v1.0.0 — "Pilot"

The first stable release. Every provider turn now runs under processes and
permissions the worker owns: OpenCode edits are allowed only when the policy
says so, one session can no longer approve another's request, and cancelled
or closed providers are cleaned up. From here on, breaking changes to the
public contract require a new major version.

Breaking

• Breaking: stop old Codex/Claude live workers and recycle their brokers
  before upgrading; live runtimes are now scoped per project, and new workers
  do not adopt legacy processes (live attach --unscoped reaches old ones).
• Breaking: --codex-ignore-user-config is rejected by Codex live and
  Codex ACP instead of being silently ignored; use the Codex exec adapter.
• Breaking: restart OpenCode live workers to get policy enforcement; each
  now owns its native server, so attach with the opencode attach command
  the worker reports.

Security

• OpenCode live enforces the permission mode on every turn and preserves
  native deny rules; only acceptEdits allows edits.
• OpenCode permission prompts are answered only for the session that owns them.
• Orchestrator-grant approvals honor their expiry.

Fixed

• Cancelled or closed providers are terminated, including their child
  processes, instead of overrunning their deadline.
• Malformed agent follow-up actions are rejected instead of half-executed.
• Expired deliveries wait out their retry backoff.
• The TUI stays within the terminal on tiny resizes.
• Replacing an incompatible daemon no longer fails with SQLITE_BUSY.

---

Full Changelog: v0.8.2...v1.0.0