Agent Wiki 0.9.4

• Redesign Access with People and Agents tabs, a searchable agent directory and
  a detail panel for wiki access, sharing and enabled tools. Show the original
  creator separately from the current owner, including agents not shared with
  the manager. Preserve existing invocation, configuration and sharing rights;
  no data migration is required.
• Patch the MCP OAuth client to 2.2.0 for issuer-bound credential storage. Keep
  the CLI's existing origin restriction and server-side SDK unchanged.

Source: daf5c189f27d2246ac06f19a32cf3576890047fc. Signed annotated tag.

Qualified linux/amd64 OCI assets, signatures, SBOM, vulnerability dispositions and recovery receipts are attached. macOS and Linux each passed 242 core tests and 79 browser tests; native upgrade passed 19 checks and container adoption/recovery passed seven. No database migration.

Runtime scans retain 24 advisory/component pairs with verified source-patch or product/platform dispositions; four moderate npm package entries represent the existing sprintf-js advisory outside reviewed Wiki execution paths. See the signed security review. Native host closure distribution is not published. Customer deployment acceptance is separate.

Agent Wiki 0.9.3 — runtime security and HTTPS hosting

Agent Wiki 0.9.3 patches the shipped dependency runtime and clarifies support for authenticated HTTPS hosting.

• Updates DOMPurify to 3.4.16 and KaTeX to 0.18.2.
• Uses OpenSSL 3.6.5 throughout the application runtime and SQLite 3.53.3 in both Node and Python. Removes unused Git interpreter extensions and enforces these properties in the package check.
• Clarifies operator responsibilities for authentication, logging, backups and recovery. Application permissions, optional per-identity MFA and persisted formats remain unchanged.

Source revision: 2155742d3b2ff64ba869fbe1799a4adcea7bf568.

The attached Linux/amd64 OCI package is qualified with source checks on macOS and Linux, the package check, a synthetic native upgrade from 0.9.2, and container adoption/replacement/backup-restore checks. Native host closure distribution is not published by this release.

Security scans remain nonempty. The signed security review reconciles all 24 reported runtime advisory/component pairs with exact source patches or product/platform mismatches. One unpatched npm advisory, affecting sprintf-js and three transitive dependents, remains outside the reviewed application execution paths. Read the attached security review, raw scans and provenance for the evidence and limitations; this is not a blanket clean-scan claim.

Verify the SSH-signed tag and signed asset checksums using the published release key, confirmed through a trusted maintainer channel. See packaging and upgrading, including the MFA restore boundary introduced in 0.9.0.

Agent Wiki 0.9.2 — sign out after MFA enrollment

Fixes “Could not sign out. Please try again.” when signing out immediately after adding a passkey or authenticator app. MFA enrollment rotates the session, and the account menu now retrieves the current session’s CSRF token before signing out. Origin and CSRF enforcement remain unchanged.

Regression tests first reproduced HTTP 403 with the old code, then verified immediate logout and subsequent MFA sign-in after TOTP, first and second passkey enrollment, and OIDC enrollment. No database migration, dependency change or MFA recovery-policy change is included.

Exact-source validation passed 238 core and 75 browser tests on macOS and Linux, managed package checks, 19 native upgrade checks and seven synthetic container adoption/recovery checks. The first managed Linux attempt had startup and preview timeouts under host load; the full unchanged retry passed. The initial native qualifier needed its locked test dependencies installed; the successful retry and original setup-failure evidence are retained.

The signed Linux amd64 OCI archive and qualification, SBOM and security records are attached. The current npm audit retains six low and four moderate affected-package entries, with no high or critical findings. The installed dependencies and 132 runtime artifacts are unchanged; earlier runtime findings remain unpatched and no fresh runtime-feed scan or clean-dependency claim is made.

Verify signatures against the repository’s established release key. Existing MFA database/key backup and minimum-version requirements remain in effect.

Agent Wiki 0.9.1

Agent Wiki 0.9.1 simplifies two-factor setup with separate Passkey and Authenticator app cards. Add a passkey opens the device prompt immediately. New passkeys receive a default label such as Passkey 1, with optional inline renaming afterward. The success screen keeps recovery codes available while renaming and offers a direct download plus an optional code preview.

The responsive interface supports light and dark appearance. Renaming requires recent authentication, ownership and CSRF checks, and preserves the passkey credential, browser sessions and recovery codes. Existing explicitly named API registrations remain supported. All other MFA enrollment, verification, removal and recovery requirements remain in place.

Validation: 238 core tests and 75 browser tests passed on macOS and Linux. Exact-commit managed Linux CI passed both source/browser and Nix package checks. Its first attempt hit a timing failure in an unchanged MCP preview test; the complete retry passed with the same runner and limits. Independent review found no P0/P1/P2 issues. Native upgrade from 0.9.0, container replacement and backup/restore qualification passed.

The signed Linux amd64 OCI archive is qualified; native host closure distribution is not published. The current production npm audit reports six low and four moderate affected-package entries, with no high or critical entries. Installed npm dependencies and 132 runtime artifacts are unchanged from 0.9.0. The signed security record documents applicability and retained prior runtime findings; no clean-dependency claim or fresh runtime-feed scan is made.

There is no new database migration. The MFA recovery requirements continue to apply, including paired database/key backup and 0.9.0-or-newer server and lifecycle tools after enrollment.

Source: 44e32573e94c723b7dfe6a8373a9c9d8bca076b5. Verify the SSH-signed annotated tag and artifact signatures against the trusted release key. This remains initial-development software; publishing source does not automatically deploy installations.

Agent Wiki 0.9.0

Agent Wiki 0.9.0 adds optional two-factor authentication for human accounts after Google/OIDC or local password sign-in. Users can enroll user-verified passkeys, an authenticator app (TOTP), or both, with single-use recovery codes. Security changes require a recent sign-in and revoke other browser sessions. Named-agent credentials and explicit grants remain separate.

Local CLI login accepts a code through a private --second-factor-file. A trusted operator can recover one exact principal using the packaged agent-wiki-reset-mfa-direct command through the managed maintenance workflow.

Upgrade and recovery: enrollment is optional, and existing accounts remain unenrolled. TOTP setup creates a private encryption-key file beside the control database; back up that matching key with the database using the new lifecycle tools. Restores invalidate browser sessions, pending challenges and all old recovery codes while preserving enrolled factors. Once factors are enrolled, retain a 0.9.0-or-newer server and lifecycle tools. See the MFA guide and upgrade notes.

Validation: 237 source tests and 75 browser tests passed on Linux and macOS; the exact source commit passed managed Linux CI and native Nix package checks. Independent application review found no P0/P1/P2 issues. Native upgrade from 0.8.18 and synthetic container adoption, replacement, authenticated reads/writes and backup/restore qualification passed.

The attached Linux amd64 OCI archive is qualified and signed. Native host closure distribution is not qualified or published. The production npm audit has one existing low finding and no moderate/high/critical findings; 132 immutable runtime artifacts are unchanged from 0.8.18 and retain the earlier documented vulnerability dispositions. No fresh runtime vulnerability scan or clean-dependency claim is made. Signed qualification and security records describe the tested scope.

Source: 554aa45e6d9c823a1bd2aa23d3b1dc3adfead092. Verify the SSH-signed annotated tag and artifact signatures against the trusted release key. This remains initial-development software. Source publication does not automatically deploy existing installations.

Agent Wiki 0.8.18

Agent Wiki 0.8.18 adds opt-in reader enrollment for new identities in one verified Google Workspace domain. It requires the restricted Google preset, preserves existing grants and revocations, and never links identities by email. Editor and manager access remain explicit. Existing installations retain their behavior by default; no persisted-data migration is required.

Source: d2be2dcc65f86610380854e68088d13db5e6daf6. SSH-signed tag and Linux/amd64 OCI assets are published. The exact source passed 226 application tests and 72 browser tests on both macOS and managed Linux CI, plus locked Nix package checks. Synthetic immutable-package upgrade, container recreation, authenticated read/write, backup and fresh-restore checks passed.

The OCI archive is 271,357,504 bytes, SHA-256 9a65bb47cde36665c916cdd358be307fa2941d71e6777449aba29d6150619961. Verify SHA256SUMS, signatures and the qualification receipt with the independently trusted release key before use. Native host closure distribution and cloud/customer activation are not established by these package checks.

Runtime dependencies are byte-identical to 0.8.17. The signed security review retains its known unpatched limitations; this release does not claim a fresh runtime vulnerability scan or patched dependencies. Production npm audit passes the high-severity threshold with one existing Low finding.

Agent Wiki 0.8.17

Agent Wiki 0.8.17 lets the authenticated CLI receive durable save receipts and full storage-health results that take longer than thirty seconds. Explicit caller cancellation remains supported; other metadata deadlines, credentials, origin confinement, server behavior and persisted data formats are unchanged. If a save is interrupted, retry the identical request and operation ID.

The exact source passed 223 application tests and 72 browser tests on Linux and macOS, managed Linux/package checks, and actual-image upgrade, replacement, backup and restore qualification. A real 31-second HTTP regression fails against 0.8.16 and passes with this release; the immutable packaged client also passed delayed-response and explicit-cancellation checks. An existing deployment returned its original durable receipt after a 73-second retry through the unmodified new CLI.

The runnable artifact is the signed Linux amd64 OCI archive; the container host does not require Nix. Verify the manifest, qualification, security review, SBOM and supporting records against SHA256SUMS and the independently trusted release signing key. Native host closures remain withheld pending clean-consumer qualification. The CLI can be used from the released source with its documented Node setup.

The runtime scan used the successfully refreshed official NVD feed and reports 24 findings across eight components. All 132 immutable runtime dependencies and 271 installed production npm manifests are unchanged from 0.8.16. The signed review retains that release's qualified reachability disposition and unpatched component limitations; this is not a clean or patched-dependency claim. ECR support and deployment performance remain installation-level checks.

Agent Wiki 0.8.16

Agent Wiki 0.8.16 keeps liveness responsive while authenticated archive health checks inspect slow storage. The full check still reads every original snapshot and reports current storage failures. Delayed responses recheck authorization. No health cache, storage format, schema, identity, lifecycle or trace-index change is introduced.

This initial-development release is built from 684cff30cfddf380dc67e30c1057775a65b19849. The Linux x86-64 OCI artifact includes signed provenance, qualification, security applicability and SBOM records. It requires no Nix installation on the runtime host. Native host closures remain withheld because clean-consumer distribution is unqualified.

The exact source passed 220 tests, 72 browser tests on both Linux and macOS, locked package checks and managed Linux CI. A real blocked-filesystem regression rejects the preceding synchronous implementation. Exact-image qualification passed the published 0.8.15-to-0.8.16 upgrade, existing session and write persistence, original trace evidence, container replacement, index recovery, backup/restore and liveness during a blocked detailed health check. These synthetic checks do not replace installation-specific acceptance.

Verify SSH signatures in namespace agent-wiki-release against the established key fingerprint SHA256:1Np/3VtW8SH6zILX+qft4EhOs5KnErjy0+RFr2zXrfQ. Verify the signed manifest and qualification record before deployment, and retain the prior image and consistent recovery pair.

The vulnerability feed refresh returned HTTP 404. The exact closure was scanned against the explicitly dated September 29 NVD cache: 24 CVE matches across eight components, identical to the preceding review. All 132 immutable runtime dependencies and 271 installed production npm manifests are unchanged from 0.8.15. This is neither a clean component scan nor a freshly updated vulnerability feed. The signed applicability review preserves existing residual limitations, including the reachable upstream Low OpenSSL memory-pressure issue.

Wiki service module 0.1.2 remains independently pinned. Existing installations are not changed by this publication.

Agent Wiki 0.8.15

Agent Wiki 0.8.15 adds an optional task-local trace index for installations whose persistent filesystem is slow for SQLite queries. Search, provenance and the conversation catalog use verified disposable indexes, while original JSONL records, source paths and citations remain authoritative and unchanged.

Enable it through the managed lifecycle with --trace-index-root /tmp/wiki-trace-index or WIKI_TRACE_INDEX_ROOT=/tmp/wiki-trace-index. The location must be outside the complete data root and owned by the serving user. Every replacement verifies or rebuilds its indexes before listening. The default remains unchanged. Full-corpus startup and serving performance must be qualified for the target installation.

This is an initial-development release from 942dc9e323625b383c83a5e680565fa0411b5cd0. The Linux x86-64 OCI artifact includes signed provenance, runtime qualification, security applicability and SBOM records. Native host closures are not included; clean-consumer installation remains unqualified. The OCI runtime requires no Nix installation.

Use the signed manifest and qualification record to verify the archive and image identity. Verify SSH signatures in namespace agent-wiki-release against the established maintainer key fingerprint SHA256:1Np/3VtW8SH6zILX+qft4EhOs5KnErjy0+RFr2zXrfQ. Preserve the prior artifact and a consistent recovery pair before upgrading. This release does not automatically change existing installations.

Validation passed on the exact source revision: 215 source tests and 72 browser tests on Linux and macOS, production dependency audit, nine locked Nix checks, 18 native builder checks, and six actual-container lifecycle scenarios covering replacement, fallback, persistence and recovery. Native builder checks do not qualify native closure distribution.

The runtime component scan reports 24 CVE matches across eight components; this is not a clean component scan. The signed applicability review found no known reachable High or Critical issue in inspected supported workflows and records residual limitations, including a reachable upstream Low OpenSSL memory-pressure issue. Review that record before deployment.

Private ECS installations needing a measured startup allowance can independently pin Wiki service module 0.1.2. Select a grace period from actual corpus initialization and verify the complete service lifecycle.

Agent Wiki 0.8.14

Agent Wiki 0.8.14 refreshes the locked NixOS 26.05 runtime to the September 28 revision, including Node 24.21.0, curl 8.22.0, OpenSSL 3.6.4 and PCRE2 10.48. Application data formats remain compatible. Existing installations still require an explicit stopped-writer upgrade, a consistent recovery copy, and deployment-specific acceptance checks.

This release includes the changes prepared in 0.8.13: a packaged loopback liveness command and support for the independently released Wiki service module 0.1.1, including optional private Cloud Map discovery and existing-service naming. The held 0.8.13 application release is superseded by this release.

Signed source tag: v0.8.14, commit d85bff140336e954957f8d4be832d58a0f70ddea.

The runnable asset is the qualified Linux x86-64 OCI archive. It does not require Nix on the container host. Its signed manifest binds the source, archive and image configuration. Verify the signing key through an independently trusted channel; its fingerprint is SHA256:1Np/3VtW8SH6zILX+qft4EhOs5KnErjy0+RFr2zXrfQ. JSON signatures use the SSH namespace agent-wiki-release.

• Archive SHA-256: 0cc9f029a0125d1c231c293c5d4c88e9a3ff520e0f9c882c8beefc4106137117.
• Image configuration SHA-256: 2bf094634ff985c07425bdc0eac7d2e5dbdb0769dcf9bc2c29b268945c161bc2.
• Exact final source passed Linux and Apple Silicon macOS checks: 204 application tests and 72 browser tests per platform, package smoke checks, and zero production npm audit findings.
• Native installed-package upgrade checks passed on both platforms. The published OCI passed adoption, identity/session continuity, backup/restore, external evidence, private liveness and runtime-hardening checks. See the signed qualification receipt for scope and measured results.

The attached runtime scan and signed applicability review are not a clean component scan. The review found no known reachable HIGH or CRITICAL issue in the inspected supported Wiki workflows. It records remaining component findings and a reachable LOW OpenSSL certificate-processing issue, CVE-2026-35189. ECR basic scanning does not support this Nix image; its lack of findings is not a security pass.

Native Nix host closures are not published: producer checks passed, but clean-consumer installation has not been qualified for this release. Synthetic checks do not certify customer deployments, independent disaster recovery, host reboot, Windows/WSL or SSH Git publication. Retain the previous recovery artifact until customer acceptance succeeds.

See upgrading, portable packages, and the changelog.