boundary and push recent-runs query into SQL by @bug-ops in #6125
• fix(scheduler): close RTW-A capability-attenuation and injection-pattern gaps by @bug-ops in #6126
• fix(durable): wire control-entry HMAC to a production key with read-side verification by @bug-ops in #6130
• fix(tui): close panel mutual-exclusion, status-label, and dispatch gaps by @bug-ops in #6131
• fix(durable): add process-exclusivity lock for colliding agent_turn ExecutionIds by @bug-ops in #6133
• fix(index): resolve workspace_root for IndexMcpServer registration by @bug-ops in #6134
• fix(memory): wire MAGE soft-escalation gate and fix community.rs newline injection by @bug-ops in #6135
• fix(core): parallelize apply_tier_results hooks and align WATCHED_SPANS names by @bug-ops in #6137
• fix(security): rate-limit failed-auth requests in gateway and a2a by @bug-ops in #6136
• fix(mcp): lock tool_list for OAuth-transport MCP connections by @bug-ops in #6138
• fix(tui): wire live worktree state and turn-latency/classifier metrics by @bug-ops in #6141
• fix(serve): wire per-session capability scopes, skill/memory tools, and policy fail-closed by @bug-ops in #6140
• fix(mcp): release tool_list_locked on server removal and probe-block by @bug-ops in #6143
• fix: thread --vault/--vault-key/--vault-path CLI flags into doctor/bench/gonka/cocoon by @bug-ops in #6144
• fix(security): scan the full CI feature bundle in the cargo-deny advisories gate by @bug-ops in #6148
• fix(llm): extend Claude no-prefill handling and correct stale model ID by @bug-ops in #6145
• fix(worktree): harden clean/list test coverage and dedupe CLI/agent clean pipeline by @bug-ops in #6149
• fix(core): stop misreporting clean task exits as force-aborted in shutdown_all by @bug-ops in #6150
• fix(skills): share one RoutingHead instance across ACP/serve sessions by @bug-ops in #6151
• fix(session): correct session_dir() double-nesting and implement fork blob-copy by @bug-ops in #6152
• fix(llm): apply Claude no-prefill gate to all request-construction paths by @bug-ops in #6154
• fix(session): treat already-hard-linked fork destination as a no-op by @bug-ops in #6157
• fix(llm): reduce Claude no-prefill bypass discoverability, add HTTP-level test coverage by @bug-ops in #6159
• fix(orchestration): enforce NetworkScope::Deny for spawned sub-agents and RunInline tasks by @bug-ops in #6161
• fix(core): register MagicDocs on tool-result push, not only assistant push by @bug-ops in #6160
• fix: convert 9 remaining Display impls from write_str to pad by @bug-ops in #6162
• fix(skills): auto-arm integrity re-check on trust promotion by @bug-ops in #6164
• fix(security): redact secret fields in IbctKey(Config)/McpTransport Serialize by @bug-ops in #6165
• fix: box::pin build_agent_factory awaits to fix large_futures on macOS by @bug-ops in #6168
• fix: safe URL redaction fallback, migrate-config validation warning, --tui feature guard by @bug-ops in #6167
• fix: wire remaining 5 memory-maintenance loops into ACP/daemon/serve by @bug-ops in #6169
• test: guard workspace linker_messages=allow against silent removal by @bug-ops in #6171
• fix(commands): close command-list drift between COMMANDS, registries, and TUI autocomplete by @bug-ops in #6172
• fix: unify skill/plugin registry disabled-state messaging by @bug-ops in #6174
• fix(config): redact secret fields in channel/A2A/MCP config Serialize by @bug-ops in #6173
• fix(sanitizer): remove dead Pipeline/Stage abstraction by @bug-ops in #6178
• fix: box remaining large_futures call sites reintroduced by #6169 by @bug-ops in #6181
• fix(core): pass model identifier, not provider name, to is_reasoning_model by @bug-ops in #6182
• test: exercise real production wiring in acp/daemon memory-loop tests by @bug-ops in #6179
• fix(sanitizer): qualify broken rustdoc intra-doc link to ClassifierMetrics by @bug-ops in #6184
• security: add gitleaks allowlist for known test-fixture dummy secrets by @bug-ops in #6186
• refactor: consolidate memory-maintenance-loop wiring into one shared function by @bug-ops in #6185
• refactor(durable): dedup step-cap check and warn on unsafe shared_db migration topology by @bug-ops in #6187
• refactor(mcp): extract shared connect-scaffolding helpers by @bug-ops in #6188
• fix(llm): resolve reasoning_amplification model identifier for Router/TriageRouter/CandleProvider by @bug-ops in #6190
• ci: exercise registry feature in PR-gating jobs, not only post-merge by @bug-ops in #6189
• perf(worktree): cache canonicalized worktree root, validate before mutate by @bug-ops in #6192
• fix(vault): require --force to overwrite an existing secret by @bug-ops in #6191
• refactor(common): consolidate ToolName/ProviderName/SkillName newtype boilerplate by @bug-ops in #6193
• refactor(config): dedup migrate idempotency checks, add shadow_sentinel step by @bug-ops in #6194
• fix(llm): make Claude no-prefill gate compile-time enforced by @bug-ops in #6196
• refactor(agent-context): replace positional-arg chain with param structs by @bug-ops in #6195
• docs(a2a): reconcile IBCT wire-format drift between specs and implementation by @bug-ops in #6198
• refactor(agent-persistence): remove dead redaction_applied field and stale TODO by @bug-ops in #6199
• fix(a2a): add Agent Card JWS signature verification and trust policy by @bug-ops in #6202
• fix(commands,durable): flip requires_auth default to fail-closed, fix durable replay dedup by @bug-ops in #6203
• build(deps): bump rmcp to 2.2.0 to resolve Cargo.lock drift by @bug-ops in #6206
• feat(session): add /cd command and --safe-mode troubleshooting flag by @bug-ops in #6207
• feat(worktree): add disk-quota config and automatic reconciliation by @bug-ops in #6204
• fix(a2a): wire AgentRegistry into --connect and fix JWS canonicalization by @bug-ops in #6209
• docs(book): fix stale claude-sonnet-4-5 model IDs in 5 files by @bug-ops in #6210
• docs(book): fix stale claude-opus-4-5 model IDs in acp.md (#6211) by @bug-ops in #6212
• refactor(worktree): collapse sweep() to a single reconcile() call per tick by @bug-ops in #6213
• docs(llm): add missing router thinking-budget delegation spec by @bug-ops in #6214
• test(subagent): close coverage/doc gaps from #5991/#5993 review by @bug-ops in #6215
• fix(tools): clamp shell fallback cwd into sandbox for path-token-free commands by @bug-ops in #6216
• fix(config): remove inert A2aServerConfig::require_tls/ssrf_protection fields by @bug-ops in #6218
• fix(tools): gate context-less spawn_background behind cfg(test) by @bug-ops in #6219
• refactor(core): extract shared Agent skill-config builder chain by @bug-ops in #6220
• chore(agent-tools): remove unused zeph-* dependencies by @bug-ops in #6222
• refactor(scheduler): route DynSchedulerExecutor through DynExecutor erasure path by @bug-ops in #6223
• refactor(common): consolidate treesitter extension-to-language mapping by @bug-ops in #6225
• spec(072): multimodal MCP ContentBlock passthrough to vision-capable LLM providers by @bug-ops in #6228
• feat(memory): add MemGuard type-aware retrieval composition by @bug-ops in #6226
• refactor(acp): extract build_acp_agent seam and add skill-config regression test by @bug-ops in #6227
• refactor(tools): migrate Arc to DynExecutor erasure path by @bug-ops in #6230
• spec(073-orch-ensemble-merge): add specification by @bug-ops in #6231
• spec(orchestration): add HITL interrupt checkpoint specification by @bug-ops in #6233
• chore(bench): remove dead BenchIsolation type by @bug-ops in #6236
• feat(zeph-tools,zeph-llm): add ToolOutput.media plumbing for MCP image passthrough by @bug-ops in #6238
• spec(075-orchestration-node-control-parity): add specification by @bug-ops in #6242
• feat(tui): add read-only settings view and transcript search by @bug-ops in #6246
• feat(orchestration): implement deterministic ensemble-merge for PlanVerifier by @bug-ops in #6247
• fix(zeph-worktree): close check-then-act race in WorktreeManager::create() admission by @bug-ops in #6252
• fix(durable): wire finalize(Completed/Failed) into production execution paths by @bug-ops in #6253
• fix(cli): accept --init/--migrate-config as flag aliases for subcommands by @bug-ops in #6280
• fix(tui): wire TaskSupervisor into phase-2 startup, add t task-panel toggle by @bug-ops in #6281
• fix(security): reject empty-string bearer/vault tokens across ACP and shared auth middleware by @bug-ops in #6282
• fix(subagent): scope worktree admission quota and classify setup failures correctly by @bug-ops in #6283
• fix(acp): purge persisted session data on session/delete by @bug-ops in #6284
• fix(orchestration): ground verifier tool-call claims against real execution trace by @bug-ops in #6286
• fix(durable): spawn DurableRetentionService background prune sweep in production by @bug-ops in #6285
• fix(a2a): enforce IBCT capability tokens on client and server request paths by @bug-ops in #6289
• fix(core): resolve scheduler-feature build gap and semaphore-acquire fail-open by @bug-ops in #6290
• fix(runtime): warn when --bare skips worktree subsystem bootstrap by @bug-ops in #6291
• fix(core): correct turn-latency metrics and idle-window bg status visibility by @bug-ops in #6292
• fix(deps): bump yanked spin 0.9.8/0.10.0 to 0.9.9/0.10.1 by @bug-ops in #6294
• fix(security): bound ShadowSentinel hot-path DB reads with an explicit timeout by @bug-ops in #6293
• fix(security): enable PII filter/secret masking by default and stop leaking gateway auth token by @bug-ops in #6295
• fix(mcp): bound unbounded regex cache in name_referenced_in by @bug-ops in #6296
• fix(core): parallelize PreToolUse hooks, backfill extraction, dedupe MAGE mapping by @bug-ops in #6297
• fix(core): dedupe per-turn skill-stats fetch and query embedding in rebuild_system_prompt by @bug-ops in #6298
• fix(orchestration): ground whole-plan verify_plan() against DAG-wide tool trace by @bug-ops in #6299
• fix(durable): reclaim crash-orphaned running executions via staleness sweep by @bug-ops in #6300
• feat(orchestration): per-task run_timeout, Mode-1 recovery, and plan-verification-incomplete signal by @bug-ops in #6304
• fix(core): strip ephemeral Image parts before persistence writes by @bug-ops in #6307
• release: v0.22.1 by @bug-ops in #6309

Full Changelog: v0.22.0...v0.22.1