Domios v1.16.0

Domios 1.16.0

Domios 1.16.0, the first public release from domios-dev/domios.

Carries the 1.16.0 release head merged in #671 plus the qualification fix that publication needs.

plugin-codex-v1.14.54

{"id":"codex","path":"provider-codex","version":"1.14.54","minCodeterm":"1.15.2"}

plugin-claude-v1.14.20

{"id":"claude","path":"provider-claude","version":"1.14.20","minCodeterm":"1.15.1"}

plugin-analytics-v1.10.21

{"id":"analytics","path":"analytics","version":"1.10.21","minCodeterm":"1.10.20"}

Domios v1.15.2

Domios 1.15.2

The app becomes Domios

• The installed application is Domios: product name Domios, identifier com.domios.app, GUI
  executable domios-app. The packaged CLI ships as domios and codeterm from identical bytes;
  domios is the primary command in help, docs and prompts.
• This is a manual move. CodeTerm 1.15.1 cannot update itself into Domios: install Domios fresh,
  then remove the old app. The per-OS steps follow below. Data stays in ~/.domios; nothing is migrated.
• New clients read only domios-latest*.json. The old latest*.json channels carry the manual move
  notes with no platform payloads: a 1.15.1 client reports this release as incompatible, and a forced
  install fails before any download or server shutdown.

What changes for you

• Plans are stored as relational task, milestone and attempt rows with an incremental recall index;
  deleting a plan never waits for indexing, and deleted plans leave every index. The schema change is
  forward-only: do not downgrade to 1.15.1 after running 1.15.2.
• Curator rounds run in a visible read-only tab under the team manager, render system deliveries and
  timeline events, and can be finished by hand.
• Blueprint runs receive bounded previous results on stdin and run without instance credentials;
  Blueprint recall uses vectors with a relevance floor.
• The composer has scoped mention sources with a caret-aware picker, live-scope mention chips and
  grouped background subagents.
• Chat copies attachments as complete files, shows their names, shares fullscreen camera, supports
  image galleries and keeps following the session after tab switches.
• Agent input is framed: routed reports and large messages arrive as one paste, and typed inputs
  reconcile across transports.
• Mesh artifacts enforce the private-path policy for outgoing files.
• Lane worktrees clean themselves up completely when their work lands.
• Billing signs you in at purchase; plans stay browsable and checkout opens in the app's theme.
• Product analytics deliver with consent in production.

Fixes

• Chat-backend bridge deliveries report backend errors and uncertain deliveries instead of
  swallowing them.
• Team close and plan deletion no longer hang; Workers report their Team on spawn.
• Tab restart delivers its input; restored tabs wake on transcript changes.
• Startup recovers stale sockets, rewrites relocated stored paths under the legacy data root and
  reports stale root references.
• Updates scrub the relaunch environment, verify Debian staging, explain privileged Debian updates
  and recover interrupted updater handoffs.
• Chat task ids keep their links where no mention host exists; Curator refusals show the server's
  message; the zoom canvas works without ResizeObserver.
• domios test plans are no longer flagged as vague by plan doctor.
• The sidebar keeps visible rows in place when lists shrink.
• Worker checklist review cards stay out of the parent chat; report task chips and references render.
• Bundled plugins ship only runtime files; shipped prompts no longer carry repository procedures; the
  remaining CodeTerm naming in docs, help and health is gone.

Removed

• The retired 1.14.9 upgrade path.

Move from CodeTerm 1.15.1 to Domios 1.15.2

Install Domios fresh by hand, then remove the old application. Do not use
CodeTerm's in-app installer for this release. Data already lives in ~/.domios
and stays there; no data move, migration script or compatibility shim is needed.
Do not run both applications together.

• Windows: quit CodeTerm, including its tray process. Disable its autostart
  in Settings before quitting. Download and run the Domios setup executable;
  the default destination is %LOCALAPPDATA%\Domios. Run the old uninstaller
  from %LOCALAPPDATA%\CodeTerm (normally uninstall.exe); remove only the old
  app, keeping ~/.domios. Remove any remaining CodeTerm-Autostart task in
  Task Scheduler. Launch Domios and re-enable autostart there if wanted. Remove
  old Start-menu/desktop shortcuts and pins, then pin Domios. In a new terminal,
  where.exe domios and where.exe codeterm must resolve the CLI in
  %USERPROFILE%\.domios\bin; the GUI is domios-app.exe. Remove old CodeTerm
  directories from the user PATH. Both CLI names run the same installed CLI.
• macOS: disable CodeTerm autostart, quit it, then open the Domios DMG and
  install Domios.app in /Applications. Delete /Applications/CodeTerm.app
  and any duplicate old bundle. Remove the old Login Item and unload/remove
  ~/Library/LaunchAgents/com.codeterm.app.plist if it remains. Launch Domios
  and re-enable autostart if wanted. Remove the old Dock icon and add Domios.
  Open a new terminal: command -v domios and command -v codeterm must select
  ~/.domios/bin or the links in ~/.local/bin, both targeting the current CLI.
  Remove custom PATH entries or links into CodeTerm.app.
• Linux: disable CodeTerm autostart and quit it. The old package is named
  code-term, and it owns /usr/bin/domios, which the new domios package also
  ships, so installing first and removing afterwards fails with a dpkg file
  conflict. Install and remove in one transaction:
  sudo apt-get install ./Domios_1.15.2_amd64.deb code-term- (on arm64,
  ./Domios_1.15.2_arm64.deb). For an AppImage install, use the new AppImage and delete
  the old CodeTerm image and its custom desktop launcher. Disable/remove the
  old codeterm.service user unit if still present, then launch Domios and
  re-enable autostart if wanted. In a new terminal, command -v domios and
  command -v codeterm must select the package-owned /usr/bin/domios and
  /usr/bin/codeterm CLI commands, or the current CLI links under
  ~/.domios/bin / ~/.local/bin. The GUI is /usr/bin/domios-app. Remove old
  custom PATH entries, desktop launchers and icons. Do not force-overwrite
  package-owned files.

After removing the old app, check autostart, shortcuts, and the default handler
for domios:// links and any file associations you configured. Set them to
Domios; remove old codeterm:// associations or custom file handlers. On Linux,
xdg-mime query default x-scheme-handler/domios must name the Domios desktop
entry. On Windows check Default apps and Task Scheduler; on macOS check Login
Items and open a domios:// link. Linux Deb/RPM packages install both CLI
commands in /usr/bin. For macOS and AppImage, start Domios once to repair
both CLI links in ~/.local/bin; verify that directory is already in your shell
PATH, or add it yourself using your shell settings. On Windows first launch
registers ~/.domios/bin on user PATH. No user shell dotfiles are edited by
Domios. Open a new terminal afterwards. Application data stays in place.

Without the release guard, the 1.15.1 updater would launch a separate Domios
NSIS install on Windows, replace the current bundle in place on macOS (leaving
the old CodeTerm.app path with a new identity), or install a differently named
Linux package alongside the old package, conflicting on shared paths such as
/usr/bin/domios. An AppImage update replaces the current image while retaining its old filename.
These mixed states are unsupported. New Domios clients use
domios-latest*.json; the old latest*.json paths publish these manual steps
with no platform payloads. The 1.15.1 discovery shows the release notes as
incompatible and cannot offer an install. A forced old install fails at missing
platform selection, before download, shutdown or installation; the old binary
cannot gain a new custom error dialog from release metadata.

The bundle identifier changes to com.domios.app. macOS treats Domios as a new
app for TCC permissions, including microphone and Accessibility: grant access
again when requested, or enable Domios in System Settings → Privacy & Security.
Old Keychain items may prompt for access by the newly signed app; approve the
prompt or sign in again if access is denied. No Keychain ACL is silently copied.
Windows notification identity/AUMID and notification preferences are new too;
allow notifications for Domios again. Existing denial/fallback and permission
request paths remain available; the old app's OS grants are not inherited.

CodeTerm v1.15.1

Domios 1.15.1 release PR. Draft: the release SHA follows once the remaining P0 lanes land; publication and tags need the owner's GO.

CodeTerm 1.15.1

• Updates show per-component progress in a clean panel, and an update that cannot install says why
  before it stops anything. Install refusals reach the CLI with their code and how to recover.
• Plugin installs and updates swap atomically: a failed step rolls back and names the exact step.
• Account, sign-in and update failures appear as toasts instead of a titlebar slot. Small surfaces
  show compact errors; plugin rows take one line with one channel notice.
• Attachments appear at once with an uploading state and clearer kind labels.
• A tab previews files in its own AgentPad, with a shared viewport viewer and edge-aware touch previews.
• The sidebar shows each section as LABEL N with live working activity and a one-line worker summary.
• Memory Activity lists configured agents, Workers and Services, with details on click.
• Claude model and effort switches apply mid-turn when the provider supports it.
• The tray shows Admin from the server's authority.
• Immediate deliveries skip the queue, heartbeats get their own chip, and the feed never blanks.
• Escape closes the Mesh peer drawer before the view.
• The Browser surface stays stable while the window resizes.

Fixes

• Runtime launches send only the assigned-task starter; the brief travels as developer instructions (P0).
• Restored tabs bound to their own session no longer show Starting while they work, and interrupted
  tabs and routed messages wake restored tabs.
• Chat runtimes keep their declared agent runtime, and worker failures record their real reason.
• Agent provider listing never waits on a plugin VM.
• Codex edit cards read path-keyed change maps; unknown edits show their raw payload.
• Telegram file sends deliver the document or fail loudly; bridge inject failures stay typed and never replay.
• Agent notifications stay in the bell, with no strip above Chat.
• Updater template placeholders and flag values are never treated as prerequisites; relocation
  tolerates a stray provider-update.lock.
• Review hooks do nothing without checklist storage; Workers close seeded criteria by id.
• Retained exit evidence is rechecked when a process identity is lost.
• An isolated verify server opens loopback-only sockets.

Internals

• Rename phase 2: crates, packages and the contract bridge move to Domios (Herald). Phases 3-5 ship in 1.15.2.
• Envelope grammar v1 with typed segments and shared fixtures.
• Stage timing instrumentation for providers, chat start, preview and PTY.
• Typed GitHub blueprint node and reuse-first blueprint prompting.
• Release CI runs in tiers: fast checks, then tests behind them; builds start at once. Qualified dry runs
  publish through release-publish.yml; RELEASE_AUTO_PROMOTE stays off.
• The platform test classifier caches results by source digest; platform jobs compile only packages
  with platform-specific tests.
• PR-time script, gateway and frontend workflows are gone: their guards run in release-preflight and
  the fast Linux tier.
• ConPTY shell-exit diagnostics report session, host and shell context.

Plugins

Plugins release on their own train. plugins/channel.json and the manifests agree
(node scripts/release-plugin.mjs check: 7 checked):

Plugin	Version	minCodeterm	Tag
provider-claude	1.14.15	1.15.1	plugin-claude-v1.14.15 to create on master after this release
provider-codex	1.14.49	1.14.9	plugin-codex-v1.14.49 to create on master after this release

provider-claude 1.14.15 needs this app version, so its tag waits for 1.15.1 to publish.

Issues

Public issues fixed by this release are resolved from the release range with
release_issue_contract.py on the final SHA and close only after served-byte verification.

Qualification (on the release SHA)

• Canonical full regression once, then ./build.sh release-preflight.
• release.yml dry run with tests on release/1.15.1.
• Publication from the qualified run through release-publish.yml after the owner's GO.

Still to land before the release SHA

• Ember (task_bc5sz3): P0 lane-scan CPU.
• Sentry (task_ml70hr): P0 background loops.
• Possibly Herdsman (one toast system) and Tempo (--speed).

plugin-claude-v1.14.19

{"id":"claude","path":"provider-claude","version":"1.14.19","minCodeterm":"1.15.1"}

CodeTerm v1.15.0

CodeTerm 1.15.0

Release 1.15.0: runtime identity moves to Domios (data, config, logs, mesh), plus release pipeline repairs. Installer, crate and CLI names stay CodeTerm until 1.15.1.

Candidate: 6f60955 (rename/domios, fast-forwarded). A push to release/** is a dry run while RELEASE_PUBLISH_ENABLED is unset.

Pipeline repairs on this branch:

• Every distributable retained by dry runs (DMG, headless, updater payloads).
• Private-store outage falls back to GitHub Actions artifacts and a job-local sccache; the endpoint is defined once in scripts/ci-store.sh.
• Size-aware evidence-store deadline with one logged retry.
• Build receipts name the real first failure.
• A qualified dry run promotes to the release from its retained bytes (promote_run_id); it refuses missing, changed or foreign evidence.
• The frontend is built once per run; every platform installs it by sha256.
• macOS arm64 and x64 build in parallel (RELEASE_MACOS_X64_LABEL).

Qualification: release.yml dry run on this head, plus canonical release-preflight on 6f60955.

CodeTerm v1.14.9

Domios 1.14.9

Agent runtime

• Codex runtime events are reduced in batches: the subscriber drains the frames already queued into one reducer call. A lagged event channel or a failed reducer pass is now a warning plus a resync, not a killed turn; the provider process closes only on exit, a protocol failure or 8 consecutive bookkeeping failures. The event queue is 8192 frames, and the Codex reducer state has a total budget.
• Worker launches no longer fail on an unproven exit: a PowerShell "command finished" marker with exit 0, seen before the provider process appears, no longer ends a launch whose session then binds.

Delivery

• Chat sends to Claude PTY tabs: a > in the transcript above a filled composer is no longer mistaken for a menu, so Enter is pressed.
• Domios pastes are followed by a pasted by Domios marker instead of the <tip>Handle the message above.</tip> and "Handle the paste as my request." follow-ups; the shared rule tells agents what the marker means.
• Voice notes carry their transcript in a <transcript> element.

Coordination

• System heartbeats appear in the tab's recurring list as read-only entries with a delivery log.
• The Orchestrator heartbeat no longer repeats the owner's own messages.
• Worker provider errors (rate limits, usage limits, server errors) reach the Orchestrator as incidents.
• Claude's cancel-only permission prompt ("Esc to cancel") is recognized by tab respond.

Build and structure

• ./build.sh check-queue: a warm per-machine cargo check of a lane SHA, returning bounded file:line errors. Build verbs report success or early failure to the calling tab with --notify-tab; install-local runs its fmt, file-size and clean-tree gates first.
• scripts/ catalogue with caller headers and a CI gate.
• First crate splits out of the app crate and codeterm-types: codeterm-wire, -decision, -provider-signals, -blueprint-types, -local-recording, -notify-types, -events, -config, -secrets, -keepawake, -cron, -shutdown and -sentinel-ports, plus the socket rpc bridge. The app crate's tangle went from 162 to 142 modules.

Release notes for reviewers

• Built from develop 6dfe8cb, the same SHA the owner installed and used as 1.14.9-dev.6 on BLACKSTAR.
• BLACKSTAR is paused as a CI build machine for this release (its runner labels are parked, and windows-x64-build is served by ROG). By the owner's decision, no local release-preflight or core-journeys run was done on BLACKSTAR; the CI release run is the gate.

Signed and notarized macOS DMGs and headless archives for all six platforms are available alongside the updater packages.

Apple notarization: aarch64 2a3fa275-bcc3-45ed-bc99-7d54273e6065 (Accepted); x64 80501837-d526-4721-ac77-a6c023bb832a (Accepted). Both DMGs are stapled and signed with Developer ID Application: ANDREY KOVALEV (JMMWQ9LWF7).

CodeTerm v1.14.7

Domios 1.14.7

Plan pl_xq9cj4. Codex moves to the Chat-only agent runtime and into the provider-codex plugin.

CodeTerm 1.14.7

• Codex runs on the stdio app-server runtime with no PTY: start, resume, history (with a thread/read fallback for Codex 0.160), sends, approvals and questions, interrupt with completion wait, model, effort and mode controls (CLI, self and cross-tab), usage.
• Codex sign-in without a PTY: browser (system browser), device code, API key over stdin or a masked field, terminal fallback; the same thread resumes without restart.
• The role identity of every role (Orchestrator, Planner, Worker, General, cron, memory workers, dreamer) is composed into the runtime system prompt and refreshed on resume and after compaction.
• Legacy PTY Codex tabs migrate to the runtime on restore; plan task dispatch, cron and memory workers, agent restart (resume and fresh) and tab stop work on runtime tabs.
• Unmapped provider server requests get correlated error replies; human-readable runtime errors; compact one-row Chat status banner.
• Account tray with provider and action icons.
• Release pipeline: independent per-artifact jobs and runner labels, structural bundle smoke checks, signature verification before publish, serialized publication, dry runs include tests.
• Gate and dev reports alert the Orchestrator on the first failure.
• Test isolation: no unit test reads the machine config or the shared lifecycle journal; platform-scoped recording tests; subsecond closed-tab cap tests.

Investigated, not fixed

• Refs #604 (CI archive and shard work continues).
• Refs #153.

Deferred, with reasons

• Isolated release execution smoke, Windows arm64 native smoke, Windows Authenticode signing: post-release tasks.
• Deleting the old codex_rpc path: after the live parity gates, next release.
• OpenCode on the same runtime: next release.