zWorkforce v3.0.3

What's Changed

• Resign latest commit by @cvsz in #52
• Fix release publishing without MSIX signing secrets by @cvsz in #53
• Add manual container publish workflow by @cvsz in #54
• Update setup script for release image by @cvsz in #55
• Prune ZARVIS package boundary by @cvsz in #56
• Harden cross-platform validation by @cvsz in #57
• Fix release without Windows artifacts by @cvsz in #58
• Update GitHub operations documentation by @cvsz in #59
• Update production readiness execution plan by @cvsz in #60
• Update roadmap for current release baseline by @cvsz in #61
• Refresh Markdown documentation links by @cvsz in #62
• Add ProMeta master agent model by @cvsz in #63
• Add ProMeta skills and agent seeds by @cvsz in #64
• Complete ProMeta runtime install flow by @cvsz in #65
• Expose ProMeta install in MCP and dashboard by @cvsz in #66
• refresh zWorkforce WinUI frontend shell and overview by @cvsz in #67
• prepare zWorkforce v3.0.3 production-readiness candidate by @cvsz in #68
• feat: plan Z.A.R.V.I.S. voice, skills and agent upgrade by @cvsz in #69
• feat: add Z.A.R.V.I.S. dashboard push-to-talk by @cvsz in #70
• refactor: share Z.A.R.V.I.S. realtime voice client by @cvsz in #71
• feat(coder): integrate native zWorkforce local coding agent and provider by @cvsz in #72
• chore(deps): bump the npm_and_yarn group across 2 directories with 10 updates by @dependabot[bot] in #75
• feat(zworkforce): apply full skills/agents coverage, zider suite, and studio dashboard redesign by @cvsz in #76
• feat(packages): redesign UI/UX theme styles across zider, zarvis, and studio packages by @cvsz in #77
• style(zider): polish extension sidebar CSS with modern dark tokens and micro-interactions by @cvsz in #78
• chore: organize planning docs and install scripts into subdirectories by @cvsz in #79
• docs: add autonomous hourly completion loop prompts by @cvsz in #80
• docs: reconcile zWorkforce production-readiness plan by @cvsz in #81
• Feat/chore monorepo cleanup by @cvsz in #82
• Feat/workspace context commands by @cvsz in #85
• fix(zider): resolve CodeQL SSRF alert #11 in summarizer service by @cvsz in #86
• fix(planning): resolve merged conflict markers by @cvsz in #87
• fix(security): resolve CodeQL SSRF alert #12 and workflow permissions alert #13 by @cvsz in #88
• feat(workspace): add durable context snapshots and compaction by @cvsz in #89
• feat(workspace): expose authenticated context API by @cvsz in #90
• fix(workspace): reserve context summaries for compact scope by @cvsz in #92
• feat(workspace): add authorized slash command registry by @cvsz in #93
• feat(workspace): add task evidence sidecar projection by @cvsz in #95
• feat(workspace): add durable tenant-scoped workspace grants by @cvsz in #96
• feat(workspace): enforce durable grants on local file tools by @cvsz in #97
• chore(deps): bump uvicorn from 0.52.1 to 0.52.3 in /packages/zarvis/services/zarvis-api by @dependabot[bot] in #94
• feat(sandbox): add probed production process containment by @cvsz in #98
• feat(workspace): add grant-bounded Git worktree adapter core by @cvsz in #99
• docs(router): add OpenRouter and multi-model router roadmap and execution plan by @cvsz in #101
• feat(workspace): bind Git worktrees to tenant grants and audit by @cvsz in #100
• Feat/r12 r13 acp safety upgrades by @cvsz in #103
• feat(workspace): add durable Git worktree lifecycle by @cvsz in #102
• feat(router): add smart model variant slugs and capability resolution by @cvsz in #104
• feat(ui): add slash command autocomplete and server resolution in dispatch console by @cvsz in #105
• feat(engine): add automatic doom-loop detection for repetitive and failing tool cycles by @cvsz in #106
• feat(connectors): add social media and e-commerce provider shop connectors (shopee, tiktok seller, facebook) by @cvsz in #107
• docs(planning): update ROADMAPS and exec plans with R14 universal plugin ecosystem (free-model-first) by @cvsz in #108
• docs(prompts): add Loop E universal plugin & connector automation to prompt registry by @cvsz in #109
• fix(tests): support standalone PYTHONPATH=. execution in test_connectors by @cvsz in #110
• chore(auto): quad-loop e2e cycle 2026-08-17T05:25Z by @cvsz in #111
• chore(auto): quad-loop e2e cycle 2026-08-17T05:32Z — extend all plans to Phase 3+4 by @cvsz in #112
• feat(scripts): automated quad-loop cron runner (every 6h) by @cvsz in #114
• feat(zwf): implement Phase 3 OTLP telemetry and Phase 4 typed agent handoff protocol by @cvsz in #115
• feat(zarvis): implement Phase 1 Gemini Live/Realtime voice engine and Phase 3 VAD tuning by @cvsz in #116
• feat(zeto,zwf): implement Zeto QA/SEO engine and ZWF secure MCP reverse tunnel by @cvsz in #117
• feat(skywork): implement Phase 3 structured citation validator and Phase 4 A2A discovery manifest by @cvsz in #119
• feat(zsp,zwf): implement ZSP real-time timeline collaboration and ZWF ACP protocol server by @cvsz in #120
• feat(zarvis,zred): implement Zarvis multi-language caption overlay and zRed SARIF triage + secret canary by @cvsz in #121
• docs(planning): update master autonomous upgrades roadmap and subsystem completion matrix by @cvsz in #122
• feat(omnibus): implement all remaining phases across Skywork, Zeto, Zider, and ZSP-AITool by @cvsz in #123
• fix(install,zider): support PEP 668 external python env in setup.sh and add build script to zider package.json by @cvsz in #127
• feat(workspace): add explicitly authorized worktree commits by @cvsz in #113
• feat(workspace): implement SW6 governed GitHub PR handoff boundary by @cvsz in #133
• feat(zider): add fail-closed governed browser action contract by @cvsz in #134
• fix(tests): filter upstream StarletteDeprecationWarning on TestClient imports by @cvsz in #136
• fix(zider): fail closed when zWorkforce control plane is unavailable by @cvsz in #135
• feat(zider): add pinned production browser executor boundary by @cvsz in #138
• feat(zider): wire guarded Playwright read-only runtime by @cvsz in #139
• chore(auto): quad-loop cron cycle 2026-08-17T12:30Z by @cvsz in #137
• feat(deploy): rename moopiew-cloudflared.service to core-cloudflared.service by @cvsz in #132
• feat(infra): centralize all Cloudflare Terraform definitions and systemd templates into zworkforce by @cvsz in #131
• feat(deploy): consolidate all Cloudflare tunnel and Caddy ingress manifests under zworkforce/deploy by @cvsz in #130
• feat(zctl): implement targeted build, install, start, stop, restart for all packages by @cvsz in #129
• feat(zider): add Manifest V3 CSP invariant test and context menu test by @cvsz in #128
• feat(zarvis): implement native WinUI 3 background audio capture and global system hotkey VoiceService by @cvsz in #125
• Chore/auto quad loop 2026 08 17 t1830 z by @cvsz in #140
• feat(zctl): expand Go control panel to cover all packages/* directories by @cv...

zWorkforce v3.0.2

3.0.2 - 2026-08-09

Windows client and operations

• Added the packaged Windows 11 operator client with complete REST service-layer route coverage.
• Enforced HTTPS for non-local client connections and protected API-key transport.
• Made MSIX smoke-test certificate trust cleanup deterministic and verified.
• Documented https://zwf.zeaz.dev as the production Workforce control-plane endpoint.

Release status

• Python distribution, checksum, and SBOM artifacts are attached.
• Windows MSIX artifacts are not attached because the automated Windows release job requires trusted MSIX signing secrets before packaging.

zWorkforce v3.0.1

Highlights

This patch release carries the post-v3.0.0 security, reliability, and dependency hardening.

• Hardened response headers and fixed static asset MIME mappings.
• Replaced weak API-key verification with salted PBKDF2-HMAC-SHA256 verifiers; legacy unsalted records must be recreated and rotated.
• Kept generated CLI secrets in mode-0600 files without printing plaintext secrets.
• Made PostgreSQL integration fixtures isolated and repeatable.
• Updated Python 3.14 and GitHub Actions/container dependencies.
• Added protected-main and repeatable validation gates.

Artifacts

The release includes the Python wheel, source archive, CycloneDX SBOM, and SHA256SUMS. The published OCI image is ghcr.io/cvsz/zworkforce:v3.0.1.

This release is immutable; v3.0.0 was not moved.

zWorkforce v3.0.0

What's Changed

• feat: ship zWorkforce v1.0.0 by @cvsz in #1
• feat: ship zWorkforce v2.0.0 final release by @cvsz in #2
• feat: ship zWorkforce v3.0.0 complete platform release by @cvsz in #3
• fix: complete zWorkforce v3.0.0 recovery and missing runtime modules by @cvsz in #4
• chore: complete v3 release engineering and production hardening by @cvsz in #6

Full Changelog: https://github.com/cvsz/zWorkforce/commits/v3.0.0