v0.4.1

What's Changed

• Unify shell_quote + duplicated CLI helpers by @alexrao2000 in #564
• Cluster governance verbs resolve the release's API URL + key by @alexrao2000 in #565
• local/cluster approvals reports the manifest-armed gates too by @alexrao2000 in #566
• Canonical env-var names for API base URL + model credential by @alexrao2000 in #567
• Gate against duplicate ADR numbers in CI by @alexrao2000 in #568
• init --from-spec can express approvalPolicy and secrets by @alexrao2000 in #569
• Reserve redirect/capture-capable env from connector secrets by @alexrao2000 in #570
• Warn when a local/cluster message turn ends awaiting approval by @alexrao2000 in #571
• Extract one shared path-style S3 client builder by @alexrao2000 in #572
• Delete vestigial dead code: ClaimView.labels + CLI runner-control client by @alexrao2000 in #573
• Worker: fall back to the default transport when a resumed reply endpoint is unreachable by @alexrao2000 in #574
• Fix architecture-vision Job numbering and move SandboxClient off the k8s adapter by @alexrao2000 in #575
• Drop the write-only Deployment.bot_identity column by @alexrao2000 in #576
• Fixture-gate the mirrored plugin-format name + mcp rules by @alexrao2000 in #577
• Gate the Rust channel adapter's field bounds against the committed schema by @alexrao2000 in #578
• Age the Slack usergroup cache on a monotonic clock by @alexrao2000 in #579
• Structure operator, deploy, and skill-message output under --json by @alexrao2000 in #580
• Wire the offline soak harness into CI and de-flake the sweeper test by @alexrao2000 in #581
• Classify a controller lease timeout distinctly from an RBAC failure by @alexrao2000 in #582
• Resolve policy-gate routes on the fake-model tier too by @alexrao2000 in #583
• Distinguish unknown cost from $0.00 and drop eval traces from the summary by @alexrao2000 in #584
• Gate model-credential forwarding on a cross-language vector matrix by @TheConnMan in #602
• BYO models: declared api_backend enum + env_key string-or-array by @TheConnMan in #605
• Emit structured JSON from init under --json by @TheConnMan in #590
• Fix controller preflight log glue and crash-loop hint leak by @TheConnMan in #617
• Move substrate-neutral label constants out of the k8s adapter by @TheConnMan in #616
• Disclose an unreadable deployed manifest in approvals output by @TheConnMan in #623
• Share the eval and approval wire DTOs and queue transport literals by @TheConnMan in #624
• Accept ADR-0042: adopt the LLM-as-a-Verifier semantic grader by @TheConnMan in #638
• Raise critical dead letter alerts by @TheConnMan in #643
• Arm a declared approval policy exactly as declared, or refuse to boot by @TheConnMan in #641
• Redact secrets at the runner stdout and gen_ai span boundaries by @TheConnMan in #640
• Watch the dead-letter graveyard and alert on each new entry by @alexrao2000 in #596
• Bump the github-actions group with 4 updates by @dependabot[bot] in #597
• Migrate the non-streaming ADR-0021 --json builders to Ui::emit by @alexrao2000 in #594
• Add a release-version consistency gate and agentos dev bump-version by @alexrao2000 in #593
• Add parity gates for behavior-pack pairs and eval-case mirrors by @alexrao2000 in #592
• Extract the sandbox hardening securityContext helpers and render-assert them by @alexrao2000 in #591
• Add an opt-in runner false-completion check by @alexrao2000 in #588
• Exercise all five extension fields against the plugin-compat gate by @alexrao2000 in #587
• Doc hygiene: retire expiring assertions and fix stale governing-rule refs by @alexrao2000 in #586
• Bump the cargo group across 1 directory with 5 updates by @dependabot[bot] in #598
• Bump the python group with 7 updates by @dependabot[bot] in #600
• Cap eval-stream delivery and dead-letter exhausted evals by @alexrao2000 in #585
• First-class local approval verbs: list pending, resolve as an actor by @alexrao2000 in #595
• Update boto3-stubs[s3] requirement from >=1.43.45 to >=1.43.50 by @dependabot[bot] in #601
• Bump the pnpm group in /apps/ui with 17 updates by @dependabot[bot] in #599
• Eval cases run in a fresh conversation by default by @TheConnMan in #651
• Backstop dead-lettered resume turns in the reconciler by @TheConnMan in #650
• Scope the model sweep poll to the run it just triggered (#608) by @TheConnMan in #648
• Declare pydantic-settings dependency in aci-protocol by @TheConnMan in #646
• Give approval polls independent deadlines by @TheConnMan in #647
• Checksum, sign, and attest every downloadable release asset by @TheConnMan in #642
• Assert gate-blocked terminal status in eval cases (#262) by @TheConnMan in #649
• Accept spelled-out degrees in the weather eval grader (stopgap for #618) by @TheConnMan in #659
• Consolidate dispatcher Socket Mode test doubles by @alexrao2000 in #652
• Centralize Python plugin manifest resolution by @alexrao2000 in #653
• Point test_wire_lock's write_lock check at a tmp path by @alexrao2000 in #654
• Bound the GitHub webhook body before authentication by @alexrao2000 in #655
• Fix three drifted seam docs and gate link-target drift by @alexrao2000 in #656
• Disclose failed or partial runner reaps in local down by @alexrao2000 in #658
• Share the eval stream and consumer-group literals by @alexrao2000 in #660
• Dial runner by shared-network container IP on the docker substrate by @alexrao2000 in #664
• Add a guide landmine on autonomous non-secret setup by @alexrao2000 in #665
• Leave a fake-model eval run unlabelled, not tagged with an uncalled model by @alexrao2000 in #666
• Add a CI falsifiability gate for the committed eval cases by @TheConnMan in #662
• Gate documented dataclass field lists against the code (follow-up to #656) by @TheConnMan in #661
• Harden local Docker runner isolation by @TheConnMan in #663
• Make the fake model a plumbing fixture, not a subject under test by @TheConnMan in #644
• Freeze the worker-to-runner boot-env contract and generate its env keys by @TheConnMan in #639
• Honor AGENTOS_DEAD_LETTER_STREAM/AGENTOS_STREAM in the API graveyard watcher by @TheConnMan in #677
• Resolve root-relative and external-URL hrefs in the doclint citation gate by @TheConnMan in #676
• approvals --list requests server-max limit and signals truncation by @TheConnMan in #675
• Migrate skill-check manifest read to the shared resolver (#671) by @TheConnMan in #674
• Operator opt-in for policy-gate tool grantability (grantableViaPolicy) by @TheConnMan in #667
• Isolate per-entry handler errors in the worker consume loop by @TheConnMan in #686
• Mint runner state refs from a runner-facing API base by @TheConnMan in #685
• Route the ADR-0021 message builders through Ui::emit by @TheConnMan in #684
• Keep the runner turn lock from wedging on a cross-task close by @TheConnMan in #683
• Hoist shared docker test fakes into sandbox conftest by @TheConnMan in #681
• Advertise local reply stub at a VM-reachable host under Docker Desktop by @TheConnMan in #682
• Disable the expired approval card on the worker by @TheConnMan in #688
• Drop an OAuth-shaped BYO credential under a base-URL override by @TheConnMan in #687
• Add parity-seam registry and guard/test discipline rules to AGENTS.md by @TheConnMan in #689
• Add a cold-start parity ladder as agentos dev e2e-ladder by @TheConnMan in #696
• Add --json field-parity gate for CLI API-mirror structs by @TheConnMan in #702

Full Changelog: v0.4.0...v0.4.1