v0.6.0

What's Changed

• Discover the platform API without the UI service (#1068) by @jw3329 in #1099
• Log a rejected webhook push instead of failing silently (#1066) by @jw3329 in #1098
• skill check: explain a remote server's red instead of implying a defect (#1093) by @jw3329 in #1101
• cluster up: preserve what cluster comms configured (#1067) by @jw3329 in #1100
• cluster/local deploy: add --repo to bind an agent at creation (#1064) by @jw3329 in #1102
• Publish a linux/arm64 CLI binary (#1065) by @jw3329 in #1103
• ADR-0086 (Draft): bundles declare connectors, the platform hosts them (#1063) by @jw3329 in #1104
• chart: plumb api.githubToken so private-repo git-flow is reachable (#1058) by @jw3329 in #1109
• Bundle format: declare connectors in connectors.yaml (ADR-0086, #1063) by @jw3329 in #1111
• Derive a connector's Kubernetes objects from its declaration (#1063) by @jw3329 in #1112
• API renders connector manifests, and never applies them (#1063) by @jw3329 in #1113
• Re-land the connectors endpoint and CLI apply plumbing (#1063) by @jw3329 in #1115
• Readability pass on README.md by @athusoo in #1013
• Retry the third-party acquisition steps that red main on a blip by @TheConnMan in #1108
• Readability pass on docs/operations.md by @athusoo in #1121
• ADR 0088: Per user delegated OAuth for MCP by @TheConnMan in #1144
• Restrict authenticated git-flow clones to the registered repository by @TheConnMan in #1142
• Tell the clicker when a fall-forward resolve is refused by @yichenzhang-curietech in #1148
• Refuse an unknown key in a --routes-from file instead of stripping it by @yichenzhang-curietech in #1147
• Scope connector object names to the agent, not the release (#1116) by @jw3329 in #1117
• Wire connectors into cluster deploy (#1063) by @jw3329 in #1119
• ADR-0087 (Draft): the API renders connector objects, the CLI applies them by @jw3329 in #1120
• Reject a server declared in both connectors.yaml and MCP config (#1118) by @jw3329 in #1149
• BootEnv: declare the connector scope the runner derives URLs from (ACI 0.2.8, #1118) by @jw3329 in #1150
• Runner mounts the connectors a bundle declared (#1118) by @jw3329 in #1151
• Worker tells the sandbox where its connectors live (#1118) by @jw3329 in #1152
• Assert Rail 1 actually enforces, and give CI a CNI that can (#1153) by @jw3329 in #1155
• Substitute ${CURIE_*} placeholders so a connector gets its host allowlist (#1156) by @jw3329 in #1158
• Read the approval card from its thread, and never stamp one we could not read by @yichenzhang-curietech in #1157
• Record the always-on note dialog as the decision it is by @yichenzhang-curietech in #1154
• Readability pass on remaining docs by @athusoo in #1017
• connectors.yaml: unhosted_url, for tiers that cannot host (#1160) by @jw3329 in #1161
• Runner mounts a hosted connector's unhosted_url where it cannot host (#1160) by @jw3329 in #1162
• Settle the approval card when a resolution arrives through the API by @yichenzhang-curietech in #1164
• cluster/local deploy: --agent, so one repo can serve two agents (#1166) by @jw3329 in #1167
• ADR-0089 (Draft): bundles declare their deploy targets by @jw3329 in #1168
• plugin-format: deploy.yaml, the declared deploy targets (ADR-0089) by @jw3329 in #1169
• Scrub real identifiers from a public repo, and gate against more by @jw3329 in #1175
• deploy --target: execute a declared routing target (ADR-0089) by @jw3329 in #1178
• Mask real agent names in the public repo by @jw3329 in #1179
• Update boto3-stubs[s3] requirement from >=1.43.55 to >=1.43.57 by @dependabot[bot] in #1174
• Bump the github-actions group with 2 updates by @dependabot[bot] in #1172
• Bump the pnpm group in /apps/ui with 12 updates by @dependabot[bot] in #1171
• Bump the cargo group across 1 directory with 2 updates by @dependabot[bot] in #1170
• Add "see Releases" pointer to README by @athusoo in #1006
• Add license and release badges to README by @athusoo in #1005
• Readability pass on CONTRIBUTING.md by @athusoo in #1014
• docs: content-quality pass on QUICKSTART.md, fix stale README scaffold output by @athusoo in #1177
• Readability pass on ARCHITECTURE.md by @athusoo in #1015
• curie init: scaffold connectors.yaml and deploy.yaml by @jw3329 in #1180
• Tell the operator when the platform is older than the CLI by @jw3329 in #1181
• ADR-0090 (Draft): a reconciler applies connectors, so agent repos need no CLI by @jw3329 in #1185
• connectors.yaml: reference an existing Secret instead of minting one (#1163) by @jw3329 in #1186
• Connector reconcile: the plan, before anything applies it (ADR-0090) by @jw3329 in #1187
• ADR-0091 (Draft): git-flow resolves deploy targets, so one repo serves many agents by @jw3329 in #1188
• Carry out a connector reconcile plan by @jw3329 in #1189
• Stop the reconciler rewriting every object on every pass by @jw3329 in #1190
• Give the connector reconciler a real cluster client and its RBAC by @jw3329 in #1191
• Parse the connector scope in BootEnv.from_env by @TheConnMan in #1204
• Read the approval record before claiming the card ref by @TheConnMan in #1209
• Reserve the platform MCP server names for Curie by @TheConnMan in #1205
• Reconcile one agent's connectors without eating its credential by @jw3329 in #1192
• Run the connector reconciler in the worker by @jw3329 in #1193
• Git-flow routes a push through deploy.yaml, so one repo serves many agents by @jw3329 in #1194
• Bind an unbound agent's repo on deploy instead of advising a recreate by @TheConnMan in #1222
• Prune undeclared connector objects on the unprovisioned skip by @TheConnMan in #1219
• Make the GitHub clone token a private durable cluster input by @TheConnMan in #1146
• Deploy a scaffolded bundle instead of ignoring its pushes by @TheConnMan in #1220
• Annotate swap-candidate licenses in the architecture vision by @TheConnMan in #1229
• Surface the diagnosis, not the usage block, as a failed step reason by @yichenzhang-curietech in #1231
• Give the platform its own GitHub identity (ADR-0092) by @jw3329 in #1223
• Refuse --local-model (when required ollama asset is missing) rather than downloading 11.4 GB implicitly (ADR 0093) by @yichenzhang-curietech in #1235
• Stop the App ID becoming a float, and let the key stay out of helm by @jw3329 in #1236
• Clear the two advisories failing every PR's audit by @jw3329 in #1237
• Use an example App ID in the tests, not the real one by @jw3329 in #1241
• Say plainly that Curie's secrets are only as safe as the cluster by @jw3329 in #1242
• Mask the downstream repo from the public corpus, and gate it by @jw3329 in #1248
• Give the k3s encryption steps in an order that works by @jw3329 in #1244
• Let the API be served over TLS by @jw3329 in #1245
• Deploy from a poll, for clusters that cannot receive a webhook by @jw3329 in #1246
• ADR-0094 (Draft): a bundle carries its own connector credentia...

v0.5.0

Upgrade notes

v0.5.0 is the first release under the Curie name. AgentOS is gone from the whole
surface: the CLI binary, the environment variables, the Helm chart, the
Kubernetes namespace, the container image coordinates, and the published schema
URLs. There are no compatibility aliases, and none are planned.

Nobody is running v0.4.x yet, so this is a clean break rather than a migration.
If you do have an old install on a box somewhere, uninstall it and install fresh
rather than upgrading in place.

v0.4.x	v0.5.0
agentos binary	curie
agentos-x86_64-unknown-linux-gnu, agentos-aarch64-apple-darwin	curie-x86_64-unknown-linux-gnu, curie-aarch64-apple-darwin
AGENTOS_* env vars (AGENTOS_CREDENTIALS, AGENTOS_MODEL, and the rest)	CURIE_* (CURIE_CREDENTIALS, CURIE_MODEL, and the rest)
agentos-0.4.3.tgz chart, installed as release and namespace agentos	curie-0.5.0.tgz chart, installed as release and namespace curie
ghcr.io/curie-eng/agentos-{api,dispatcher,worker,ui,runner}	ghcr.io/curie-eng/curie-{api,dispatcher,worker,ui,runner}
keyring service dev.curie.agentos	ai.curietech.curie
schema $id under https://curie.tech/agentos/	https://curietech.ai/schemas/

Two consequences worth calling out:

• Secrets saved with agentos secrets set live under the old keyring service and
  are invisible to curie secrets. Set them again.
• The wire contract went to 0.2.7. The only change is the schema $id URL, so
  anything validating a bundle against the published schema needs the new
  address.

Install

curl -fsSL https://raw.githubusercontent.com/curie-eng/curie/main/get-curie.sh | bash

The installer resolves the right binary for your platform, always checks the
sha256 against checksums.txt, and verifies the cosign signature over that
manifest when cosign is on PATH. To do it by hand, or to make the signature check
mandatory, see docs/release-verification.md.

Prebuilt binaries cover Linux x86_64 and macOS Apple silicon. Anything else
builds from source in cli/.

What was verified for this release

The live parity ladder was run against a real model (z-ai/glm-5.2) at every
rung and graded, not just checked for plumbing: the skill tier, the local
compose stack, the generated release compose, and a real Kubernetes install.
Full CI was green on the tagged commit.

Two honest gaps, both pre-existing rather than new:

• gVisor kernel isolation is untested. The verification cluster has no
  runsc runtime, so the install ran with security.gvisor.mode=off. CI's
  cluster rung has the same gap.
• Evals remain a floor rather than a ceiling. See
  ADR-0022.

---

What's Changed

• Resolve the release asset by platform in release-verification.md by @alexrao2000 in #773
• Add a reset-thread CLI verb for forced thread sandbox release by @alexrao2000 in #781
• Require an explicit allowlist of check-runs and paginate the check-run fetch by @alexrao2000 in #782
• Distinguish a zero-match namespace sweep from an actual removal and aggregate the resume command's exit status by @alexrao2000 in #783
• Release the local message Slack stub port on a timed-out turn by @alexrao2000 in #784
• Bound bundle ingestion with an upload size cap and extraction size/ratio guards by @alexrao2000 in #785
• Bound the thread-reset drain to a per-tick budget by @alexrao2000 in #777
• Declare ephemeral-storage requests and limits on every sandbox container by @alexrao2000 in #774
• Add PriorityClass so platform pods outrank sandbox pods by @alexrao2000 in #778
• Restate the release gate's trust boundary honestly by @alexrao2000 in #776
• Bound the interrupt RPC so it cannot hang the kill switch or interrupt_agent by @alexrao2000 in #780
• Set sizeLimit on every writable emptyDir in the sandbox pod by @alexrao2000 in #775
• Ship a tenant ResourceQuota and LimitRange for the sandbox namespace by @alexrao2000 in #779
• Stop the agent-sandbox controller from shadow-managing a permissive egress NetworkPolicy by @alexrao2000 in #795
• Share the GHA layer cache with e2e-ladder's image builds by @alexrao2000 in #791
• Surface plumbing rows in the eval model-sweep report by @alexrao2000 in #794
• Give the skill-tier e2e script a live-credential mode and AGENTOS_BIN support by @alexrao2000 in #792
• Discover the release credentials for cluster eval by @alexrao2000 in #793
• Add a CI gate for _AciModel model_validate call sites by @alexrao2000 in #796
• Fail an eval model sweep row loudly when a model never completes a turn by @alexrao2000 in #798
• Add a --json emit-hop parity gate for CliOutput::to_json projections by @alexrao2000 in #797
• Add a parity-ladder rung that runs against the generated release compose by @alexrao2000 in #800
• Revert the e2e-ladder image builds to plain docker build by @alexrao2000 in #803
• Quote a CI step name whose colon broke YAML parsing by @alexrao2000 in #805
• Gate the CLI's plugin_format hand-mirrors against the frozen schema by @alexrao2000 in #799
• Wait for a thread reset to actually land before reporting success by @jw3329 in #806
• Record ADR-0069: the policy-gate resume reconciliation stays observe-only by @alexrao2000 in #808
• Read a bundle .env as an opt-in, lowest-priority credential for skill up by @jw3329 in #809
• Adopt an existing non-plugin bundle: init --adopt + guide + signpost error by @jw3329 in #810
• Fix release gate refusing every tag from ci.yaml check-name drift by @TheConnMan in #820
• Guarantee a non-empty eval error on a bare timeout (#813) by @TheConnMan in #818
• Give the agent-sandbox controller the platform PriorityClass (#816) by @TheConnMan in #819
• Consolidate ADR-0039 dead-letter machinery onto StreamConsumer by @TheConnMan in #825
• Consolidate Valkey connect-and-skip test boilerplate into a shared helper by @TheConnMan in #824
• Fix four stale doc facts and consolidate duplicated getting-started content by @TheConnMan in #823
• Delete grep-verified dead Python code by @TheConnMan in #822
• Keep a multi-paragraph approval summary from breaking the CLI notice parse by @alexrao2000 in #827
• Flip thread-reset pending signal only after the release actually lands by @alexrao2000 in #826
• Scope eval sweep never-completed detection to the triggered sha by @alexrao2000 in #829
• Enforce archive member-count and incremental size caps during bundle prescan by @alexrao2000 in #828
• Add public contribution and support baseline docs by @alexrao2000 in #830
• Make the read-only tool set harness-declared for side-effect classification by @alexrao2000 in #831
• Bound and sequence eval sandbox-claim creation for single-node clusters by @alexrao2000 in #832
• Serialize thread reset against turn start under the route lock by @alexrao2000 in #834
• Add tool_called eval grader kind (ADR-0022 Phase 1) by @alexrao2000 in #837
• Render the approval card below the channel-interaction seam by @alexrao2000 in #838
• Evaluate typify for the Rust ACI types: keep the hand-rolled emitter (ADR-0072) by @alexrao2000 in #833
• Add one-command chart runtime E2E harness and require live verification for runtime-AC tickets by @alexrao2000 in #835
• Own bundle credential plumbing for the compose tier and persist Slack tokens by @alexrao2000 in #836
• Populate eval cost_usd from token usage and add variance-aware grading by @alexrao2000 in #839
• Remove the UI fixture world and add a durable-state read surface by @alexrao2000 in #842
• Publish committed, versioned JSON schemas for every agent-facing CLI result by @alexrao2000 in #841
• Expose the durable state store to bundle code by @alexrao2000 in #840
• Wire the parity ladder's cluster rung into CI on a kind cluster ...

v0.4.3

Upgrade notes

• agentos cluster down now returns the retryable exit class (3) instead of 1 when teardown
  fails for a connectivity reason, and it sweeps the namespaces it created even when
  helm uninstall fails, so compute is no longer orphaned behind an unreachable API server.
  Scripts branching on exit code 1 need updating.
• agentos local message and agentos cluster message now wait for an approval to resolve
  instead of returning as soon as the turn is parked. The wait is bounded by the existing
  --timeout-secs. Scripted callers that relied on the immediate return will now block.
• agentos cluster message no longer falls back to the dev credentials. On a default
  cluster up install it reads the release's own API key and Valkey password from the chart
  Secret; an explicit flag or env var still wins. This fixes the 401 that made the documented
  cluster round trip fail on a strong-secrets install.
• agentos skill down with no .agentos/runner.json now exits 0 instead of 1.

What's Changed

• Warn on mistaken approval-gate names; drop internal jargon from the default booting placeholder by @alexrao2000 in #719
• Give the sandbox docker-run network error an actionable remediation hint by @alexrao2000 in #720
• Add an operator command to force a fresh sandbox for a stuck thread by @alexrao2000 in #721
• Nudge new agents toward the greeting behavior pack in the scaffolded AGENTS.md by @alexrao2000 in #722
• Add agentos local rebuild to fix single-service credential loss by @alexrao2000 in #723
• Log claim latency separately from turn duration for diagnosability by @alexrao2000 in #724
• Render ConfirmIntent/ChoiceIntent's prompt in the Slack approval card by @alexrao2000 in #725
• Add a JavaScript dependency audit alongside the Rust/Python ones by @alexrao2000 in #726
• Wire AGENTOS_FALSE_COMPLETION_CHECK through the worker to every sandbox boot by @alexrao2000 in #730
• Gate the tag-triggered release pipeline on reviewed-main ancestry and green checks by @alexrao2000 in #727
• Retire e2e.sh's cluster-verb-against-compose deploy leg by @alexrao2000 in #728
• Add an env-var image/tag override for compose.dev.yaml's api, migrate, and worker services by @alexrao2000 in #729
• Bound the thread-reset interrupt so a wedged sandbox still releases by @TheConnMan in #744
• Correct the approval-gate built-in tool recognition set by @TheConnMan in #741
• Fix the release authorization gate so a valid tag can publish by @TheConnMan in #740
• Record ADR-0059: the sandbox is a bounded resource envelope by @TheConnMan in #754
• Make the install snippets platform-aware and lead onboarding with the offline path by @TheConnMan in #753
• Exclude venvs, caches and ignore-file entries from plugin bundles by @TheConnMan in #762
• Record a package-shaped redesign of the harness-adapter seam by @TheConnMan in #763
• Make a leftover runner container recoverable from the CLI by @TheConnMan in #764
• Keep the message reply surface alive until the approval resumes by @TheConnMan in #772
• Fail-forward cluster down teardown on an unreachable API server by @TheConnMan in #769
• Add list-agents and deploy-local, plus a bundle picker for Deploy to Slack by @alexrao2000 in #731
• Guard every publishing job the ancestor-graph skip reached by @TheConnMan in #788
• Discover the release credentials for cluster message by @TheConnMan in #789

Full Changelog: v0.4.2...v0.4.3

v0.4.2

What's Changed

• Fix approval-gate shorthand fail-open and complete local approvals offline by @TheConnMan in #710
• Fix four cold-start-surfaced cluster/CLI defects (#704-707) by @TheConnMan in #711

Full Changelog: v0.4.1...v0.4.2

v0.4.1

What's Changed

• Unify shell_quote + duplicated CLI helpers by @alexrao2000 in #564
• Cluster governance verbs resolve the release's API URL + key by @alexrao2000 in #565
• local/cluster approvals reports the manifest-armed gates too by @alexrao2000 in #566
• Canonical env-var names for API base URL + model credential by @alexrao2000 in #567
• Gate against duplicate ADR numbers in CI by @alexrao2000 in #568
• init --from-spec can express approvalPolicy and secrets by @alexrao2000 in #569
• Reserve redirect/capture-capable env from connector secrets by @alexrao2000 in #570
• Warn when a local/cluster message turn ends awaiting approval by @alexrao2000 in #571
• Extract one shared path-style S3 client builder by @alexrao2000 in #572
• Delete vestigial dead code: ClaimView.labels + CLI runner-control client by @alexrao2000 in #573
• Worker: fall back to the default transport when a resumed reply endpoint is unreachable by @alexrao2000 in #574
• Fix architecture-vision Job numbering and move SandboxClient off the k8s adapter by @alexrao2000 in #575
• Drop the write-only Deployment.bot_identity column by @alexrao2000 in #576
• Fixture-gate the mirrored plugin-format name + mcp rules by @alexrao2000 in #577
• Gate the Rust channel adapter's field bounds against the committed schema by @alexrao2000 in #578
• Age the Slack usergroup cache on a monotonic clock by @alexrao2000 in #579
• Structure operator, deploy, and skill-message output under --json by @alexrao2000 in #580
• Wire the offline soak harness into CI and de-flake the sweeper test by @alexrao2000 in #581
• Classify a controller lease timeout distinctly from an RBAC failure by @alexrao2000 in #582
• Resolve policy-gate routes on the fake-model tier too by @alexrao2000 in #583
• Distinguish unknown cost from $0.00 and drop eval traces from the summary by @alexrao2000 in #584
• Gate model-credential forwarding on a cross-language vector matrix by @TheConnMan in #602
• BYO models: declared api_backend enum + env_key string-or-array by @TheConnMan in #605
• Emit structured JSON from init under --json by @TheConnMan in #590
• Fix controller preflight log glue and crash-loop hint leak by @TheConnMan in #617
• Move substrate-neutral label constants out of the k8s adapter by @TheConnMan in #616
• Disclose an unreadable deployed manifest in approvals output by @TheConnMan in #623
• Share the eval and approval wire DTOs and queue transport literals by @TheConnMan in #624
• Accept ADR-0042: adopt the LLM-as-a-Verifier semantic grader by @TheConnMan in #638
• Raise critical dead letter alerts by @TheConnMan in #643
• Arm a declared approval policy exactly as declared, or refuse to boot by @TheConnMan in #641
• Redact secrets at the runner stdout and gen_ai span boundaries by @TheConnMan in #640
• Watch the dead-letter graveyard and alert on each new entry by @alexrao2000 in #596
• Bump the github-actions group with 4 updates by @dependabot[bot] in #597
• Migrate the non-streaming ADR-0021 --json builders to Ui::emit by @alexrao2000 in #594
• Add a release-version consistency gate and agentos dev bump-version by @alexrao2000 in #593
• Add parity gates for behavior-pack pairs and eval-case mirrors by @alexrao2000 in #592
• Extract the sandbox hardening securityContext helpers and render-assert them by @alexrao2000 in #591
• Add an opt-in runner false-completion check by @alexrao2000 in #588
• Exercise all five extension fields against the plugin-compat gate by @alexrao2000 in #587
• Doc hygiene: retire expiring assertions and fix stale governing-rule refs by @alexrao2000 in #586
• Bump the cargo group across 1 directory with 5 updates by @dependabot[bot] in #598
• Bump the python group with 7 updates by @dependabot[bot] in #600
• Cap eval-stream delivery and dead-letter exhausted evals by @alexrao2000 in #585
• First-class local approval verbs: list pending, resolve as an actor by @alexrao2000 in #595
• Update boto3-stubs[s3] requirement from >=1.43.45 to >=1.43.50 by @dependabot[bot] in #601
• Bump the pnpm group in /apps/ui with 17 updates by @dependabot[bot] in #599
• Eval cases run in a fresh conversation by default by @TheConnMan in #651
• Backstop dead-lettered resume turns in the reconciler by @TheConnMan in #650
• Scope the model sweep poll to the run it just triggered (#608) by @TheConnMan in #648
• Declare pydantic-settings dependency in aci-protocol by @TheConnMan in #646
• Give approval polls independent deadlines by @TheConnMan in #647
• Checksum, sign, and attest every downloadable release asset by @TheConnMan in #642
• Assert gate-blocked terminal status in eval cases (#262) by @TheConnMan in #649
• Accept spelled-out degrees in the weather eval grader (stopgap for #618) by @TheConnMan in #659
• Consolidate dispatcher Socket Mode test doubles by @alexrao2000 in #652
• Centralize Python plugin manifest resolution by @alexrao2000 in #653
• Point test_wire_lock's write_lock check at a tmp path by @alexrao2000 in #654
• Bound the GitHub webhook body before authentication by @alexrao2000 in #655
• Fix three drifted seam docs and gate link-target drift by @alexrao2000 in #656
• Disclose failed or partial runner reaps in local down by @alexrao2000 in #658
• Share the eval stream and consumer-group literals by @alexrao2000 in #660
• Dial runner by shared-network container IP on the docker substrate by @alexrao2000 in #664
• Add a guide landmine on autonomous non-secret setup by @alexrao2000 in #665
• Leave a fake-model eval run unlabelled, not tagged with an uncalled model by @alexrao2000 in #666
• Add a CI falsifiability gate for the committed eval cases by @TheConnMan in #662
• Gate documented dataclass field lists against the code (follow-up to #656) by @TheConnMan in #661
• Harden local Docker runner isolation by @TheConnMan in #663
• Make the fake model a plumbing fixture, not a subject under test by @TheConnMan in #644
• Freeze the worker-to-runner boot-env contract and generate its env keys by @TheConnMan in #639
• Honor AGENTOS_DEAD_LETTER_STREAM/AGENTOS_STREAM in the API graveyard watcher by @TheConnMan in #677
• Resolve root-relative and external-URL hrefs in the doclint citation gate by @TheConnMan in #676
• approvals --list requests server-max limit and signals truncation by @TheConnMan in #675
• Migrate skill-check manifest read to the shared resolver (#671) by @TheConnMan in #674
• Operator opt-in for policy-gate tool grantability (grantableViaPolicy) by @TheConnMan in #667
• Isolate per-entry handler errors in the worker consume loop by @TheConnMan in #686
• Mint runner state refs from a runner-facing API base by @TheConnMan in #685
• Route the ADR-0021 message builders through Ui::emit by @TheConnMan in #684
• Keep the runner turn lock from wedging on a cross-task close by @TheConnMan in https://github.com/...

v0.4.0

What's Changed

• guide: document gVisor fail-closed opt-out on no-runsc cluster by @TheConnMan in #364
• cluster up honors AGENTOS_MODEL for runner-model parity by @TheConnMan in #365
• message --json: structured stdout for timeout and dry-run terminal states by @alexrao2000 in #367
• cliCommand(): manifest-typed console/CLI command resolver by @alexrao2000 in #368
• docs: surface the parity-pain queries for agent-driven discoverability by @alexrao2000 in #370
• eval: pluggable scorer seam above the port + tier-1 trajectory matcher by @alexrao2000 in #372
• local eval / cluster eval: the same evals at every tier (parity gate) by @alexrao2000 in #371
• Console/CLI parity: attach cliCommand hints to wired surfaces (#279) by @alexrao2000 in #374
• Console/CLI parity: parity test + honest noCliEquivalent state + sync invariants (#280) by @alexrao2000 in #375
• Bundle format: system prompt in the bundle manifest (#271) by @alexrao2000 in #376
• Bundle format: consume the manifest hooks field (PreToolUse guardrails) (#272) by @alexrao2000 in #377
• Bundle format: approval-policy + trigger declarations in the manifest (#273) by @alexrao2000 in #378
• memory: implement the memory port (load/append + provenance) [#264] by @alexrao2000 in #379
• storage: extract the ObjectStore port; defer the second adapter [#282] by @alexrao2000 in #380
• queue-stream: extract a thin broker port at the non-sacred seams [#284] by @alexrao2000 in #381
• cli: guided eval generation interview (agentos skill eval-init) by @alexrao2000 in #383
• docs/adr: substrate is a resilience-only fallback, not a product swap axis by @alexrao2000 in #384
• docs/design: multi-dev shared-cluster design pass by @alexrao2000 in #385
• memory: learned-from provenance trace-back (#266) by @alexrao2000 in #387
• memory: consolidation pipeline (#265) by @alexrao2000 in #386
• evals: model dimension on the eval matrix + prompt-cache smoke test by @alexrao2000 in #382
• memory: inspect/edit/delete learned memory (API + UI) (#267) by @alexrao2000 in #388
• Explicit provider egress for cluster up (#362) by @TheConnMan in #366
• Add ADR-0009: harness-neutral runner seams by @TheConnMan in #306
• Propose ADR-0022: eval completeness (tier parity, trajectory graders, trace promotion) by @TheConnMan in #345
• ui: regenerate command manifest for cluster-up egress flags by @TheConnMan in #396
• Resolve duplicate ADR numbers 0009 and 0025 by @TheConnMan in #395
• Enforce CLI hint parity registry coverage by @TheConnMan in #398
• Guard memory mutations with versions by @TheConnMan in #397
• Authed MCP example + skill-up config: --secret, .env loading, credential preflight, install.sh by @alexrao2000 in #401
• Rehydrate a thread's conversation across unplanned runner restarts by @yichenzhang-curietech in #402
• Harden git-flow image and API conflict/report paths by @jw3329 in #403
• Add interactive AgentOS terminal UI by @alexrao2000 in #404
• Add durable Approval record and awaiting-approval suspend/resume lifecycle by @yichenzhang-curietech in #406
• Add canUseTool permission gate replacing the hardcoded bypass by @yichenzhang-curietech in #407
• Add Block Kit approval cards with server-side authorizer and click-to-resolve by @yichenzhang-curietech in #408
• Add approval-policy routes and the platform audit log by @yichenzhang-curietech in #409
• Guide MCP auth example from interactive UI by @alexrao2000 in #405
• Backstop stranded approval resumes with a reconciler by @TheConnMan in #416
• Approval + authed-MCP review follow-ups (#413) by @TheConnMan in #415
• Scope the sandbox state credential (ADR-0033) by @TheConnMan in #414
• Add approval SLA expiry sweeper and resolve-path resume by @TheConnMan in #417
• Backstop expiry wakeups in the resume reconciler by @TheConnMan in #421
• Unfuse the approval approver set from the route's channel by @TheConnMan in #423
• Auto-mark prerelease GitHub Releases for -rc tags by @TheConnMan in #427
• Interactive TUI + keychain secrets: guided authed-MCP flow, with the github-issues example by @alexrao2000 in #431
• Declare aci-protocol dep on the dispatcher and smoke-test its image by @TheConnMan in #434
• Docs: arm approval gates with the fully-namespaced tool name by @TheConnMan in #433
• One-shot post-approval allowance at resume boot (#430) by @TheConnMan in #437
• ADR-0009: accept per-agent connector-secret design (#429) by @alexrao2000 in #435
• plugin-format: secrets policy field (#429) by @alexrao2000 in #436
• cluster: per-agent connector-secret Secret + render assertions (#429) by @alexrao2000 in #439
• local tier: per-agent connector secret delivery (#429) by @alexrao2000 in #438
• Add agentos update: self-reinstall the CLI from the checkout by @alexrao2000 in #443
• install.sh: always rebuild the CLI (drop the mtime skip heuristic) by @alexrao2000 in #444
• Reject reserved AGENTOS_* connector-secret names by @alexrao2000 in #445
• Platform CLI verbs: versions/memory/approvals/observability (local + cluster) by @alexrao2000 in #446
• TUI: lead with a "Platform" tab of the primary product functions by @alexrao2000 in #448
• TUI: guided "Deploy to Slack" workflow (local + cluster) by @alexrao2000 in #441
• TUI: collapse the two Deploy-to-Slack recipes into one tier prompt by @alexrao2000 in #449
• AGENTS.md: mandate local-stack cleanup and worktree-based test edits by @TheConnMan in #472
• Adopt semver for the ACI, true the version to 0.2.0, and enforce compatibility by @TheConnMan in #471
• Close two approval-seam defects: silent fail-open gates and collapsed 403 reasons by @TheConnMan in #470
• Wire the dispatcher to the platform API and gate boot on it by @TheConnMan in #469
• Post route-bound approval cards over the default transport by @TheConnMan in #468
• Share model resolution between local up and local comms by @TheConnMan in #467
• docs: ADR-0029 adopt LLM-as-a-Verifier (grader + progress signal) by @TheConnMan in #393
• docs: ADR-0030 proactive within-episode memory agent by @TheConnMan in #394
• ADR-0037: agent-facing observability CLI helper by @TheConnMan in #479
• ADR-0037: opt-in binding hook and Pareto model routing by @TheConnMan in #480
• Fix TUI tab visibility and repo-root detection for Deploy-to-Slack by @TheConnMan in #481
• Document macOS Gatekeeper workaround for the release binary by @TheConnMan in #482
• Renumber observability ADR 0037 -> 0038 (collision with model-routing ADR) by @TheConnMan in #483
• Emit structured JSON under --json for every agent-facing verb by @TheConnMan in #503
• Reserve model-credential env names for connector secrets by @TheConnMan in #486
• Correct the drifted interface catalog and gate it against re-rot by @TheConnMan in #484
• Pin the duplicated CONNECTOR_SECRET_KEYS_ENV literal by @TheConnMan in #504
• Enforce plugin manifest secrets policy at deploy time by @TheCO...

v0.4.0-rc.4

What's Changed

• docs: ADR-0029 adopt LLM-as-a-Verifier (grader + progress signal) by @TheConnMan in #393
• docs: ADR-0030 proactive within-episode memory agent by @TheConnMan in #394
• ADR-0037: agent-facing observability CLI helper by @TheConnMan in #479
• ADR-0037: opt-in binding hook and Pareto model routing by @TheConnMan in #480
• Fix TUI tab visibility and repo-root detection for Deploy-to-Slack by @TheConnMan in #481
• Document macOS Gatekeeper workaround for the release binary by @TheConnMan in #482
• Renumber observability ADR 0037 -> 0038 (collision with model-routing ADR) by @TheConnMan in #483
• Emit structured JSON under --json for every agent-facing verb by @TheConnMan in #503
• Reserve model-credential env names for connector secrets by @TheConnMan in #486
• Correct the drifted interface catalog and gate it against re-rot by @TheConnMan in #484
• Pin the duplicated CONNECTOR_SECRET_KEYS_ENV literal by @TheConnMan in #504
• Enforce plugin manifest secrets policy at deploy time by @TheConnMan in #510
• Gate the TUI recipe catalog against the clap grammar (#462) by @TheConnMan in #509
• Add ADR-0039: workflow-controlled agents run on AgentOS as a callable substrate by @TheConnMan in #511
• Add ADR-0040: adopt ACP as an edge projection by @TheConnMan in #522
• Make the TUI Platform tab governance recipes tier-aware (#463) by @TheConnMan in #525
• Share one AgentTarget args struct across local and cluster tiers by @TheConnMan in #523
• Accept ADR-0022 and rewrite it to match the code as a build spec by @TheConnMan in #528
• Add a cluster observability twin behind one tier-aware endpoint seam by @TheConnMan in #534
• Bound stream delivery with a cap and a dead-letter graveyard by @TheConnMan in #536
• Gate outbound Claude Code plugin compatibility in CI by @TheConnMan in #537

Full Changelog: v0.4.0-rc.3...v0.4.0-rc.4

v0.4.0-rc.3

What's Changed

• ADR-0009: accept per-agent connector-secret design (#429) by @alexrao2000 in #435
• plugin-format: secrets policy field (#429) by @alexrao2000 in #436
• cluster: per-agent connector-secret Secret + render assertions (#429) by @alexrao2000 in #439
• local tier: per-agent connector secret delivery (#429) by @alexrao2000 in #438
• Add agentos update: self-reinstall the CLI from the checkout by @alexrao2000 in #443
• install.sh: always rebuild the CLI (drop the mtime skip heuristic) by @alexrao2000 in #444
• Reject reserved AGENTOS_* connector-secret names by @alexrao2000 in #445
• Platform CLI verbs: versions/memory/approvals/observability (local + cluster) by @alexrao2000 in #446
• TUI: lead with a "Platform" tab of the primary product functions by @alexrao2000 in #448
• TUI: guided "Deploy to Slack" workflow (local + cluster) by @alexrao2000 in #441
• TUI: collapse the two Deploy-to-Slack recipes into one tier prompt by @alexrao2000 in #449
• AGENTS.md: mandate local-stack cleanup and worktree-based test edits by @TheConnMan in #472
• Adopt semver for the ACI, true the version to 0.2.0, and enforce compatibility by @TheConnMan in #471
• Close two approval-seam defects: silent fail-open gates and collapsed 403 reasons by @TheConnMan in #470
• Wire the dispatcher to the platform API and gate boot on it by @TheConnMan in #469
• Post route-bound approval cards over the default transport by @TheConnMan in #468
• Share model resolution between local up and local comms by @TheConnMan in #467

Full Changelog: v0.4.0-rc.2...v0.4.0-rc.3

v0.4.0-rc.2

What's Changed

• Auto-mark prerelease GitHub Releases for -rc tags by @TheConnMan in #427
• Interactive TUI + keychain secrets: guided authed-MCP flow, with the github-issues example by @alexrao2000 in #431
• Declare aci-protocol dep on the dispatcher and smoke-test its image by @TheConnMan in #434
• Docs: arm approval gates with the fully-namespaced tool name by @TheConnMan in #433
• One-shot post-approval allowance at resume boot (#430) by @TheConnMan in #437

Full Changelog: v0.4.0-rc.1...v0.4.0-rc.2

v0.4.0-rc.1

What's Changed

• guide: document gVisor fail-closed opt-out on no-runsc cluster by @TheConnMan in #364
• cluster up honors AGENTOS_MODEL for runner-model parity by @TheConnMan in #365
• message --json: structured stdout for timeout and dry-run terminal states by @alexrao2000 in #367
• cliCommand(): manifest-typed console/CLI command resolver by @alexrao2000 in #368
• docs: surface the parity-pain queries for agent-driven discoverability by @alexrao2000 in #370
• eval: pluggable scorer seam above the port + tier-1 trajectory matcher by @alexrao2000 in #372
• local eval / cluster eval: the same evals at every tier (parity gate) by @alexrao2000 in #371
• Console/CLI parity: attach cliCommand hints to wired surfaces (#279) by @alexrao2000 in #374
• Console/CLI parity: parity test + honest noCliEquivalent state + sync invariants (#280) by @alexrao2000 in #375
• Bundle format: system prompt in the bundle manifest (#271) by @alexrao2000 in #376
• Bundle format: consume the manifest hooks field (PreToolUse guardrails) (#272) by @alexrao2000 in #377
• Bundle format: approval-policy + trigger declarations in the manifest (#273) by @alexrao2000 in #378
• memory: implement the memory port (load/append + provenance) [#264] by @alexrao2000 in #379
• storage: extract the ObjectStore port; defer the second adapter [#282] by @alexrao2000 in #380
• queue-stream: extract a thin broker port at the non-sacred seams [#284] by @alexrao2000 in #381
• cli: guided eval generation interview (agentos skill eval-init) by @alexrao2000 in #383
• docs/adr: substrate is a resilience-only fallback, not a product swap axis by @alexrao2000 in #384
• docs/design: multi-dev shared-cluster design pass by @alexrao2000 in #385
• memory: learned-from provenance trace-back (#266) by @alexrao2000 in #387
• memory: consolidation pipeline (#265) by @alexrao2000 in #386
• evals: model dimension on the eval matrix + prompt-cache smoke test by @alexrao2000 in #382
• memory: inspect/edit/delete learned memory (API + UI) (#267) by @alexrao2000 in #388
• Explicit provider egress for cluster up (#362) by @TheConnMan in #366
• Add ADR-0009: harness-neutral runner seams by @TheConnMan in #306
• Propose ADR-0022: eval completeness (tier parity, trajectory graders, trace promotion) by @TheConnMan in #345
• ui: regenerate command manifest for cluster-up egress flags by @TheConnMan in #396
• Resolve duplicate ADR numbers 0009 and 0025 by @TheConnMan in #395
• Enforce CLI hint parity registry coverage by @TheConnMan in #398
• Guard memory mutations with versions by @TheConnMan in #397
• Authed MCP example + skill-up config: --secret, .env loading, credential preflight, install.sh by @alexrao2000 in #401
• Rehydrate a thread's conversation across unplanned runner restarts by @yichenzhang-curietech in #402
• Harden git-flow image and API conflict/report paths by @jw3329 in #403
• Add interactive AgentOS terminal UI by @alexrao2000 in #404
• Add durable Approval record and awaiting-approval suspend/resume lifecycle by @yichenzhang-curietech in #406
• Add canUseTool permission gate replacing the hardcoded bypass by @yichenzhang-curietech in #407
• Add Block Kit approval cards with server-side authorizer and click-to-resolve by @yichenzhang-curietech in #408
• Add approval-policy routes and the platform audit log by @yichenzhang-curietech in #409
• Guide MCP auth example from interactive UI by @alexrao2000 in #405
• Backstop stranded approval resumes with a reconciler by @TheConnMan in #416
• Approval + authed-MCP review follow-ups (#413) by @TheConnMan in #415
• Scope the sandbox state credential (ADR-0033) by @TheConnMan in #414
• Add approval SLA expiry sweeper and resolve-path resume by @TheConnMan in #417
• Backstop expiry wakeups in the resume reconciler by @TheConnMan in #421
• Unfuse the approval approver set from the route's channel by @TheConnMan in #423

Full Changelog: v0.3.1...v0.4.0-rc.1