v0.25.0

What's Changed

• [auto-task] Skill validation — review the shipped Orbit skills for drift by @orbit-agent-01 in #2541
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2542
• [friction-curation] Note in CI that a failed guardrails step skips the sandbox gate by @orbit-agent-01 in #2543
• Publish a privacy policy page on orbit-cli.com by @orbit-agent-01 in #2544
• [friction-curation] Retry a task pilot once when only status drifted, and keep other drift rejected by @orbit-agent-01 in #2545
• docs: Refresh README and remove stale product descriptions by @danieljhkim in #2547
• [security-review] orbit mcp listen executes JSON-RPC lines from a browser-sent HTTP POST, so any web page can blind-write tasks while the listener runs by @orbit-agent-01 in #2548
• Promote doc-duties to the embedded default auto-task catalog by @orbit-agent-01 in #2549
• docs: Tighten RELEASING.md and CONFIG.md by @danieljhkim in #2550
• Copilot terminal-status fixture intermittently fails to launch freshly written executable with ETXTBSY by @orbit-agent-01 in #2551
• [code-scanning-sweep] Fix rust/command-line-injection in crates/orbit-core/src/application/job/pipeline/worker/scope.rs by @orbit-agent-01 in #2552
• Full QA harness aborts in managed worktree when owner-only qa-full-sweep definition is absent by @orbit-agent-01 in #2554
• [BLOCKED] [friction-curation] Require caller enumeration when a repair narrows a shared invariant by @orbit-agent-01 in #2546
• Add a run-failure-patterns default auto-task that mines unfiled recurring run failures by @orbit-agent-01 in #2555
• Add a report-only backlog-hygiene default auto-task for stuck and untriaged tasks by @orbit-agent-01 in #2556
• Full QA definition-policy scenario never executes its required plugin command-group assertion by @orbit-agent-01 in #2557
• Full QA workflow-process tests misidentify disposable non-Git fixtures inside managed worktree by @orbit-agent-01 in #2558
• fix: Render worker scope memory limits from their integers (CodeQL #459) by @danieljhkim in #2553
• [code-review] Run-failure scan read commands can mutate run state by @orbit-agent-01 in #2559
• Task-pilot QA fixture tries to fetch through read-only shared Git metadata in managed worktree by @orbit-agent-01 in #2560
• [code-review] Backlog-hygiene report reads runs through commands that finalize orphaned runs by @orbit-agent-01 in #2561
• Codebase refinement: bug fixes, hardening, dead-code removal, dedupe by @danieljhkim in #2562
• [auto-task] Skill validation — review the shipped Orbit skills for drift by @orbit-agent-01 in #2563
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2564
• website: redesign the homepage and docs chrome, fix stale docs by @danieljhkim in #2565
• [friction-curation] Update the host scheduler's auto-task definition from a sandboxed job run by @orbit-agent-01 in #2566
• [code-org] Restructure orbit-cmd: registry/ and task/ modules, split doctor.rs into doctor/ by @orbit-agent-01 in #2567
• [code-org] Restructure orbit-engine: activity_job workspace module layout, split ci/collect.rs and cli_runner orchestrator/spawn by @orbit-agent-01 in #2568
• [code-org] Split orbit-exec linux_sandbox.rs into a linux_sandbox/ module by @orbit-agent-01 in #2569
• [code-org] Restructure orbit-tools: split plugin backend/callback/loader and move logic out of builtin/github/mod.rs by @orbit-agent-01 in #2570
• dashboard: redesign the chrome, Tasks, drain card, Runs and run detail by @danieljhkim in #2572
• [code-org] Restructure orbit-core runtime/: plugin/, workspace/, audit/ modules and a declarations-only mod.rs by @orbit-agent-01 in #2571
• [code-org] Restructure orbit-core application/: fold routine.rs into routines/, extract managed_assets, group health, split gate.rs and command dispatch by @orbit-agent-01 in #2573
• [code-org] Restructure orbit-core engine_host: split runtime_host.rs and regroup v2_host into ci_failure/, pull/, admission/ by @orbit-agent-01 in #2574
• [code-org] Restructure orbit-store: split migration steps, move logic out of fat mod.rs files, split task_registry/store.rs, group contracts by @orbit-agent-01 in #2575
• dashboard: split the stylesheet per screen, organize assets into folders, tidy the top bar by @danieljhkim in #2576
• Remove two unused imports in orbit-core left by recent refactors by @orbit-agent-01 in #2577
• [code-review] Rule injection writes through agent-guide symlinks outside the workspace by @orbit-agent-01 in #2578
• Explicit Ship is refused as a duplicate while a task-pilot preparation run lists the task by @orbit-agent-01 in #2579
• Dashboard truncates a refused Ship/Approve error to one ellipsized line ("ship failed: tas…") by @orbit-agent-01 in #2580
• [test-cleanup] Add a cli_runner test builder and file fixtures to collapse orchestrator.rs/spawn.rs setup boilerplate by @orbit-agent-01 in #2581
• Make orbit job resume submit a detached worker by default (add --wait for the foreground path) by @orbit-agent-01 in #2582
• [ci-failure-sweep] Fix red CI: CI / Coverage (informational) / Collect workspace coverage by @orbit-agent-01 in #2583
• [code-org] Restructure orbit-web: split state.rs and slim lib.rs and api/mod.rs by @orbit-agent-01 in #2584
• [friction-curation] Task-pilot apply fails whenever agent-main advances during the pilot ("state-trigger source changed") by @orbit-agent-01 in #2585
• [code-org] Leftover splits: orbit-types task model and auto_task, orbit-config registry, orbit-cli operation, orbit-agent response layout by @orbit-agent-01 in #2586
• [friction-curation] Stop the orbit-common generation admission test from failing after a dropped update by @orbit-agent-01 in #2587
• Refuse a second live resume of the same source run (server-side dedup for submit_resume_run) by @orbit-agent-01 in #2588
• [test-cleanup] Add a tool-call test helper to collapse task_tools.rs boilerplate by @orbit-agent-01 in #2589
• [ci-failure-sweep] Fix red CI: macOS Platform / macOS Sandbox / Run orbit-core sandbox tests by @orbit-agent-01 in #2590
• [test-cleanup] Add an initialized-MCP-client fixture to collapse mcp_roundtrip.rs handshake boilerplate by @orbit-agent-01 in #2591
• Block tasks coupled to a run that is reconciled interrupted (system interruption) by @orbit-agent-01 in #2592
• CI red: job_resume_detached fixture defines [crews.sol] without a default_crew on hosts with no agent CLIs by @orbit-agent-01 in #2593
• [test-cleanup] Replace text-matching dashboard_assets tests with behavior tests, keeping only structural safety guards by @orbit-agent-01 in #2594
• Hold new run admissions while a host shutdown/reboot is scheduled by @orbit-agent-01 in #2595
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2596
• [test-cleanup] Review zero-unique tests in crates/orbit-cli/src/command/workspace/tests/init.rs by @orbit-agent-01 in #2597
• [test-cleanup] Review zero-unique tests in crates/orbit-web/src/api/tests/tasks.rs by @orbit-agent-01 in #2598
• [test-cleanup] Review zero-unique tests in crates/orbit-core/src/adapter/tool_host/tests/task_tools.rs by @orbit-agent-01 in #2599
• [test-cleanup] Review zero-unique tests in crates/orbit-cli/tests/mcp_roundtrip.rs by @orbit-agent-01 in #2600
• output_goldens fixture escapes to the enclosing checkout's config when TMPDIR is inside a Git checkout by @orbit-agent-01 in #2601
• [test-cleanup] Review zero-unique tests in crates/orbit-web/src/api/tests/runs.rs by @orbit-agent-01 in #2602
• [test-cleanup] Review zero-unique tests in crates/orbit-core/src/application/job/tests/catalog.rs by @orbit-agent-01 in #2603
• test-compiler-cache fails when TMPDIR is inside the repo: wrapper rewrites the fake rustc path by @orbit-agent-01 in #2604
• [test-cleanup] Review zero-unique tests in crates/orbit-core/src/adapter/engine_host/v2_host/tests/sandbox.rs by @orbit-agent-01 in #2605
• [code-scanning-sweep] Fix rust/path-injection in crates/orbit-core/src/runtime/host_signal.rs by @orbit-agent-01 in #2606
• [auto-task] Remediate current GitHub Actions failures by @orbit-agent-01 in #2607
• [qa-sweep] orbit run ship-sweep ignores --root and ORBIT_ROOT by @orbit-agent-01 in #2608
• Keep task-pilot history entries brief; move full assessment out of the history line by @orbit-agent-01 in #2610
• Add auto-task delete with a durable opt-out for shipped defaults; remove code sweeps from ws_marketing by @orbit-agent-01 in #2612
• [security] Plugin state dirs are readable by every other plugin backend and by agent sandboxes; carve out state/plugins/<ns> so a plugin can hold a credential by @orbit-agent-01 in #2613
• [qa-sweep] Ship-sweep parent marked interrupted/process_not_found 7 ms after start while its child kept running by @orbit-agent-01 in #2614
• [qa-sweep] Sibling-landed code-review repair still fails git_commit with "nothing to commit" and lands blocked by @orbit-agent-01 in #2615
• [qa-sweep] A cancelled PR child run leaves no audit event or actor, and its task is blocked with error=- by @orbit-agent-01 in #2616
• [qa-sweep] Readiness reports a queued ship-sweep coordinator as the drain while a live run auto drain owns the workspace by @orbit-agent-01 in #2617
• [qa-sweep] Installing a new binary SIGTERMs live drains and records them inconsistently (failed vs interrupted) by @orbit-agent-01 in #2618
• [plugin-standard] exec backend that exits before reading stdin surfaces only 'Broken pipe'; report its exit status and stderr by @orbit-agent-01 in #2619
• [qa-sweep] orbit tool run rejects the host-qualified selectors MCP hands out and ignores workspace when cwd has no .orbit by @orbit-agent-01 in #2620
• [ci-failure-sweep] Fix red CI: CI / Coverage (informational) / Collect workspace coverage by @orbit-agent-01 in #2621
• [plugin-standard] requires.programs is neither resolved nor granted: an exec backend cannot run a declared program that is not on the caller's PATH by @orbit-agent-01 in #2622
• [qa-sweep] Friction curation in a product workspace blocks every run on Orbit-platform frictions it cannot re-home by @orbit-agent-01 in #2623
• [qa-sweep] macOS managed worktree: orbit tool calls fail "generation record cannot be opened (EPERM)" when ORBIT_ROOT is inherited by @orbit-agent-01 in #2624
• [ci-red] ORB-13011 startup grace window broke seven orphan/owner reconciliation tests by @orbit-agent-01 in #2625
• [ci-repair] Plugin call-time profile test still asserts pre-ORB-13008 read roots (backend.rs:145) by @orbit-agent-01 in #2626
• [plugin-standard] orbit plugin remove leaves {{plugin_state}} behind; add --purge-state or document it by @orbit-agent-01 in #2627
• [qa-sweep] orbit routine list --workspace ignores the filter; doctor prints "9 of 6 auto-tasks need attention" by @orbit-agent-01 in #2628
• [qa-sweep] task-pilot re-pilots an external-only proposed task with no in-repo selectors on every run by @orbit-agent-01 in #2629
• [qa-sweep] Tasks blocked by a since-fixed infrastructure error (provider launcher not found) stay blocked indefinitely by @orbit-agent-01 in #2630
• [qa-sweep] Run records mislabel provenance: dashboard and state-triggered runs say cli, deterministic jobs show an LLM model, successful drains carry a when: error_message by @orbit-agent-01 in #2631
• [ci-red] ORB-13024 added friction rehome/rehome_to but five surface-contract tests still pin the old friction surface by @orbit-agent-01 in #2632
• [plugin-standard] Supported path for Python exec backends with third-party dependencies under the plugin sandbox by @orbit-agent-01 in #2633
• [cli] read-only plugin verbs create .orbit/ in an unregistered cwd; scaffold without --dir writes under ~/.orbit/scaffold by @orbit-agent-01 in #2634
• [ci-red] ORB-13023 added the infra-blocked-tasks doctor check but healthy_fresh_workspace_has_no_failures still expects 19 rows by @orbit-agent-01 in #2635
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2636
• Fix terminal-interface doc and comment drift: nonexistent --no-color, removed commands, stale snapshot claim, 256-color emission by @orbit-agent-01 in #2637
• Test runs leak plugin skill symlinks into the real ~/.claude/skills (dangling links left behind) by @orbit-agent-01 in #2638
• Make CLI help goldens match shipped help and close JSON-mode error, not-found and help-text gaps by @orbit-agent-01 in #2639
• [plugin-standard] Plugin secrets 1/3: spec.secrets manifest, host-owned secret store, and operator orbit plugin secret set|list|rm by @orbit-agent-01 in #2640
• Enforce bounded channels and async-lock lints, remove the forking test poll loop, and add nextest and CI timeouts by @orbit-agent-01 in #2641
• Correct architecture/error-pattern doc drift and make missing_docs and workspace-dependency rules honest by @orbit-agent-01 in #2642
• [ci-flake] uv plugin lockfile-upgrade test intermittently runs the old environment after orbit plugin upgrade (1.0.0 vs 2.0.0) by @orbit-agent-01 in #2643
• Emit basic 16-color ANSI from terminal table cells instead of crossterm's 38;5 codes by @orbit-agent-01 in #2644
• [ci-red] ORB-13105 moved skill links beside an overridden --root; mcp_setup_root's leak guard now rejects that .claude/skills dir as MCP client config by @orbit-agent-01 in #2645
• MCP tool schemas for plugin tools drop enum/default/min/max from the plugin's input_schema by @orbit-agent-01 in #2646
• Friction update/rehome on a missing record return invalid_input instead of friction_not_found by @orbit-agent-01 in #2647
• [friction-curation] Return task writes after redaction when the response projection has no string id by @orbit-agent-01 in #2648
• [friction-curation] Finish git_commit for a verified no-diff implementation without inventing a commit by @orbit-agent-01 in #2649
• [plugin-standard] A plugin's error envelope loses retryable and detail: parse_response flattens it into an Execution string by @orbit-agent-01 in #2650
• [ci-red] Coverage job lacks the pinned uv now that the uv plugin test runs in the normal suite (exit 127) by @orbit-agent-01 in #2651
• Refuse task completion while the task's linked implementation run is still alive by @orbit-agent-01 in #2652
• [friction-curation] Tell implementation agents to attach no-diff.json when a verified implementation correctly changes nothing by @orbit-agent-01 in #2653
• Read-only plugin tools are capability_denied for agent shell callers (resolved as unknown) by @orbit-agent-01 in #2654
• [plugin-standard] Document the exec child env allowlist and ORBIT_PLUGIN_CALLBACK_FD; warn when timeout_ms exceeds the host ceiling by @orbit-agent-01 in #2655
• [ci-red] ORB-13104's local-CLI Agent fallback applies to every governed operation; unidentified CLI callers now pass orbit.drain.probe by @orbit-agent-01 in #2656
• [flake] cli_runner provider spawn fails with ETXTBSY on a freshly written fixture launcher (Coverage job) by @orbit-agent-01 in #2657
• [ci-red] macOS Sandbox: uv plugin conformance fails, Seatbelt denies mkdir of the missing state/plugins parent for {{plugin_state}} by @orbit-agent-01 in #2658
• [plugin-standard] Plugin call context has no task or run id, so a backend cannot bind a write to the task that authorized it by @orbit-agent-01 in #2659
• [ci-red] macOS Sandbox: plugin backend cannot realpath its own state dir; Seatbelt denies metadata reads on the global-root ancestors of the {{plugin_state}} carve-out by @orbit-agent-01 in #2660
• [plugin-standard] Plugin secrets 2/3: deliver declared secrets per call on exec stdin and MCP _meta.orbit, never env/argv by @orbit-agent-01 in #2661
• [plugin-standard] Plugin secrets 3/3: backend-driven rotation via secret_updates with compare-and-swap by @orbit-agent-01 in #2662
• Align the website meta description and README intro with the approved descriptor "a local-first runtime for coding agents" by @orbit-agent-01 in #2663
• [security] Design a host-side broker for agent-invoked plugin calls so agent sandboxes can be denied state/plugins and host secrets by @orbit-agent-01 in #2664
• docs: treat ~800 lines as a heuristic for splitting, not a limit by @orbit-agent-01 in #2665
• Worker containment: keep warn-and-launch as the default, add an opt-in strict mode that refuses uncontained workers by @orbit-agent-01 in #2666
• Replace the path-heuristic test-harness worker refusal with an explicit launch signal by @orbit-agent-01 in #2667
• Plugins: workspace-scoped enable toggles layered under the host enable state by @orbit-agent-01 in #2668
• pr_complete waits out in-flight required checks instead of refusing when GitHub reports mergeStateStatus BLOCKED by @orbit-agent-01 in #2669
• [security] Plugin call broker 2/4: compile a brokered backend's profile as plugin profile ∩ calling agent profile, widening only {{plugin_state}} by @orbit-agent-01 in #2670
• macOS brokered plugin profile does not deny an agent's interior-wildcard read exclusion (**/.env) — agent-main macOS red after ORB-13237 by @orbit-agent-01 in #2671
• [security] Plugin call broker 1/4: per-run host broker socket with kernel peer authentication (Linux PID namespace, macOS ancestry) by @orbit-agent-01 in #2672
• Codex agents get an unbound orbit MCP server: forward the managed-run workspace binding via codex mcp_servers.env_vars by @orbit-agent-01 in #2673
• Reap plugin delivery-job worktrees on successful delivery by @orbit-agent-01 in #2674
• Workspace plugin toggle write rejects a crew pool naming a host-defined crew by @orbit-agent-01 in #2675
• Dashboard: enable/disable plugins (workspace and host scope) from the plugins tab, operator-only, grant changes stay on the CLI by @orbit-agent-01 in #2676
• macOS SBPL tests from ORB-13265 compare against the /var alias instead of the physical /private/var tempdir — agent-main macOS still red by @orbit-agent-01 in #2677
• Dashboard: collapse an expanded task row after a successful status change by @orbit-agent-01 in #2678
• Repair agent-main red: codex argv tests still expect the pre-#2673 argv without the injected orbit MCP server overrides by @orbit-agent-01 in #2679
• Deterministic plugin.tool_call steps deny every plugin that declares requires.programs by @orbit-agent-01 in #2680
• [code-scanning-sweep] Fix rust/path-injection at 2 locations in crates/orbit-config/src/plugin_enablement.rs by @orbit-agent-01 in #2681
• [cold-install] Quickstart's first local ship fails because workspace init --mcp leaves its own files uncommitted by @orbit-agent-01 in #2682
• Repair agent-main red: plugin broker tests fail on macOS (sun_path too long, unsupported 'intruder' provider) and flake on Linux (busy BrokenPipe) by @orbit-agent-01 in #2683
• [cold-install] orbit run show on a failed run hides the root cause behind truncated nested child-run errors by @orbit-agent-01 in #2684
• [security] Activity tool allowlist and agent actor-kind are not enforced for codex agents' MCP calls (envelope stripped by codex) by @orbit-agent-01 in #2685
• [code-review] Auto-task deletion races scheduler admission and can bypass open-task refusal by @orbit-agent-01 in #2686
• [cold-install] orbit doctor reports "Workspace healthy" when no agent can run a task by @orbit-agent-01 in #2687
• Add a per-crew enabled toggle; orbit init seeds every default crew and disables those whose provider isn't detected by @orbit-agent-01 in #2688
• [cold-install] Stop workspace init --mcp from writing a config dir per provider when a shared location already covers it by @orbit-agent-01 in #2689
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2690
• Activity tool policy 1/3: add tool_disallow_list (disallow-by-default mode) with explicit policy mode and fail-closed enforcement; allowlists stay for custom jobs by @orbit-agent-01 in #2691
• Repair agent-main red: workspace_init_before_machine_identity_is_repaired_after_orbit_init fails in CI since #2687 (doctor now fails without a runnable agent CLI) by @orbit-agent-01 in #2692
• Activity tool policy 2/3: switch the six shipped agent_loop activities from tools allowlists to tool_disallow_list (deny control-plane/admin tools and agent recursion only) by @orbit-agent-01 in #2693
• Repair agent-main red: non_interactive_init_against_non_global_root_leaves_home_skill_links_untouched rejects the newly seeded 'antigravity' crew since #2688 by @orbit-agent-01 in #2694
• Website: remove the tabbed install terminal from the homepage hero (keep the agent-session transcript) by @orbit-agent-01 in #2695
• Website: make light mode the default theme (and stop persisting the default as if it were a user choice) by @orbit-agent-01 in #2696
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2697
• Activity tool policy 3/3: proc_disallowed_programs for shipped activities so granted plugin programs (e.g. uv, ORB-13314) and ordinary dev tools are not refused by @orbit-agent-01 in #2698
• Repair agent-main red: 11 tests fail since #2693 (shipped agent_loop activities switched to tool_disallow_list) by @orbit-agent-01 in #2699
• Repair agent-main red: 5 orbit-cli integration tests fail in CI since #2688 because fixture crew 'sol' is seeded disabled on a CLI-less runner by @orbit-agent-01 in #2700
• [code-review] Doctor reports missing provider CLIs for disabled pool crews by @orbit-agent-01 in #2701
• [friction-curation] Forward local base_sync from the workspace drain into worktree setup by @orbit-agent-01 in #2702
• [friction-curation] Audit every task crew change and keep a null crew off the pool redraw by @orbit-agent-01 in #2703
• [security] Plugin call broker 3a/4: broker executes authorized plugin calls through audited dispatch (replaces not_implemented) by @orbit-agent-01 in #2704
• Repair agent-main red: crew_pools::clearing_the_crew_redraws_and_a_complexity_edit_does_not expects pre-#2703 crew-history wording by @orbit-agent-01 in #2705
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2706
• [security] Plugin call broker 3b/4: nested orbit forwards plugin tool calls to the run broker (CLI + MCP clients) by @orbit-agent-01 in #2707
• [security] Plugin call broker 3c/4: brokered backend lifecycle (MCP sessions per caller, disconnect kill) and real-bwrap end-to-end by @orbit-agent-01 in #2708
• [security] Plugin call broker 4/4: deny state/plugins and the plugin secret store to agent sandboxes (Linux sentinel mount, macOS SBPL) with no in-process fallback by @orbit-agent-01 in #2709
• Repair: brokered::a_masked_process_without_a_broker_refuses_plugin_calls fails without a TTY (#2709 test resolves caller as unknown) by @orbit-agent-01 in #2710
• [code-review] Landlock workspace traversal recurses forever through directory symlinks by @orbit-agent-01 in #2711
• [code-review] Bound orbit-exec pipe draining when descendants leave the child process group by @orbit-agent-01 in #2712
• [code-review] Auto-task show and mint bypass definition path confinement by @orbit-agent-01 in #2713
• [code-review] Apply a total deadline and teardown cancellation to broker frame reads by @orbit-agent-01 in #2714
• [code-review] Keep reservations while provider children survive an unexpected worker exit by @orbit-agent-01 in #2715
• [code-review] [full-review] Redact task status notes before persisting lifecycle history by @orbit-agent-01 in #2716
• [code-review] Refuse unenforceable absent denyModify paths in direct Bubblewrap invocations by @orbit-agent-01 in #2717
• [code-review] [full-review] Bind CI duplicate coverage to the supplying job, not a bare run ID by @orbit-agent-01 in #2718
• [code-review] Bound host Git subprocesses in worktree fingerprints and rebase continuation by @orbit-agent-01 in #2719
• Repair agent-main macOS red: broker call_when rejects NotConnected when a full broker closes before the write by @orbit-agent-01 in #2720
• Repair agent-main red: reviewer_profile_starts_direct_linux_invocation_and_protects_env_paths pins the pre-ORB-13433 guard by @orbit-agent-01 in #2721
• [code-review] [full-review] Refuse plugin write confinement when Landlock cannot mediate truncate by @orbit-agent-01 in #2722
• [code-review] [full-review] Do not let a hyphen-prefix package PR suppress another dependency alert by @orbit-agent-01 in #2723
• [code-review] Make task artifact replacement recoverable across blob/manifest failures by @orbit-agent-01 in #2724
• [code-review] [full-review] Preserve secret redaction across bounded debug-echo flushes by @orbit-agent-01 in #2725
• [code-review] [full-review] Enforce the published PR head before ungated completion requests a merge by @orbit-agent-01 in #2726
• [code-review] [full-review] Refuse claimed validation evidence from a dirty or changed candidate tree by @orbit-agent-01 in #2727
• [code-review] [full-review] Preserve foreign rebase state through terminal PR failure handoff by @orbit-agent-01 in #2728
• [code-review] Settle interrupted bundle writes before exporting task archives by @orbit-agent-01 in #2729
• [code-review] [full-review] Preserve read-only activity profiles when adding macOS runtime grants by @orbit-agent-01 in #2730
• [code-review] Bound task-publication Git subprocess lifetimes by @orbit-agent-01 in #2731
• [code-review] [full-review] Reject conflicting claim artifact paths before the durable commit decision by @orbit-agent-01 in #2732
• [code-review] [full-review] Preserve customized skill files during legacy workspace cleanup by @orbit-agent-01 in #2733
• [code-review] [full-review] Honor listed .yml policies during named lookup and runtime policy loading by @orbit-agent-01 in #2734
• Repair agent-main red: orbit-web artifact test helpers can't find content-addressed blobs after ORB-13439 by @orbit-agent-01 in #2735
• [code-review] [full-review] Serialize workspace catalog mutations across CLI writers by @orbit-agent-01 in #2736
• [code-review] [full-review] Preserve dirty worktrees when non-force removal times out by @orbit-agent-01 in #2737
• [code-review] [full-review] Retain the agent sandbox boundary for brokered unsandboxed plugins by @orbit-agent-01 in #2738
• [code-review] [full-review] Confine retired graph cleanup across intermediate symlinks by @orbit-agent-01 in #2739
• [code-review] [full-review] Resolve ship mode from the selected workspace in shared-root checkouts by @orbit-agent-01 in #2740
• [code-review] [full-review] Match newline-containing paths consistently in recursive policy globs by @orbit-agent-01 in #2741
• [code-review] [full-review] Bound sparse tar output when extracting plugin sources by @orbit-agent-01 in #2742
• [code-review] Redact credentials in malformed Git remote errors by @orbit-agent-01 in #2743
• [code-review] [full-review] Keep artifact attachment from forwarding unrelated task mutations by @orbit-agent-01 in #2744
• [code-review] [full-review] Keep nested failure examples from overriding a successful terminal envelope by @orbit-agent-01 in #2745
• [code-review] Reject wrongly typed job step guards instead of executing unconditionally by @orbit-agent-01 in #2746
• Repair agent-main macOS flake: broker test connect() panics when set_read_timeout races a broker-closed socket (EINVAL) by @orbit-agent-01 in #2747
• [code-review] [full-review] Atomically deduplicate concurrent agent invocation retries by @orbit-agent-01 in #2748
• [code-review] [full-review] Make the live containment stress fixture fail closed and always reap its processes by @orbit-agent-01 in #2749
• [code-review] [full-review] Confine stale-artifact retirement across intermediate symlinks by @orbit-agent-01 in #2750
• [code-review] [full-review] Restore displaced plugin installs when publishing the staged tree fails by @orbit-agent-01 in #2751
• [code-review] Restore compound-step outputs and fan-in aliases when resuming jobs by @orbit-agent-01 in #2752
• [code-review] [full-review] Confine bootstrap managed-asset reconciliation to its catalog by @orbit-agent-01 in #2753
• [code-review] [full-review] Revalidate task meaning when replaying a settled review gate by @orbit-agent-01 in #2754
• [code-review] [full-review] Keep retired activity repair from rewriting symlink targets outside its catalog by @orbit-agent-01 in #2755
• [code-review] [full-review] Confine plugin schedule seeding across destination symlinks by @orbit-agent-01 in #2756
• [code-review] [full-review] Stop active disabled systemd timers when pausing the clock by @orbit-agent-01 in #2757
• [code-review] [full-review] Confine routine materialization across destination symlinks by @orbit-agent-01 in #2758
• [code-review] Replace auto-task cursor fixture that never exercises production selection by @orbit-agent-01 in #2759
• [code-review] [full-review] Serialize plugin namespace installation and pruning by @orbit-agent-01 in #2760
• [code-review] Clear inherited process deny policy before launching an allowlist activity by @orbit-agent-01 in #2762
• [code-review] Remap retained PR association anchors during delivery history replay by @orbit-agent-01 in #2763
• [code-review] Encode quoted untracked filenames in batched worktree fingerprints by @orbit-agent-01 in #2765
• [code-review] [full-review] Prefer the newest relevant CI success when suppressing a non-landing failure by @orbit-agent-01 in #2766
• [code-review] [full-review] skill unlink removes unrelated agent skill symlinks by @orbit-agent-01 in #2767
• [code-review] Reject oversized worktree GC age values without panicking by @orbit-agent-01 in #2768
• feat: [distributed-drain v1] Enable follower pull — owner pull/bind/settle tools, routed PullPeer, orbit run auto --pull [ORB-13625] by @danieljhkim in #2764
• [code-review] Serialize manual auto-task mint with non-force deletion by @orbit-agent-01 in #2769
• [code-review] [full-review] Require conformance consent for rendered write roots outside scratch by @orbit-agent-01 in #2770
• [BLOCKED] [code-review] Keep CLI output-reader finalization bounded when cancellation setup fails by @orbit-agent-01 in #2761
• fix(ci): make make ci-lint pass on macOS by @danieljhkim in #2771
• fix: [distributed-drain v1] Resolve claimed-leaf worker bindings on macOS [ORB-13625] by @danieljhkim in #2772
• fix: [distributed-drain v1] Return routed worker reads undecorated from MCP task.show [ORB-13625] by @danieljhkim in #2773
• [code-review] Do not advance the local task allocator from foreign-prefix reindex entries by @orbit-agent-01 in #2774
• [code-review] [full-review] Replace bootstrap prompt phrase pins with behavioral contract coverage by @orbit-agent-01 in #2775
• [code-review] [full-review] Resolve nested linked worktrees before taking the repository-root fast path by @orbit-agent-01 in #2776
• [code-review] [full-review] Preserve significant whitespace in command argv entries by @orbit-agent-01 in #2777
• [code-review] [full-review] Couple task blocking to the winning run-finalization transition by @orbit-agent-01 in #2778
• [code-review] [full-review] Remove internal dependency edges when consolidating code-alert tasks by @orbit-agent-01 in #2779
• [code-review] [full-review] Publish product ownership markers atomically by @orbit-agent-01 in #2780
• [code-review] [full-review] Bound retained macOS sandbox profile files and descriptors by @orbit-agent-01 in #2781
• fix: [distributed-drain v1] Decode routed owner reads through the MCP structured-content envelope [ORB-13625] by @danieljhkim in #2782
• feat: [distributed-drain v1] Stop a pull drain after three consecutive failed claims [ORB-13625] by @danieljhkim in #2783
• [code-review] [full-review] Keep older actionable CI failures when newer cancellation could not be investigated by @danieljhkim in #2784
• [code-review] [full-review] Reject non-finite plugin numeric flags instead of silently dropping them by @danieljhkim in #2785
• Keep recovery authority WAL sidecars so sandboxed workers can read it by @danieljhkim in #2786
• [code-review] [full-review] Remove compound SELECT ceiling from batched relation validation by @orbit-agent-01 in #2788
• [code-review] [full-review] Bound audit-summary sparkline expansion for old since values by @orbit-agent-01 in #2789
• [code-review] Handle maximum task-number imports without overflowing the allocator by @orbit-agent-01 in #2790
• [code-review] [full-review] Bound release-source reads before buffering update artifacts by @orbit-agent-01 in #2791
• [code-review] [full-review] Isolate missing-launcher fixtures from installed system providers by @orbit-agent-01 in #2793
• Dashboard: make an in-progress drain visibly obvious (card, dock tab and page chrome), including the wind-down after admissions stop by @orbit-agent-01 in #2787
• Read macOS process start identity from libproc so sandboxed workers resolve their binding by @danieljhkim in #2792
• feat: [distributed-drain v1] Owner completion policy lands accepted follower handoffs [ORB-13637] by @danieljhkim in #2795
• Upgrade admission: key generations on store compatibility, not executable digest; hand off long-lived processes instead of refusing by @orbit-agent-01 in #2796
• Plugin sources keep the plugin in a .orbit-plugin/ directory; install only that tree by @orbit-agent-01 in #2794
• [code-review] [full-review] Preserve the log-tail cursor and partial line across initial follow handoff by @orbit-agent-01 in #2798
• fix: [distributed-drain v1] Follower drain closes settlements for claims the owner already ended [ORB-13639] by @danieljhkim in #2797
• [code-review] [full-review] Enforce federated MCP deadlines while writing requests by @orbit-agent-01 in #2799
• [code-review] [full-review] Preserve unrelated skill links during workspace teardown by @orbit-agent-01 in #2800
• [code-review] [full-review] Bind dashboard log replay cursor to the bytes actually scanned by @orbit-agent-01 in #2801
• [code-review] Preserve legitimate pending-write-named artifacts during task export by @orbit-agent-01 in #2802
• [code-review] [full-review] Treat NDJSON stdout broken pipes as successful consumer termination by @orbit-agent-01 in #2803
• [code-review] [full-review] Preserve workspace routing for dashboard artifact previews and task actions by @orbit-agent-01 in #2804
• Make task-pilot freshness inputs configurable (default: title, description, criteria, plan, selectors) by @orbit-agent-01 in #2805
• [code-review] [full-review] Reject writable SQLite sidecar symlinks before permission hardening by @orbit-agent-01 in #2807
• fix: [code-review] [full-review] Stop HTTP-loop tool dispatch when its wall-clock budget expires [ORB-13486] by @danieljhkim in #2806
• [code-review] [full-review] Exclude machine-only settings when seeding workspace config from global by @orbit-agent-01 in #2808
• [code-review] [full-review] Bound the complete non-TTY init prompt read by @orbit-agent-01 in #2809
• [code-review] [full-review] Refresh the retained plugin panel DOM nodes by @orbit-agent-01 in #2810
• fix: [code-review] [full-review] Bound dependency-cycle traversal across shared subgraphs [ORB-13491] by @danieljhkim in #2811
• [code-review] [full-review] Propagate buffered JSON audit-export flush failures by @orbit-agent-01 in #2812
• fix: [code-review] [full-review] Distinguish MCP server requests from responses before matching IDs [ORB-13492] by @danieljhkim in #2813
• [code-review] [full-review] Keep dashboard registry fingerprints tied to the loaded snapshot by @orbit-agent-01 in #2814
• fix: [code-review] [full-review] Return a failing exit status for unsuccessful waited task-pilot runs [ORB-13501] by @danieljhkim in #2815
• [code-review] [full-review] Bound dashboard log replay batches and paused browser buffers by @orbit-agent-01 in #2816
• fix(ci): regenerate config-show snapshots; make failed-spawn test fail on macOS by @danieljhkim in #2817
• [code-review] [full-review] Keep plugin traversal fixtures inside their owned temporary roots by @orbit-agent-01 in #2818
• [code-review] [full-review] Keep remote-run navigation authority in dashboard task summaries by @orbit-agent-01 in #2819
• [code-review] [full-review] Scope plugin panel caches and pending reads to workspace revisions by @orbit-agent-01 in #2820
• [code-review] [full-review] Make the session continuation smoke accept its requested spelling by @orbit-agent-01 in #2821
• [code-review] [full-review] Bind artifact provenance to the managed file path by @orbit-agent-01 in #2822
• [code-review] [full-review] Replace tool help wording pins with contract behavior checks by @orbit-agent-01 in #2823
• [code-review] [full-review] Honor Start empty when initializing config from the crew editor by @orbit-agent-01 in #2824
• [code-review] Scope run-detail responses to the current run and workspace by @orbit-agent-01 in #2826
• fix: [distributed-drain v1] Claimed leaves hand off the agent's output summary instead of writing owner task state [ORB-13642] by @danieljhkim in #2825
• [code-review] [full-review] Preserve secret redaction at GitHub log excerpt cuts by @orbit-agent-01 in #2828
• fix: [code-review] [full-review] Preserve workspace-root selectors and include their descendants in overlap checks [ORB-13485] by @danieljhkim in #2827
• [code-review] [full-review] Settle pipeline waits immediately for persisted timeout outcomes by @orbit-agent-01 in #2830
• fix: [code-review] [full-review] Preserve config editor drafts through refresh and failed saves [ORB-13498] by @danieljhkim in #2829
• fix: [code-review] [full-review] Preserve storage and reconciliation errors during CLI run lookup [ORB-13502] by @danieljhkim in #2831
• fix: [code-review] [full-review] Preserve HTTP session tool-result pairs when policy denial terminates a turn [ORB-13487] by @danieljhkim in #2832
• fix: [code-review] [full-review] Bound HTTP agent response bodies before buffering [ORB-13488] by @danieljhkim in #2833
• [code-review] [full-review] Report persisted invocation settings when a retry is deduplicated by @orbit-agent-01 in #2834
• [code-review] Refresh expanded step output when run logs arrive by @orbit-agent-01 in #2835
• fix: [code-review] [full-review] Execute the read-only registry child assertions instead of accepting zero tests [ORB-13510] by @danieljhkim in #2836
• [code-review] [full-review] Never draw a zero-weight crew after disabled pool members are removed by @orbit-agent-01 in #2837
• [code-review] [full-review] Preserve direct-YAML definition snapshots across job resume by @orbit-agent-01 in #2839
• fix: [code-review] [full-review] Keep member automation progressing after retained assessments fill its capacity [ORB-13511] by @danieljhkim in #2838
• [code-review] [full-review] Report catalog layers using the definition selected for execution by @orbit-agent-01 in #2840
• [code-review] [full-review] Make task update persistence coverage exercise the real persistence path by @orbit-agent-01 in #2841
• fix: [code-review] [full-review] Preserve record and field boundaries in plain table output [ORB-13512] by @danieljhkim in #2842
• fix: [code-review] [full-review] Revalidate auto-task definition revisions at scheduler admission [ORB-13490] by @danieljhkim in #2843
• fix: [code-review] [full-review] Run GitHub discovery tools in the selected workspace [ORB-13515] by @danieljhkim in #2844
• [code-review] [full-review] Make the missing clock-program fixture independent of Homebrew installs by @danieljhkim in #2845
• [code-review] [full-review] Fill filtered task search pages beyond the initial BM25 chunk budget by @danieljhkim in #2846
• [code-review] [full-review] Isolate mutable task and distributed fixtures from inherited worker authority by @danieljhkim in #2847
• [code-review] [full-review] Revalidate the selected routine target at the toggle write boundary by @danieljhkim in #2848
• [code-review] [full-review] Isolate mutable routine fixtures from inherited worker authority by @danieljhkim in #2849
• [code-review] [full-review] Replace catalog prose and YAML substring assertions with contract checks by @orbit-agent-01 in #2855
• [code-review] [full-review] Retain manifest-write warnings in workspace sync reports by @danieljhkim in #2851
• [code-review] [full-review] Preserve friction re-home metadata across Markdown export and import by @danieljhkim in #2850
• [code-review] [full-review] Make task YAML durability probe verify successful fsync of the renamed file by @danieljhkim in #2852
• [code-scanning-sweep] Fix rust/path-injection at 5 locations across 2 files by @danieljhkim in #2853
• [code-review] [full-review] Keep cursor symlink test fixtures inside uniquely owned temporary roots by @danieljhkim in #2854
• [code-review] [full-review] Open scoreboard snapshots without following targets swapped after validation by @danieljhkim in #2857
• [code-review] [full-review] Make friction auto-resolution preserve the first committed resolver atomically by @danieljhkim in #2856
• [code-review] [full-review] Fail closed when resume lineage exceeds the ancestor traversal bound by @danieljhkim in #2858
• [code-review] [full-review] Exercise operation locking after store construction in serialization tests by @danieljhkim in #2860
• [code-review] [full-review] Restore the friction benchmark's test selection and imported corpus by @danieljhkim in #2859
• [code-review] [full-review] Cap pipeline polling sleep at the remaining wait deadline by @orbit-agent-01 in #2861
• [code-review] [full-review] Report effective plugin status after sync reconciliation by @orbit-agent-01 in #2862
• [code-review] [full-review] Report the current previous ceiling on unchanged worker-limit requests by @orbit-agent-01 in #2863
• [code-review] [full-review] Exercise the stale-owner gate when the identity probe is unavailable by @orbit-agent-01 in #2864
• [code-review] [full-review] Reject dangling sweep-log symlinks before rendering launchd output paths by @orbit-agent-01 in #2865
• [code-review] [full-review] Keep log dock controls reachable when the toolbar overflows by @danieljhkim in #2866
• [code-review] [full-review] Keep run step targets and exit codes readable on mobile by @danieljhkim in #2868
• [code-review] [full-review] Isolate explicit-root web fixtures from inherited worker authority by @danieljhkim in #2869
• [code-review] [full-review] Do not finalize friction import after a corpus-root access failure by @danieljhkim in #2870
• [code-review] [full-review] Resolve plugin skill-link ownership before replacing or unlinking links by @orbit-agent-01 in #2872
• [code-review] [full-review] Keep clock version-probe pipe reads inside the deadline by @orbit-agent-01 in #2873
• [code-review] [full-review] Prevent archived or deleted job-run IDs from being reallocated by @danieljhkim in #2871
• [code-review] [full-review] Retain landed publication evidence until reconciliation is durably recorded by @danieljhkim in #2867
• [code-review] [full-review] Read publication source bundles under canonical writer coordination by @danieljhkim in #2874
• [code-review] [full-review] Keep reindex snapshots synchronized through index publication by @orbit-agent-01 in #2878
• [code-review] [full-review] Exercise ship lock contention in the healthz responsiveness regression by @danieljhkim in #2876
• [code-review] [full-review] Exercise contention in the shared environment guard regression by @danieljhkim in #2875
• docs: running run-failure log under docs/rca by @danieljhkim in #2877
• fix: Keep publication inspection trees private to each validated snapshot [ORB-13605] by @danieljhkim in #2879
• [code-review] [full-review] Reconcile interrupted review settlement before returning a verdict by @orbit-agent-01 in #2882
• [code-review] [full-review] Gate the deleted-executable worker assertion to Linux by @orbit-agent-01 in #2883
• [code-review] [full-review] Assert failure-handoff dispatch in the named pipeline regression by @orbit-agent-01 in #2886
• [code-review] [full-review] Isolate orbit-common logging and redaction environment fixtures by @danieljhkim in #2880
• [code-review] [full-review] Restore behavioral assertions for run-list counts and truncated results by @orbit-agent-01 in #2888
• docs: failure log — open-fix citations, drain-stop stranding, headless claude background gates by @danieljhkim in #2881
• [code-review] [full-review] Preserve terminal child-dispatch evidence across late checkpoints by @danieljhkim in #2884
• [code-review] [full-review] Isolate the no-root web-server test from the caller's registry by @orbit-agent-01 in #2890
• [code-review] [full-review] Use matching Unicode case normalization for friction substring queries by @danieljhkim in #2885
• [code-review] [full-review] Replace config prose and template substring pins with behavior coverage by @danieljhkim in #2887
• [code-review] Recheck the pull failure breaker after settling pending leaves by @danieljhkim in #2889
• [code-review] [full-review] Make audit provenance filter coverage detect ignored query fields by @danieljhkim in #2891
• [code-review] [full-review] Exercise expired reservations in the handoff console regression by @danieljhkim in #2892
• [code-review] [full-review] Run the Grok environment fixture instead of accepting zero child tests by @orbit-agent-01 in #2898
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #2897
• [code-review] [full-review] Remove configurable schedule and budget pins from routine seeding tests by @orbit-agent-01 in #2899
• test-validate-codex-plugin.sh races on fixed temp paths under concurrent validation by @danieljhkim in #2900
• [qa-sweep] Workspace sync fails closed when the routine manifest cannot be written by @danieljhkim in #2901
• Treat an archived dependency as satisfied when it reached done before it was archived by @danieljhkim in #2893
• [code-review] [full-review] Make auto-task projection tests stable across schedule boundaries by @danieljhkim in #2894
• [code-review] [full-review] Isolate mutable job fixtures from inherited worker authority by @orbit-agent-01 in #2903
• [code-review] [full-review] Make shutdown tests prove the full grace interval after notification by @danieljhkim in #2902
• [code-review] Revalidate task-pilot assessments for workspace-root context selectors by @orbit-agent-01 in #2904
• fix: Keep scoreboard values within their agent columns at narrow widths [ORB-13612] by @danieljhkim in #2895
• test: Exercise downstream reads in pipeline durability tests [ORB-13463] by @danieljhkim in #2896
• [code-review] Extend live run timelines past the last completed step by @danieljhkim in #2905
• [auto-task] Skill validation — review the shipped Orbit skills for drift by @orbit-agent-01 in #2908
• [code-review] [full-review] Reject unsupported review-admission contract versions by @danieljhkim in #2906
• [code-review] [full-review] Isolate mutable plugin fixtures from inherited worker authority by @orbit-agent-01 in #2910
• Document [workflow.task_pilot_freshness] defaults as a commented block in the seeded config.toml by @danieljhkim in #2907
• [code-review] Bound task reindex locking so large workspaces do not exhaust file descriptors by @danieljhkim in #2909
• [code-review] [full-review] Preserve the YAML line boundary when inserting routine enabled by @orbit-agent-01 in #2911
• [code-review] [full-review] End the blob concurrency fixture when a writer fails by @orbit-agent-01 in #2914
• [friction-curation] Keep Orbit's own GitHub PR refs out of task commit subjects so a stale handoff PR is never named by @danieljhkim in #2912
• [code-review] [full-review] Make the nonblocking submission test distinguish waiting for worker exit by @danieljhkim in #2913
• [auto-task] Doc duties — validate the least-recently-validated docs by @orbit-agent-01 in #2917
• [distributed-drain v1] Owner and follower can mint the same child run ID; commit lookups bind by run ID alone by @orbit-agent-01 in #2920
• Ship a bundled full-code-review auto-task and make the code-review sweep selector collision-proof by @danieljhkim in #2915
• Worktree GC on a replica workspace resolves task status from the owner; option to reap target/ only by @danieljhkim in #2916
• [friction-curation] Clear ORBIT_PLUGIN_BROKER with the shared inherited-authority test env so plugin fixtures stop routing to the host broker by @danieljhkim in #2919
• [friction-curation] Stop the Coverage (informational) job flaking on process-level orbit-cli tests that pass under nextest by @danieljhkim in #2918
• fix: resolve open rust/path-injection code scanning alerts (#465–#471) by @danieljhkim in #2921
• docs: failure log adds drain-stop stranding (ORB-13663) and headless claude background gates (ORB-13664) by @danieljhkim in #2922
• Hide plugin-seeded auto-tasks, routines and other definitions from listings and the dashboard when the plugin is off in the workspace by @orbit-agent-01 in #2923
• [code-review] Retry reindex batches until stale relation dependencies settle by @orbit-agent-01 in #2924
• ci(codeql): cancel superseded analyses per ref by @danieljhkim in #2925
• [code-review] [full-review] Restore the disabled audit execution-ID concurrency regression by @orbit-agent-01 in #2926
• Headless claude crew hands off while its validation gates still run in the background by @orbit-agent-01 in #2927
• fix: repair agent-main CI red — implement prompt budget and fan-in resume flake by @danieljhkim in #2928
• feat: Route orbit run ship to a plugin-contributed delivery job [ORB-13271] by @danieljhkim in #2929
• ci(codeql): let a running branch analysis finish by @danieljhkim in #2931
• docs: failure log adds ORB-13271 to ORB-13663 / ORB-13664 entries by @danieljhkim in #2930
• fix: [distributed-drain v1] Settlement belongs to the admission record, not the drain that admitted it [ORB-13663] by @danieljhkim in #2932
• [code-review] Plugin delivery merge leaves skill mirror drift and fails ci-fast by @orbit-agent-01 in #2933
• Post-v0.24.0 release survey and breaking-change handoff by @orbit-agent-01 in #2934
• chore: prepare v0.25.0 release [ORB-13671] by @orbit-agent-01 in #2935

Full Changelog: v0.24.0...v0.25.0