FleetQ v1.27.0

What's changed

• chore(phpstan): regenerate baseline on CI runner (PHP 8.4.21) (a72e4a1)
• style: fix pre-existing Pint violations blocking CI (b469e65)
• chore(release): 1.27.0 — UI-gap backlog + docs (0f7d5b9)
• feat(mcp): 13 read/write tools for the new UI features + safe team resolution (d0b32b7)
• feat(outbound+broadcast): chunk broadcast sends; complete 3 outbound channels (fc5d759)
• fix(security): explicitly team-scope project dependency dropdown + lookup (275e638)
• feat(ui): Wave-3 partials — editable agent heartbeat + dry-run, EditProjectForm deps repeater, human-task SLA escalation config (131e947)
• feat(ui): Wave 3 — reasoning bank, error-mode catalog, test suites, KG communities, crew chat room (e538fc3)
• fix(security): close cross-tenant gaps in secret-scan MCP tool + checkpoints page (48f0e1a)
• feat(ui): Wave 2 — blacklist, outbound proposals (RO), skill ops, workflow compensation+simulation, experiment checkpoints, memory proposals queue, credential secret-scan findings (1ee81be)
• feat(outbound): register 5 chat channels as core drivers + config UI (3354c45)
• feat(ui): Wave 1 batch 1 — AgentSession viewer, release signing-key mgmt, drift + eval-monitor dashboards, broadcast list/create, CSV import wizard (afe0ce8)
• chore: correct domain/MCP/migration counts in CLAUDE.md (08d702b)
• feat(crew): QA validation surfaces an honest 'could not verify' coverage gap (4f3adc2)
• feat: searchable model picker component + team-settings refreshManagedModels (ca9a011)
• fix: make dynamicCatalogModels/resolveCatalogApiKey protected for cloud override (0c92c7b)
• fix: annotate credentials cast in resolveCatalogApiKey for larastan (bc9a845)
• feat: dynamic model catalog sync for managed providers (OpenRouter) (d9122dd)
• feat(evaluation): Agentic AI Flywheel — self-growing eval set, error-mode catalog, drift + production monitors (5c52a11)
• fix(chatbot): remove unreachable default match arm (PHPStan match.alwaysTrue) (3f9e699)
• style: fix pre-existing Pint violations blocking CI (34ac72f)
• fix(chatbot): least-privilege access levels for SupportAssistant/Custom (b28aee1)
• test: pin bash_sandbox_mode in GracefulToolDegradationTest (hermetic) (6bfd2f1)
• fix(phpstan): charter property — @Property tag + resolve AgentResource access via ->resource (cd0f3bd)
• feat: Squad + Web IQ borrows — tool-call governance, decision log, evidence citations, agent charter (2859494)
• fix: pipeline-hardening — graceful tool degradation + memory query/embedding fixes (361b58f)
• feat(agent-chat): A2A consumer-side agent-card discovery (flag-gated, discovery-only) (2afd53e)
• fix(phpstan): drop stale isLocalProvider unused-method baseline entry (70e71c9)
• refactor(ai): route all embedding generation through the embedding seam (a20885f)
• feat(ai): pluggable embedding seam + SemanticCache model namespacing (097c75f)
• fix(ai): resolve provider/model mismatch at resolution time + cap memory embedding input (f4fe559)
• feat(widget): thumbs up/down feedback on assistant messages (ea7381d)
• fix(phpstan): type policy/arbiter code; baseline 2 larastan enum/date quirks (12d58fc)
• fix(chatbot): strip tool-call narration, enforce user language, enrich citations for all types (3e702a5)
• fix(governance): tenant-scope AgentPolicyGetTool version query + Gate::authorize on policy Livewire writes (97900fc)
• fix(security): explicit tenant scoping on AgentPolicy Livewire pages (8a9b1c7)
• feat(crew,ui): competitive arbitration + AgentPolicy Livewire UI + proposal explain panel (a21298e)
• feat(approval): versioned policy-governed autonomy (AgentPolicy + replay) (6098009)
• fix(mcp): CrewCostEstimateTool — plain Team::find + reword comment for tenant-scope guard (75716be)
• feat(orchestration): cost-aware orchestration — fan-out cost gate + tier selector (308d83b)
• fix(mcp): add #[IsDestructive] annotation to MetricTagValueTool (4b90dfc)
• feat(metrics): Return on Cognitive Spend (ROCS) — cost↔value ROI (d85d5ed)
• chore(phpstan): baseline taste-sprint false-positives (8.4) (8fcd67e)
• chore(phpstan): bump CreateAgentTool Request::get baseline count 6->7 (pre-existing drift from taste sprint) (d208abe)
• feat(phoenix): per-team project routing + auto-ingest local-agent transcripts (f7f2e1b)
• fix(marketplace): carry taste through publish/install round-trip (3c12026)
• fix(agent): complete taste parity — assistant get + workspace round-trip (0b378e2)
• feat(agent,budget,memory): borrowed-ideas sprint (contextrie + mercury) (89a7d44)
• fix(test): force local media disk in bug-report widget + signal tests (52238c5)
• fix(test): stub resolveInternal in clarification + plan-with-knowledge tests (bf981ce)
• chore(ci): regenerate PHPStan baseline on runner (clears pre-existing drift) (1c00c60)
• fix(ai): resolve Team explicitly for resolveInternal to satisfy PHPStan (ec82144)
• style: fix pre-existing Pint drift on 8 files (CI Code Quality gate) (e0668fa)
• fix(ai): BYOK-aware provider resolution for internal pipeline LLM calls (f29892e)
• feat(widget): public streaming media route for bug-report attachments (f032b0a)
• fix(sentry): drop partner-webhook retry noise (issue #811) (b386696)
• fix(storage): address code-review findings (base) (b0b6bf5)
• docs(readme): add architecture flowchart (2b1b6fe)
• feat(storage): migrate upload call sites to TenantStorageManager (stage 3+5) (34c5e2b)
• feat(storage): S3 tenant disks + TenantStorageManager gateway (stage 1-2) (914a07f)
• fix(observability): pt3 hotfix — extract before_send closure to static class (31ed1d6)
• fix(observability): pt3 — move pattern filters to Sentry before_send hook (e79710d)
• fix(phpstan): drop 24 stale baseline entries on ResolveAgentToolsAction (800ed91)
• fix(observability): pt2 — log perms, watchdog queue/timeout, more Sentry filters (5403eef)
• fix(observability): suppress Sentry noise + recover from auth/no-provider errors (5ab32bb)
• fix(phpstan): @Property hints on enum-cast models + targeted bug fixes (8451a75)
• fix: audit_entries team_id + Livewire authorize gates (2feca8d)
• feat(agentforce-borrowed): safety middleware, MCP registry, agent workspace (e2a6765)
• fix(billing): walk back by duration_ms when aggregating execution tokens (bdddaa0)
• feat(billing): expose cost_credits + real tokens in OpenAI usage block (e85a3e3)
• fix(agent): drop trailing tool mention for tool-less agents (29e46b9)
• fix(agent): honor partner system message and stop hallucinating tool calls (f3a0003)
• fix(security): cap transcript span amplification + authorize attribution ids (00427d0)
• feat(observability): ingest local-agent transcripts into Phoenix traces (246fca1)
• fix(ai): count sub-program key in availableProviders gate (f4b8a00)
• fix(ai): scope agent execution to the token/agent team, not the UI team (cf89fb5)
• fix(ai): count sub-program key in providerHasApiKey gate (a325cbb)
• fix(skill): scope lift-eval dataset lookup to team (cross-tenant IDOR) (4bc2670)
• feat(skill): blind A/B skill-lift eval + failure-mode lint + public quality leaderboard (2a09532)
• fix(quality): resolve phpstan findings introduced by refactor extractions (e19fee6)
• refactor(skill): extract ExecuteSkillAction::execute pipeline phases (9d88656)
• refactor(assistant): break up SendAssistantMessageAction Brain Method (58eace3)
• refactor(tool): extract ResolveAgentToolsAction::execute pipeline phases (dff9df4)
• refactor(tool): extract browser_task closure in ToolTranslator::buildBrowserTools (259ff82)
• refactor(workflow): extract resolveNode Brain Method into per-type handlers (883e696)
• fix(code-index): path-traversal guard in PolyglotCodeExtractor materialize (ee2730c)
• feat(code-index): polyglot extraction via CodeGraph + code_impact tool (cee45cc)
• fix(ci): repair pre-existing Multica test failures + secret-proxy phpstan (b2a9e39)
• test: make RunSecretVault tamper assertion deterministic (39dadee)
• feat(ai): proxy-based secret injection for claude-code-vps (596c790)
• feat(local-agents): catalog parity with Multica runtime set (375a387)
• feat(skill): SkillKit hardening — recommended sections + GitHub import (d9926ce)
• chore(phpstan): clean larastan findings for agentskills/nudge (4faf3b0)
• feat(skill): agentskills.io import/export + memory nudge (dc9f03b)
• fix(phpstan): clear this session's larastan regressions (4f0f498)
• fix(mcp): annotate InspectDiffCommentsTool team-self-lookup (CI gate) (139bf8d)
• feat(local-agents): runtime-extensible CLI registry (Multica borrow B) (85b8bec)
• fix(marketplace): symmetric agent publish/install round-trip (34549d8)
• feat(agent): full agent definition round-trip in workspace export/import (e90bd42)
• test(mcp): pin MCP Apps capability gate to SEP-1865 (2026-01-26) (8e5741a)
• feat(guardrail): code comment guardrail (oh-my-opencode borrow) (31b2ba8)
• feat(guardrails): agent action guardrails — SQL gating, N-of-M approvals, LLM approval summaries (247f3a9)
• feat(db): add pgvector columns to existing tables (idempotent, guarded) (f3086ce)
• feat(signal): fix-durability loop — detect & learn from fixes that don't survive (dd87a42)
• fix(signal): annotate Signal metadata + learned_relevance properties for PHPStan (4e92ec5)
• feat(signal): borrow CondenseIt — HN/Reddit/GitHub-Releases connectors, novelty enrichment, learned relevance ranker (81653b6)
• feat(governance): dotCMS-borrowed brand voice, content quality gate, MCP schema introspection (7511d7f)
• chore: align main to develop tree, preserve local-mode CSP fix (138b280)
• chore(phpstan): regenerate base baseline in CI runner env (0f2413d)
• feat(api): support tool_ids on agent update endpoint (f006059)
• fix(sentry-watchdog): dispatch one job per (team, project) (3c8ddfe)
• fix(sentry-watchdog): scope triage to the integration's Sentry project (ff35dcc)
• fix(sentry-watchdog): unblock autonomous PR delegation (07bdf01)
• fix(phpstan): @Property annotations for SkillVersion, ExperimentStage, Integration (#92) (bc34d1d)
• fix(docker): remove hardcoded plugin paths, move to override.yml.example (#91) (1da47dc)
• fix(integration): Sprint B — 3 medium driver fixes (Sentry, Attio, LinkedIn) (c096557)
• fix(integration): hotfix 10 driver issues found in agent-team validation (fd1011c)
• fix(phpstan): batch 5 — Chatbot/Signal sub/KG/Telegram + Livewire callers (issue #82 final stretch) (#90) (f1e116a)
• fix(phpstan): batch 4 — Approval/Signal/Outbound/Audit/Bridge @Property (#89) (12e1794)
• fix(phpstan): batch 3 — Team/Experiment/PlaybookStep/Assistant @Property completion (#88) (b3ac226)
• fix(phpstan): batch 2 — Agent + Marketplace + Trigger @Property gaps, Resource @Mixins (#87) (890c504)
• fix(phpstan): batch 1 — JSONB @Property annotations across Tool/Marketplace/Skill/Crew/Workflow/Project/Email domains (#86) (cfa1d7b)
• fix(csp): allow Vite HMR + dev WebSocket origins in local mode (#84) (562cfcb)
• fix(phpstan): unblock CI — add @Property annotations for JSONB models (#85) (e35f092)
• feat(sentry-watchdog): Phase 1 infrastructure — auto-fix workflow + submodule routing + PR email (18e7ccf)
• fix(sentry-watchdog): suppress Cron noise + forensic logging on triage defaults (c4fece9)
• fix(sentry-watchdog): batch criticals into one digest + add admin UI (2ba80b8)
• feat(theneo-borrowed): llms.txt routes + skill breaking-change detector + x-ask-ai component (4edb401)
• fix(security): tenant-isolation sweep — 3 architecture tests + 4 MCP bug fixes (b29a3bc)
• fix: resolve Resend-merge PHPStan debt — model docblocks, dead code, MCP annotations (a812ea3)
• fix(security): gate every Livewire write method + close test coverage gap (7e71164)
• fix: gate the Audit Log page to admin/owner roles (ac38a1d)
• fix: theme + tenant-scope two cloud admin pages (28b30de)
• fix: redirect unauthenticated Pulse visitors to login (452e3f5)
• fix: add Pulse migration — Pulse publishes it, does not auto-load (1cac292)
• feat: add viewPulse gate for Laravel Pulse access (3ed8163)
• feat: Broadcast domain, Audiences UI, Resend provider settings (8cd4950)
• feat: Resend email integration — connector, delivery webhooks, audiences (490213a)
• feat(mcp): add mcp:call debug command + Bridge computer-use guide (fea9c2c)
• feat(code-index): complete the deferred code-element embedding phase (1601374)
• feat(memory): RoBrain-borrowed belief fields — rejected alternatives, supersession, contradiction scan (124cfd2)
• feat(memory): add Tenure-inspired structured belief fields (d082628)
• fix: satisfy PHPStan in DecisionRubric (817c6ff)
• feat: CraftBot-borrowed sprint — decision rubric, event distillation, format guide (0cf48a4)
• fix(landing): correct MCP tool count in FAQ (e976e4e)

Upgrade

git fetch --tags origin
git checkout tags/v1.27.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.