v0.7.0

• Breaking (MCP surface): tools/list now defaults to the explore phase instead of the full surface. An existing client that connects and does not call toolset_select sees the read/snapshot/navigate lifecycle only — no mutation, intent, checkpoint, or command_execute tools. [mcp] startup_toolset, overridden by BOBBY_MCP_TOOLSET, selects the phase at connect: explore (default), act, intent, verify, full. The first tools/list is ~42 KiB on explore against 128 KiB on full. Capability gates are unchanged and remain the only enforcement boundary; hidden tools stay callable.
• Breaking (bootstrap): default bobby init / bobby install / loopback auto-init mint the agent preset (no authority:admin). Use --preset unrestricted for the operator floor. Marker-less existing bootstrap.env files still heal as unrestricted. bobby doctor reports bootstrap-preset.
• MCP adds workflow_start and workflow_observe in every toolset phase, with checkpoint_save also advertised in Intent. Handles substitute only the documented page-work scope, remain capability-checked, and expire on accepted reinitialize/server-generation change; explicit IDs remain compatible for lifecycle and recovery.
• Workflow handle state is bounded to 64 committed LRU bindings plus 64 concurrent reservations. Starts reconcile sessions closed through other interfaces; successful close calls reclaim local bindings, while externally closed pages return ordinary notFound until LRU reclamation.
• Streamable HTTP logical clients using the same authenticated principal share one cached MCP server lifecycle and generation. An accepted initialize resets their shared handles and requires a fresh initialized notification; distinct principals remain isolated.
• MCP initialize returns short instructions: explore startup phase, toolset_select + re-list, error.repair, autoCheckpoint default, bobby:// recovery docs.
• tools/list advertise-only output collapse for recovery_status, page_open, session_create, session_list, and checkpoint_save (opaque / top-level keys; validation schemas unchanged). Full catalog ~80.9 KiB / 128 KiB (~49 KiB headroom); explore ~25.2 KiB.
• MCP failures carry a machine-readable repair hint: command-layer failures set error.repair, RPC-layer rejections set error.data.repair, each {action, doc} pointing into bobby://failure-taxonomy. A needsReconciliation outcome always carries the never-retry repair, whatever its error code.
• http_wait accepts optional contains (and maxBodyBytes): each attempt becomes http_fetch and succeeds only when the truncated body includes the substring — for readiness gates that return 200 before they are ready.
• runtime_info's capabilities list reports vision wiring: vision-assist and vision-provider appear only when configured, so an agent can tell an unconfigured provider apart from a transient vision failure without shell access.
• tools/list advertise-only trim: the constant $schema URL is dropped from advertised input and output schemas, and workflow_recover's RecoveryDecision is advertised as a status-tag projection (the same treatment Evidence already had). Validation schemas and tools/call are unchanged.
• The tool_schema_sizes example prints the per-tool composition (description / input / output / annotations / examples), so future growth is attributable at a glance.
• The Northstar scenario server is extracted from runtime-tests into a reusable gauntlet-server crate. It serves GET /__gauntlet/snapshot and GET /__gauntlet/request-log (the same state the in-process snapshot() / request_log() expose), and ships a gauntlet-server binary (--seed, --level) so out-of-process drivers can run and verify journeys over HTTP. The five release-gate journeys are unchanged.
• benchmarks/competitor-gauntlet/ is a benchmark harness that runs the five Northstar journeys against alternative agent browser tooling with a headless agent driver, recording wall time, tool calls, error counts, token usage, server-authoritative pass/fail, and a structured agent self-report per run. Results append to benchmarks/results/runs.jsonl (gitignored); score aggregates per tool.
• MCP job_submit / job_status / job_cancel mirror HTTP /v1/jobs (same caps). Advertised in full, act, and verify when a job port is attached (bobby mcp-stdio and bobby serve MCP HTTP). Built-in handlers: echo, sleep, http_probe, http_wait, and http_fetch (SSRF-safe; http_fetch returns a truncated GET body so agents need not open a browser for health/API JSON); bobby://job-handlers documents payloads; bobby doctor reports them under job-handlers.
• Ollama joins the direct vision backends. bobby vision-proxy --ollama --ollama-base-url and bobby vision connect --provider ollama normalize a local model's output to the VisionProposal schema, and a provider on port 11434 is detected from config. No credentials leave the machine.
• bobby vision collect gathers gauntlet vision proposals as JSONL training data, creating and validating the output directory up front. The collector API is staged ahead of the runner that will drive it.
• bobby context forget no longer fails against a store it just released. Claiming the lockfile retries briefly, because the command opens, drops, and reopens the store in one process and that hand-off lost the race on Linux. A lockfile that is unusable for a reason other than contention now says so instead of telling the operator to stop a bobby that is not running.
• Dependency bumps that reach bobby-browser-client consumers: sha2 0.10 to 0.11, reqwest 0.12 to 0.13, toml_edit 0.22 to 0.25, dialoguer 0.11 to 0.12. Digest output is unchanged -- the same lowercase hex, now produced with hex::encode because sha2 0.11 returns a type that no longer formats with {:x}.
• tools/list advertise-only schema trim: opaque deep nests for WaitCondition / IntentHints / TargetSpec / ScreenshotMode and a collapsed form_snapshot outputSchema. Validation schemas and tools/call are unchanged. Frees catalog headroom: full is 116,204 bytes of the 131,072 budget, so job_* fit with 14,868 spare.
• README / install docs: not on homebrew-core yet; checklist for a future core submission (formula name, three binaries, bottles, audit).
• Unix release binaries are stripped before packaging. Installation docs cover curl download of GitHub Release assets. scripts/install.sh is the one-liner installer (BOBBY_VERSION, INSTALL_DIR).
• Docs: public agent skill (bobby install --skill) vs internal Ghost / ZigZagZig recovery (Rust: SkillGhost / SkillZigZagZig) — navigation title "Internal skill runtime (Ghost / ZigZagZig)".
• context_ask falls back to the persisted per-profile store, with source of observed, persisted, or visionPromoted on every answer.
• context_neighbors returns remembered form structure around a control.
• context:read capability, over MCP and /v1. Bootstrap heal floors (unrestricted and agent) include context:read so agents are not stranded without it after init.
• bobby context list and bobby context forget <site>; bobby doctor reports store size; retention sweeps on open.
• Release-gate canary asserts no typed values or credentials reach the context store.
• IntentHints.accessibleName: an a11y_snapshot node's target passes into any intent_* tool verbatim. Equivalent to an exact nearText; both set to different values is refused as intentCompileFailed.
• The tools/list byte-budget gate measures all 21 capabilities, not the 15 it had listed. Capability::ALL is the single source.
• Idempotent retry works over MCP. The digest covered the whole CommandEnvelope, including deadline and the per-attempt commandId/attemptId/workflowId, all of which the gateway mints fresh on every dispatch with no caller override — so a retry never matched its own first try and every retry answered idempotencyConflict on a command that may already have landed. Identity is now the command: schema version, session, page, the command itself, and the one-shot vision consent. Same key with a different command still conflicts. A replayed outcome no longer has the current call's workflowId/attemptId stamped onto it, because that pair never ran.
• Evidence::Wait carries observed, the value the condition matched on: the element text or value, the URL, or the document ready state. The poll already read it to decide whether it was satisfied and then discarded it, so verifying a submit cost a second round trip to learn what had just been confirmed. Bounded at 512 characters on a character boundary. Chromium reports it for text, value, URL, and document conditions; Firefox for URL. Absent on element and network-quiet conditions, which match on presence and counts rather than a value.
• recovery_status accepts sessionId instead of workflowId and answers with that session's recoverable workflows, newest first, capped at 32. recovery_status and workflow_recover were keyed by workflowId alone and the checkpoint store had no index, so an agent that was compacted or restarted could not name — and therefore could not reach — its own in-flight workflow. Exactly one of the two keys is required. Ownership is enforced against the session-ownership registry, and a corrupt entry is skipped rather than failing the listing.
• The context-store privacy canary scans the store instead of a directory that cannot exist. It read <context dir>/<profile> literally, but the store hex-encodes the profile component, so the scan found nothing and the test failed on its own precondition — the property it exists to prove was never actually checked. It now walks every .json under the store root at any depth.
• intent_submit_and_verify, intent_follow, and boundary click accept autoCheckpoint, which defaults to true. A Boundary command took three calls — pin commandId/attemptId, checkpoint_save naming those exact ids, then submit — because a WorkflowCheckpoint needs restartUrl and currentUrl and nothing on the runtime interface exposes live page state. The runtime now mints it and returns its checkpointId. Pass autoCheckpoint: false only to author invariants or replayableInputs. Executor::validate is unchanged and still matches on all five fields; a checkpoint that fails to save fails the submit.
• bobby install --host acp and bobby acp-stdio mirror the MCP stdio entrypoint for ACP hosts (credential load + exec of acp-gateway).
• Release packages and Formula/bobby-browser.rb ship the gateway trio (bobby, mcp-gateway, acp-gateway). bobby doctor checks sibling gateway presence on PATH. README documents brew install --formula ./Formula/bobby-browser.rb and the three-binary / Explore size tip.
• bobby init --preset agent mints a bootstrap without authority:admin; heal respects the preset marker and never widens an agent floor to unrestricted. (Superseded for the default floor by the Unreleased breaking bootstrap note above.) bobby doctor reports bootstrap-preset.
• bobby doctor reminds that vision:assist still needs session executionPolicy.visionAssist=true, and that javascript:evaluate still needs executionPolicy.javascriptEvaluation=true (cap alone is not enough).
• Vision HTTP endpoints resolve only through NodeRegistry (sdk-core extract + vision child spawn). bobby doctor warns when both [nodes] and [vision].endpoint_url are set ([nodes] wins).
• bobby vision connect (direct) writes the loopback HTTP endpoint under [nodes.vision] (kind = "vision") and keeps provider profiles under [vision.providers.*]. It no longer persists a dual-truth [vision].endpoint_url.
• ACP session/prompt freeform-text parse errors include a concrete structured JSON example in the error data. MCP prompt list descriptions carry one-line recovery tips.
• MCP gateway tools/call argument structs and capability/operation/description tables live in tool_args / tool_meta; the name-matched dispatch match lives in server/tool_dispatch.rs (behavior unchanged).