hal0 v0.8.2b2-nightly.20260625084816

Nightly v0.8.2b2-nightly.20260625084816 — changes since v0.8.2b2-nightly.20260624085413:

• Merge pull request #971 from Hal0ai/docs/benchmarking-ui-handoff (6e3ddbb)
• docs(bench): UI/feature handoff for the benchmarking toolbox (36f05e3)
• Merge pull request #969 from Hal0ai/fix/ui-deploy-reliability (f1c32b4)
• fix(deploy): land UI builds reliably (no-cache index + install to served dist) (bb0d51f)
• Merge pull request #968 from Hal0ai/ui/gpu-gauge-prefill (68d6046)
• feat(dash): iGPU usage gauge + prefill TTFT readout (yellow ring) (f0704e9)
• Merge pull request #967 from Hal0ai/feat/gpu-benchmark-harness (dc01d55)
• feat(bench): GPU benchmark harness + hal0-benchctl seam + agent skills (03e08af)
• feat(dash): topbar Kanban/Agent-Chat launchers, global agent chat, Archived lane (#966) (bd5018f)

hal0 v0.8.2b2

Two fixes on the 0.8.2 beta line — profile MTP tuning now actually takes
effect, and stacks can pull their referenced models. Safe upgrade from
v0.8.2b1.

Fixed

• Explicit profile spec flags win over the MTP bundle. resolve_profile_flags
  appended MTP_FLAG_BUNDLE after a profile's own flags, so the bundle's
  spec-draft defaults (--spec-draft-type-k q8_0, --spec-draft-p-min 0.0)
  silently clobbered any --spec-draft-* a profile pinned — there was no way to
  tune the MTP draft through a profile. The bundle is now merged as defaults that
  the profile's explicit flags override (gap-filled only). (#963)
• Absent stack models can be pulled. Custom GGUF builds referenced by the
  seed stacks (saber, pi-agent, qwopus coders, halostrix, gemma, …) were
  auto-scanned with empty hf_repo/hf_filename, so on stack import/apply they
  classified "unresolvable" with no download URL. Registered their public HF
  coordinates (jcbtc/ + Jackrong/ + unsloth/ repos) in the curated catalogue;
  embed_references falls back to curated on export; and a new
  backfill_coordless() repairs existing coord-less registry rows on rescan. (#964)

Changed

• CI: cancel superseded PR runs (never main); PRs test Python 3.12 only while
  main runs 3.12/3.13/3.14 (3.14 non-blocking); least-privilege workflow
  permissions; Node 20 → 22. (#898)

hal0 v0.8.2b1

Profiles gain the same portable export/import/sharing model stacks already have.
Safe upgrade from v0.8.1-beta.2.

Added

• Portable profile export/import. A profile can now be exported to a
  self-contained, checksummed .hal0profile.json envelope and imported on another
  host — the same file-based sharing model stacks use. The envelope carries the
  profile template plus a sha256 content checksum and an independent
  schema_version; no secrets or host paths are serialized. New routes
  GET /api/profiles/{name}, POST /api/profiles/{name}/export, and
  POST /api/profiles/import (dry-run reports checksum validity + name collision;
  commit creates under a chosen name, 409 profiles.exists on a duplicate). New
  MCP tools mirror the stack_* set: profile_list / profile_status /
  profile_export (autonomous read) and profile_import / profile_delete
  (gated). The dashboard adds an Export button to every profile card and an Import
  dialog (file → dry-run preview → commit). (#962)

hal0 v0.8.2b2-nightly.20260624085413

Nightly v0.8.2b2-nightly.20260624085413 — changes since v0.8.1-nightly.20260623085944:

• Merge pull request #965 from Hal0ai/chore/release-0.8.2b2 (5fe75e3)
• chore(release): bump version to 0.8.2b2 (4c37f25)
• Merge pull request #898 from Hal0ai/ci/cleanup-speed (8eaeadc)
• Merge branch 'main' into ci/cleanup-speed (80e8580)
• Merge pull request #964 from Hal0ai/fix/stack-model-pull-coords (04008b0)
• Merge branch 'main' into fix/stack-model-pull-coords (644ba7f)
• Merge pull request #963 from Hal0ai/fix/profile-mtp-bundle-precedence (c8b89a7)
• fix(stacks): give absent stack models pullable HF coords (4053b07)
• fix(profiles): explicit profile spec flags win over the MTP bundle (442c803)
• Merge pull request #962 from Hal0ai/feat/profiles-export-import (3a03224)
• chore(release): bump version to 0.8.2b1 (4a3894a)
• feat(profiles): portable export/import + sharing (mirrors stacks) (8a5d71c)
• Merge pull request #961 from Hal0ai/feat/stacks-focus-ui (b71e592)
• test(profiles): update bench-metric selector to .pf-card-metric (d69dd18)
• feat(profiles): match the Stacks library-card style (acc0547)
• feat(stacks): Focus layout from the design handoff (1e26db0)
• Merge pull request #960 from Hal0ai/feat/stacks-slot-create-snapshot (70b849e)
• fix(stacks): live snapshot + create-on-apply + slot picker (feee88c)
• Merge pull request #959 from Hal0ai/feat/stacks-routes-mcp (9927c59)
• feat(stacks): dashboard UI — #slots/stacks (PR-5) (425409a)
• feat(stacks): ship saber/forge/pi seed stacks (PR-6) (d200525)
• feat(stacks): REST routes + MCP admin tools (PR-4) (e81fb18)
• ci: run coverage only on main pushes, not PRs (aa449fe)
• ci: faster PRs + wider main coverage, concurrency, least-privilege perms (ef9d50a)

hal0 v0.8.1-beta.2

Bugfix on the 0.8.1 beta line — restores fleet auto-update. Safe upgrade from
v0.8.1-beta.1.

Fixed

• Updater version comparison uses PEP 440. hal0 update compared versions with
  a digit-tuple parser that split on . and stripped non-digits per segment, so the
  pip-normalised installed beta 0.8.0b3 parsed to (0, 8, 3) and the tag-form
  manifest 0.8.1-beta.1 to (0, 8, 1, 1) — (0,8,1,1) > (0,8,3) is false, so
  every box on a 0.8.0bN beta saw the new release as "not newer" and hal0 update
  reported nothing to apply (the installed beta number was misread as the patch
  component). The comparator now uses packaging.version.Version in both the updater
  and the API route, falling back to the digit-tuple only for non-PEP-440 nightly
  tags (whose timestamp ordering still relies on it). (#957)

hal0 v0.8.1-beta.1

Installer/privilege simplification + Hermes durable memory on by default. The
hal0-api privilege seams (hardened unprivileged mode, the slot privilege seam)
are gone, and a fresh hal0 agent bootstrap hermes now provisions a working
durable-memory provider out of the box.

Added

• Hermes durable memory enabled by default. Provisioning now ships a working
  hal0-memory provider and sets memory.provider=hal0-memory, so Hermes gets
  cross-session recall with no manual config. Two banks — private:hermes
  (default) and shared (cross-agent) — backed by hal0's Hindsight engine via
  the hal0-api REST front door; reads union both banks. The provider exposes
  hal0_memory_{search,recall,add} (with shared=true to write the shared
  bank) and auto-injects recalled context each turn. (#955)

Changed

• Hermes agent identity is hermes (was hermes-agent), matching the
  hal0 agent registry. The agent-id is the single source for the
  X-hal0-Agent MCP headers, the persona memory namespace, and the prelude. (#955)
• Memory plugin install path fixed. The plugin is copied to
  $HERMES_HOME/plugins/hal0-memory/ (a direct child of plugins/, which the
  Hermes loader actually scans) instead of the nested plugins/memory/… that
  never loaded. (#955)

Removed

• Hardened (unprivileged hal0-api) mode removed; hal0-api runs as root.
  Dropped live-hello; fixed ready-summary IPs. (#953)
• Dormant slot privilege seam removed (hal0-slotctl + euid routing). (#954)

Breaking

• Hermes memory namespace renamed private:hermes-agent → private:hermes.
  Existing private:hermes-agent data is not auto-migrated; reprovisioned agents
  start recalling from private:hermes + shared. (#955)

hal0 v0.8.1-nightly.20260623085944

Nightly v0.8.1-nightly.20260623085944 — changes since v0.8.0-nightly.20260622113640:

• Merge pull request #958 from Hal0ai/release/0.8.1-beta.2 (3472a48)
• chore(release): 0.8.1-beta.2 (9c5dd5e)
• Merge pull request #957 from Hal0ai/fix/updater-version-compare-pep440 (35cadc2)
• fix(updater): compare versions with PEP 440, not a digit-tuple (af47413)
• Merge pull request #956 from Hal0ai/release/0.8.1-beta.1 (72b2274)
• chore(release): prep 0.8.1-beta.1 (fa350cb)
• Merge pull request #955 from Hal0ai/feat/hermes-memory-private-shared-banks (95d1c98)
• test: read whole hal0-memory package for the plugin-present check (9874df2)
• style: ruff format the updated hermes memory tests (1239cd5)
• fix(hermes): restore coder persona + update tests for the new memory plugin (35cb600)
• feat(hermes-memory): ship hal0-memory provider by default (private + shared banks) (9c22f81)
• Merge pull request #954 from Hal0ai/refactor/drop-slotctl-privilege-seam (f4a8638)
• test: drop comfyui non-root sudo test (seam removed) (92ea316)
• refactor: remove the dormant slot privilege seam (hal0-slotctl + euid routing) (4eb7f2c)
• Merge pull request #953 from Hal0ai/refactor/installer-drop-hardened-mode (589c05f)
• refactor(installer): remove hardened (unprivileged hal0-api) mode; drop live-hello; fix ready-summary IPs (8177d4f)
• Merge pull request #951 from Hal0ai/feat/canonical-llm-roles (0bb463f)
• chore(release): 0.8.0-beta.3 (ADR-0023) (1aa7163)
• style: ruff format ADR-0023 line-wraps (11f88c2)
• style: ruff format extraction_env.py (da7d350)
• fix(tests): drop duplicate MemoryItem import (ruff F811/RUF100) (75d26b4)
• feat(memory,slots)!: canonical llm roles agent+utility; wire memory extraction_slot; remove cognee (ADR-0023) (c4c77a8)
• Merge pull request #950 from Hal0ai/release/v0.8.0-beta.2 (9002c2f)
• release: v0.8.0-beta.2 — board live-updates + hermes env-seam bugfixes (f794365)
• Merge pull request #949 from Hal0ai/fix/board-ws-token-harvest (a29c5b0)
• style(board): ruff format board_ws + test (22419dd)
• fix(board): harvest rotating Hermes token for the events WS bridge (b487ad5)

hal0 v0.8.0-beta.3

Canonical LLM roles + Hindsight-native memory extraction
(ADR-0023). The two
canonical LLM roles are now agent (the capable default + fallback anchor,
replacing chat) and utility (the cheap helper, now seeded on every
install). chat and primary are retired as slot/role names.

Changed

• Canonical roles are agent + utility. agent replaces chat as the
  default/anchor everywhere (seeded slots, dispatch rule-9 fallback, the default
  pin set, _configured_primary). utility joins SEEDED_SLOTS so a fresh box
  never silently falls back to a heavy model for cheap extraction.
• Generalized virtual addressing. Any enabled type=llm slot X is now
  addressable as hal0/X (chain (X, agent)); the advertised canonical virtuals
  are hal0/agent, hal0/utility, hal0/npu.
• Memory graph extraction is operator-selectable and actually wired.
  [memory.graph].extraction_slot names the local llm slot Hindsight uses for
  graph extraction; hal0 propagates it to hindsight-api via a systemd drop-in
  (HINDSIGHT_API_LLM_MODEL=hal0/<slot>) + restart. hal0 memory graph enable
  takes --slot <name> (validated against the live enabled-llm-slot set).
• Cognee fully removed. The Cognee engine + wrapper are deleted; Hindsight is
  the platform engine (with a PgVector boot-degrade fallback). MemoryRecord
  survives as an alias of MemoryItem.

Breaking

• hal0/chat is no longer advertised. Clients pinned to hal0/chat (Hermes,
  OpenWebUI, any custom consumer) must repoint to hal0/agent.
  Hermes model.default is now hal0/agent.
• memory.graph.route / memory.graph.upstream removed, replaced by
  memory.graph.extraction_slot (default "utility"). Old route/upstream
  keys in hal0.toml are silently dropped on load (no hard-fail on upgrade). The
  hal0 memory graph enable --route/--provider/--model options are gone — use
  --slot.
• primary is no longer a slot alias. SLOT_ALIASES is {"agent-hermes": "agent"}.

hal0 v0.8.0-beta.2

Bugfix release on the 0.8.0 beta line. No behaviour changes beyond the two
fixes below — a safe upgrade from v0.8.0-beta.1. First release to carry #948.

Fixed

• Operator Board live updates restored. The board's events-WS proxy
  (/api/board/events) resolved its upstream Hermes session token from the
  HERMES_SESSION_TOKEN env var only, while the REST path harvests the
  rotating per-process token from the dashboard HTML. With no env pin (the
  default), the WS connected upstream with no token, Hermes rejected the
  upgrade (403), and the browser socket died with 1011 — so tasks created in
  Hermes loaded on refresh but never pushed live to the board. The WS bridge
  now shares the REST client's token resolution (env-pin → HTML-harvest →
  rotation cache) and re-harvests + retries once on connect failure. (#949)
• Hermes privileged env seam. A privileged env-write seam lets the
  unprivileged provisioner write root:root .env files, so Hermes agent
  config provisioning works under the dropped-root hal0-api. (#948)

hal0 v0.8.0-beta.1

First beta of the 0.8.0 line — the model-config, Hermes, and permissions
overhaul. Configuration becomes a declarative single source of truth
(Stacks + single-source launch argv), Hermes consolidates onto its own
config ownership, and hal0-api can finally drop root. Voice (TTS + STT)
lands end-to-end. One behaviour change to be aware of: the hal0/primary
and hal0/flm virtual aliases are gone — see Changed.

Added

• Stacks — declarative config SSOT. A StackConfig schema plus a
  StackApplyEngine that plan()s a Stack into a ChangeSet, apply_config()s
  it as an atomic commit with rollback, and converge()s the live slot set
  (primary-slot load/swap/skip + capability-child routing through the
  orchestrator). Content-hash drift detection and an active-stack pointer,
  export/import via a checksummed .hal0stack.json envelope, snapshot of live
  config into a Stack, and a StacksCatalog CRUD with seed guards. Seed stacks
  (saber / forge / pi) derived from the roster bench.
  (#921, #923, #925, #926)
• Voice stack — TTS + STT. Brought up and verified end-to-end: voice_wire
  fixed, Open WebUI Call mode wired, and the NPU-trio facade auto-provisions
  STT. (#924, #928)
• Single-source slot argv (overhaul stream A). A resolver dedups the launch
  flag soup down to a last-wins canonical command; per-flag provenance is
  exposed at GET /api/slots/{name}/resolved, and the slot Edit drawer renders
  the resolved command with per-flag source badges (base / profile /
  extra_args). (#929, #930, #931, #932)
• Capability-based slot fallback. When a slot's model.default isn't
  locally servable (registered-but-no-file, or pulled-away), load() falls back
  to the best locally-registered model matching the slot's capability —
  excluding diffusion / image / video models and preferring name-similarity to
  the configured id. (#940, #942)
• Hardened permissions — run hal0-api unprivileged (opt-in). Set
  HAL0_USER=hal0 and the installer drops the API off root: a declarative
  ownership table (audited read-only by hal0 doctor perms), a narrow
  privileged seam (hal0-slotctl + a no-wildcard sudoers grant) so the
  unprivileged API can still write per-slot units and drive hal0-slot@*, and
  a codified flip (run-as drop-in + recursive chown of config + state, pruning
  agents/ + secrets/ + the models dir). Slot containers stay rootful — the
  container remains the sandbox boundary. Default HAL0_USER=root is
  byte-for-byte unchanged. (#929, #943, #944, #945)
• Hermes owns its own config. The runtime is unpinned with a real upgrade
  path, and a config-set overlay replaces the whole-file config.yaml render —
  Hermes owns and self-migrates its config while hal0 layers only its keys.
  (#934, #938)
• Chat-template render-validation. The template catalog is render-validated
  so a broken template can no longer ship silently. (#917)

Changed

• Breaking — hal0/primary and hal0/flm virtual aliases removed. Virtual
  model names now map 1:1 to their resolution chains; hal0/primary no longer
  resolves (use hal0/chat) and hal0/flm is gone (use hal0/npu). Slot-name
  back-compat is intentionally kept, and the Hermes overlay now emits
  model.default: hal0/chat. (#939)
• q8_0 KV cache, universally. Main and MTP-draft KV caches are now q8_0
  across slots — near-lossless and keeps fused FlashAttention on AMD HIP. (#933)
• Profiles lift bench-tuned MTP config into rocm-moe / rocm-dnse. (#922)
• Open WebUI disables PersistentConfig so the env prewire wins the chat
  connection. (#927)
• Docs mirrored from hal0-web.

Fixed

• Installer — setup --storage-dir is passed as a separate argv token so
  fresh --models-dir installs seed slots correctly (#946); the hardened-perms
  flip chowns config + state recursively so a root→hal0 upgrade doesn't strand
  root-owned state subdirs (#945); hermes gateway install runs
  non-interactively and skips enable when the unit is absent (#941); a
  lemonade-team PPA is added so the FLM/NPU .deb resolves on a fresh Ubuntu
  box (#937); the registry scans the effective store / pull_root rather than
  only declared roots (#935).
• Hermes gateway marks its EnvironmentFile optional (-) so fresh
  installs don't crash-loop on a missing secrets vault. (#936)
• Dependencies — bump vulnerable deps flagged by Dependabot. (#919)