v0.7.1

Phosphor v0.7.1

A performance and stability release: provider prompt caches stay warm
across agent turns, Windows sandbox startups and shutdowns no longer
stall, and the security advisory backlog is cleared.

Performance

• Provider prompt caches stay warm across agent turns. Dynamic run
  state (todo list, active goal, post-turn reminders) used to be
  reassembled into the system prompt on every agent-loop iteration,
  invalidating provider prefix caches on every todo update. It now rides
  the run's user message once as a <run_context> block, so the wire
  prefix stays byte-identical and providers keep serving from cache.
• MCP server instructions are ordered deterministically, so tooling
  around the prompt stops churning the cache for no reason.
• A drifting model is re-anchored on its open todo via tool results,
  keeping long runs on track without rewriting the system prompt.

Fixes

• Windows ACL crawls are bounded. Container ACE grants and revokes
  no longer block process startup or exit for minutes on deep workspace
  or toolchain-cache trees; they run behind explicit deadlines, a grant
  overrun fails the launch closed, and any revoked ACEs left behind are
  cleaned up at the next launch.
• Second instance fails fast. Starting another Phosphor against the
  same data directory now fails instantly with the owner's PID instead
  of stalling for 30 seconds on SQLite busy timeouts. Short-lived
  read-only commands can still inspect a database a TUI is using.
• Confined git works again. Writable sandbox roots can now unlink
  and rename files, so git add/commit/status work inside the
  sandbox again, while .git metadata stays fenced from direct agent
  writes.
• No more ghost text over the TUI. Confined children launch with
  CREATE_NO_WINDOW, so a child failing early (e.g. ssh.exe inside
  the sandbox) can no longer paint raw text onto the terminal screen.
• Continuation and queued turns deliver their notes. Recovery
  instructions ("continue where you left off") and the todo snapshot
  are now delivered on the outbound prompt instead of sitting in the
  queue and leaking into a later user turn.
• Flaky Windows CI test fixed. Session title generation no longer
  races the prompt-cache wire test, ending the spurious
  TestWirePromptByteStableAcrossTodosUpdate failure.

Security

• golang.org/x/net upgraded to v0.62.0, fixing CVE-2026-97045
  (html.Render namespace-transition bug) and CVE-2026-78661
  (quadratic-complexity panic when coalescing text nodes).
• Remaining code-scanning and Dependabot alerts were triaged and
  dismissed with evidence where the vulnerable code path is unreachable
  in this codebase (unused x/crypto/openpgp, unused TIFF decoding in
  disintegration/imaging).