v0.6.0

Frontend framework upgrade, landed as separate verifiable steps rather than one bundled dependency PR.

Changed

• React 18 to 19, and Next.js 15.5 to 16.3.
• Next 16 removes next lint, so linting moved to the ESLint CLI. .eslintrc.json became eslint.config.mjs in flat-config form and the lint script is now eslint .. ESLint stays on 9.x and TypeScript on 5.x: eslint-config-next bundles an eslint-plugin-react that calls the context.getFilename() ESLint 10 removed, and typescript-eslint refuses to load against TypeScript 7.
• Dependabot now holds back typescript 7, eslint 10 and tailwindcss 4. Web deps update as one group, so a single incompatible major was turning the whole batch red and blocking the safe bumps behind it.

Fixed

• Every brace-containing glob threw TypeError: expand is not a function. The brace-expansion override pinned the whole tree to 5.0.9, which is ESM-only, but minimatch@3 needs the v1 CommonJS default export. Each vulnerable major is now pinned to its own patched release, so the advisories stay closed and both API shapes resolve.
• The hero event stream called setCount synchronously inside an effect body, causing cascading renders. Reduced motion now reads through useSyncExternalStore, which is SSR-safe and responds to preference changes live.

Full changelog: v0.5.0...v0.6.0

v0.5.0 — new identity, real CI, and the bugs that found

Turning security gates on is what made this release worth cutting. Three of the fixes below were live vulnerabilities nothing was looking for.

Try it: https://atlas-ra.vercel.app

The site was loading no fonts at all

tailwind.config.ts referenced --font-sans, but nothing defined it and body never applied font-sans. Every page had been rendering in the browser's default serif. It read as a deliberate editorial choice in screenshots; it was unstyled default.

New visual identity

IBM Plex Sans for text, Space Grotesk for display, IBM Plex Mono for code and event badges — self-hosted through next/font. An indigo signal colour on cool blue-black, with a dot-matrix backdrop.

Emerald is demoted to exactly one job: the semantic done / approved / verified state. Brand and success were previously the same green, so "this is ATLAS" and "this task passed" looked identical — on a dashboard about verification state, that was the wrong signal.

A real pipeline

Was: two jobs, floating action tags, no permissions block, one Python version, no dependency or secret scanning.

Now: lint + format, mypy --strict, tests on 3.10/3.11/3.12, evals, gitleaks over full history, pip-audit, licence check, npm audit, tsc --noEmit, and build. CodeQL and OpenSSF Scorecard weekly, plus a security heartbeat every third day. Actions pinned by commit SHA, with Dependabot watching them.

What the gates found

• cryptography 49.0.0 carried PYSEC-2026-3552 → 50.0.0.
• Next.js 14.2.35 carried a high-severity Image Optimizer DoS advisory → 15.5.23. The app uses no next/image and no async request APIs, so the migration surface was empty.
• brace-expansion, fast-uri, glob, nanoid, js-yaml, postcss, and sharp all sat inside advisory ranges.
• 15 backend files were unformatted.
• The API reported version 0.1.0 while the package was 0.4.1.

Also fixed

• The hero event stream sliced its step list, so the card grew as steps appeared and shoved the page down. Steps now stay mounted and fade in, reserving full height from first paint.
• The preview notice claimed atlas serve would switch the hosted page to real data. Browsers block an https origin from calling http://localhost, and the API allows only http://localhost:3000 as a CORS origin — it never could.
• The README architecture diagram rendered as a sprawl of crossing edges. Replaced with the task lifecycle, verified against mermaid 11 before committing.

Full changelog: https://github.com/harshitwandhare/atlas-ra/blob/main/CHANGELOG.md

v0.4.1 — corrections and README gallery

Patch release for corrections found while building the README screenshot gallery.

Fixed

An overclaim on the landing page. v0.4.0 shipped with a hero stat reading 4 execution tiers. executors/registry.py documents four (1=API/code, 2=CLI, 3=browser, 4=screen), but default_registry() only registers tools at tiers 1 and 2 — run_python, run_powershell, delete_path. Tiers 3 and 4 are roadmap, which docs/REQUIREMENTS_AUDIT.md already said plainly. Sitting beside "3 swappable providers", where all three are real, it read as four working tiers. Now 2 execution tiers live.

Everything else on the page was cross-checked against source and holds: three providers, three teams plus the Critic, three memory tiers, all six gateway routes, and every engineering claim in the marquee.

Two layout bugs, both surfaced by looking at the captures rather than the code:

• Hero stats packed from the bottom via flex-col-reverse, so the single label that wraps to two lines pushed its number a line above the other three.
• /console centred itself in max-w-3xl while the preview banner filled the whole main, leaving their left edges misaligned. All dashboard screens now share one container.

Added

scripts/capture_screens.py — regenerates the README screenshots from the deployment (or any --base-url) with headless chromium. Animations are frozen before capture so reruns are deterministic, and the landing page is captured as viewport-sized sections rather than one ~12000px stitch that tears on the animated marquee.

README now leads with the landing page and carries a gallery of the site and dashboard. Preview captures live in docs/screenshots/preview/, deliberately separate from the real-run screenshots against a local Ollama instance, which the deployment cannot reproduce.

Full changelog: https://github.com/harshitwandhare/atlas-ra/blob/main/CHANGELOG.md

v0.4.0 — landing page and hosted preview

ATLAS now explains itself. The root route was previously the goal-submission view, so anyone opening the deployment landed on an unexplained text input; and because the dashboard talks to a local backend, every screen behind it rendered empty.

Try it: https://atlas-ra.vercel.app

Added

Landing page at / — why the project exists (stateless, unverified, unbounded agents), the five-checkpoint task lifecycle, a six-layer architecture diagram with the provider protocol called out as the seam, a capabilities grid, the engineering gates, and a local-first quickstart. Includes an animated replay of a real event stream: task_created → routed → skill_matched → message_delta → review → critic approve → done.

Hosted-preview mode — when the dashboard cannot reach a backend it serves sample tasks, skills, approvals, and events behind a notice stating plainly that the data is illustrative and the controls are inert. Detection is per-request rather than an environment flag, so a local run with atlas serve up shows real data with no configuration, and starting the server mid-session swaps the samples out without a reload.

Changed

• Goal submission moved from / to /console; dashboard screens now live in an (app) route group behind the existing sidebar.
• Dashboard styling moved onto CSS custom properties wired into Tailwind, replacing ad-hoc zinc-* classes.

Fixed

• GET /tasks/{task_id} returned HTTP 200 with an {"error": "not found"} body for an unknown id; now returns 404.
• POST /approvals/{request_id} raised a bare KeyError for an unknown id, surfacing as an unhandled 500; now returns 404.
• Hero stats paired an sr-only <dt> with a visible <dd> holding the same text, so screen readers announced every label twice.
• backend/uv.lock had silently stayed at 0.3.1 through the entire v0.3.2 cycle.

Full changelog: https://github.com/harshitwandhare/atlas-ra/blob/main/CHANGELOG.md

ATLAS v0.3.1

Patch release focused on retrieval durability, plus the branding and open-source docs added since v0.3.0.

Fixed

• Semantic memory resilience — SemanticStore.search now skips blank or half-written records in the append-only docs.jsonl instead of raising JSONDecodeError. A write interrupted by a crash can no longer take down retrieval for every later query. This brings the semantic store in line with how the skill store already tolerates malformed files, and is covered by a new test.

Added

• Brand — geometric peak logo (light/dark variants) wired into the README and dashboard.
• Docs — SECURITY.md policy and an expanded CONTRIBUTING guide for the public release.

Full history in CHANGELOG.md.

ATLAS v0.3.0

First public release.

ATLAS is a multi-team AI agent system: an orchestrator routes goals to specialist teams, a Critic verifies every result before completion, three memory tiers (episodic SQLite ledger, semantic store, versioned skill playbooks) make it compound over time, and destructive host actions are human-approval-gated in code. Ships with a live Next.js dashboard, a typed CLI, three interchangeable providers (Claude Agent SDK / LangGraph / Ollama), an eval harness in CI, and ready-to-load ComfyUI + TouchDesigner workflows for generative-AI lab work on a 10 GB VRAM budget.

Highlights of this release:

• 55-test suite (unit, integration, API+WebSocket, CLI, full e2e) — mypy strict, ruff, evals all gating CI
• Crash-supervised task runs: provider failures escalate cleanly, never orphan a task
• Non-blocking local inference (Ollama) — the dashboard stays live during generation
• Real screenshots in the README from a fully local, zero-cloud run
• Docs: architecture, data models, operations manual, version matrix, honest requirements audit, security policy

See CHANGELOG.md for the full history.