v0.4.0

0.4.0 (2026-07-31)

� BREAKING CHANGES

• policies: fold managed overrides into head rules in the engine

Added

• audience-scoped sandbox credentials � llm/tool/control/workspace split (#33) (fa87936)
• bring your own MCP server, intuitively + authoritative harness/model (#24) (ac7653f)
• broker,db: tear down upstream MCP sessions from any replica (#34) (7007ac5)
• capabilities: design-doc Phase 5 � capability & MCP catalog (c31f3e0)
• catalog: connector-catalog bulk import � MCP Registry (primary) + open-connector (supplement) (#25) (6ee603e)
• catalog: decorate entries with live connection/bundle state; connected cards get Disconnect/Reconnect (b1da355)
• chart: archive object store and replica declaration (#34) (95ad63d)
• ci,dx: non-vacuous CI, supply-chain gate, GHCR distribution, user guides, policy proptests (#22) (7aabf3b)
• ci: prove the permission gate with no model spend, and gate it on every PR (0e49849)
• ci: secrets acceptance matrix � KMS, invariant 20, virtual keys, RLS (#32,#75) (3bb321d)
• codex: codex-runner image + app-server supervisor; facade strips server tools (Phase 6 step 6) (b13a8ab)
• connectors: Phase 5.5 � connector catalog & OAuth credential custody (81e1887)
• core,server: frozen-schema argument enforcement at the gate (#33) (708cecc)
• core: connection requirements + run-binding fields on RunSpec (#31) (d72aedc)
• core: event invocation context + github result destinations + TrustTier::as_str (a6ed044)
• core: read-only trust tier classifier (fork events review, never write) (b9af0a8)
• db,server,chart: remove the ceilings that made 300 concurrent runs impossible (#34) (e7ecb3d)
• db: 0013 appendix � legacy brokered bundles to connection requirements, subscriptions repointed (#31) (4de4e9c)
• db: atomic subscription+schedule update with stale guard (042655c)
• db: event delivery/dispatch/external-result tables + trust-tier & dispatch binding (migration 0005) (0891d45)
• db: identity layer � migration 0012, TenantScope, identity repositories (#30) (86395a8)
• db: migration 0013 � connection ownership, tool snapshots, run resource bindings (#31) (b632736)
• db: RLS policies + tenant GUC plumbing, wave A (#32,#75) (9f27a47)
• db: RLS wave B � identity + audited system_worker bypass (#32,#75) (cd5f00d)
• demo: fixture repo + demo compose (3c1f5c9)
• demo: just demo � five-minute no-key first-run + validation drills (007da29)
• dev: local Postgres container replaces Neon for local development (21c5b03)
• docs,web: public /docs platform � relocated engine, search, new guides (f3b4454)
• docs,web: repo docs tree + in-app /developer docs engine (7865c42)
• durable automation API contract, PATCH /v1/triggers/{id}, self-explanatory template box (db19dba)
• dx: one-command bootstrap (just setup) + environment preflight (just doctor) (d4bb3b9)
• dx: one-command bootstrap (just setup) + environment preflight (just doctor) (3ae195c)
• e2e: codex phase 10 (protocol replay + no-model probes + live tier) + deploy wiring (Phase 6 step 8) (95abec5)
• facade+gate: second dialect enforcement boundary, OpenAI metering, intent-based tool budget, approval digest binding (Phase 6 step 4) (955bc57)
• github: expose updated_at/pushed_at in the repo picker projection (c3c12f1)
• github: Phase 5.6 � seamless GitHub connect via App manifest + install dances (c56638f)
• governance: the Governance page � per-tool permissions matrix + managed overrides (#36) (e7a253f)
• governor,db: cross-replica egress governance � durable rate windows + breaker (#34) (023c151)
• harness: server-side harness registry; per-harness API defaults; orchestrator env seam (Phase 6 steps 1-3) (fd2b266)
• k8s: Phase 0 � provider seam + collection hardening (Docker-only) (#49) (7930e96)
• k8s: Phase 1 � KubernetesProvider + workspaced collector + dual listener (#50) (223e5e8)
• k8s: Phase 2 � Helm chart + verified network hardening + per-cloud presets (#51) (336bc92)
• k8s: Phase 3 � CI + provider conformance (#52) (8c54b7b)
• phase-f: Codex review gate fixes + operational metrics (#34) (54df7e0)
• policies: append-only policy_versions � migration 0026 + storage (eb1232b)
• policies: codex-review hardening � CAS publishes, strict drafts, enforced append-only (b72f35a)
• policies: DB-native policies � versioned storage, structured authoring, attachment (�17 #11) (eb0d426)
• policies: fold managed overrides into head rules in the engine (45eda12)
• policies: retire policy-sync; governance e2e for the versioned model (319679e)
• redact,codex: scrub OpenAI project keys + fbx session/trigger tokens; codex-runner package.json (Phase 6 step 6 prep) (5fea3e2)
• replay-runner: deterministic replay driver + transcript (d14c77e)
• replay-runner: image + just replay-build (a40639b)
• runner: move the control token off the environment before exec (#34) (a9a5bea)
• runner: shared runner-lib (contract + shims) + token-renew loop + server-side renew hardening (Phase 6 step 5) (ffc57fe)
• scripts: db-clean-tests � a scalpel for test residue, not a reset (#46) (ee9bfb5)
• server,db: approval single-emission + pg_notify, session lease/epoch fencing, delivery claims (#33) (800f8c3)
• server,db: durable four-state execution claims around brokered dispatch (#33) (33dcf45)
• server,db: durable request-keyed LLM budget reservations (#33) (757d87e)
• server,db: one-time browser-bound OAuth state rows (#32) (ab6f82e)
• server,db: reusable OAuth client registrations (#32) (f075a8c)
• server,db: versioned envelope sealing with per-tenant DEKs (#32) (34d4898)
• server,workspace: workload identity, archive object store, load harness (#34) (33fefb8)
• server: /v1/admin/orgs � break-glass, IdP lifecycle, issuer migration (#30) (c1906bb)
• server: /v1/auth � IdP-agnostic OIDC login, sessions, switch, logout (#30) (c659a45)
• server: binding consumers � broker/workspace/publish rechecks, approval authority (#31) (3c003e7)
• server: binding resolution service � requirements to frozen run resource bindings (#31) (b301e3f)
• server: connection ownership � personal/organization owners, use authorization, /auth/me user_id (#31) (e09388e)
• server: connection tool snapshots � forced-negotiation photograph, bundle cutover, generation custody (#31) (ba08d91)
• server: contract URL + ingress helpers on trigger get/list/rotate (de85bf0)
• server: event trigger subscriptions � connection binding, $17 #2 default events, publish modes (273922d)
• server: fork trust tier is real � read-only enforcement at the permission gate (7a070dd)
• server: github app connections � rs256 jwt, installation tokens, sealed webhook secret (e3b869f)
• server: github connector � webhook verify + PR normalize behind the seam (74390cc)
• server: outbound rate limits + per-connection circuit breakers (#33) (79dc55b)
• server: PATCH /v1/triggers/{id} for the mutable subscription surface (3c48b8e)
• server: per-run MCP session manager + 2025-11-25 conformance (#33) (89dbaa9)
• server: per-tenant LiteLLM virtual keys; master key confined to provisioning (#32) (1275ae2)
• server: PR comment/check publishers � stable update-in-place identity, App-only (74fd34e)
• server: Principal resolver, RBAC, PATs, CSRF � identity enforcement (#30) (e469d09)
• server: provider-ignorant event spine � ingress, two-level dedup, subscription fan-out (f339538)
• server: pure PATCH resolution for trigger subscriptions (973d83a)
• server: resumable legacy�KMS re-seal with count parity (#32) (b39b5dd)
• server: shared egress boundary � SSRF-hardened clients + clone admission (#33) (739f6b2)
• web: app-store composer � unified AppPicker, guardrail presets, plain language (9e90e45)
• web: bundle picker for agent attach � select registered capabilities instead of typing refs (ba4269a)
• web: connection ownership, tool snapshots, requirements editor, explicit bindings (#31) (f599f1b)
• web: dashboard redesign � 5-item IA, dark design system, app-store integrations (c6eb415)
• web: durable /automations/{id} page with live API contract (680083b)
• web: edit template and settings on the automation detail page (8a57fc9)
• web: enable codex harness; per-harness models reset on switch (Phase 6 step 9) (0c3170f)
• web: extract pure automation-contract helpers (a2f67d1)
• web: FLUIDBOX_WEB_MODE sso proxy, login page, session shell (#30) (2991ace)
• web: homepage v2 � patterns grid + real-product visibility section (9319363)
• web: improve control-plane UX and resilience (709114f)
• web: marketing site redesign � dark editorial system, film hero, end-user pass (1b9e52c)
• web: move the dashboard under /app � the public/app boundary (293ba74)
• web: policy attachment + structured authoring (specs A & C) (0c8ba6e)
• web: public marketing site � home, product, open-source, security, pricing, changelog (3d8eb25)
• web: self-explanatory template box + pre-save API preview (42d44dc)
• web: SEO surface � sitemap, robots, OG/Twitter card, noindex boundaries (21db1ea)
• web: server-side auth gate � sso login wall, session-aware /login, deep-link return (93f6ed6)
• web: shared AutomationContract; secrets modal is secrets-only (2d0f5af)
• web: surface the brokered execution outcome in the run timeline (#33) (3d97cf5)
• web: unify dashboard and run workflows (#26) (e3a475d)
• web: WorkOS AuthKit web-tier gate for /app (FLUIDBOX_WEB_AUTH=workos) (04019dc)

Fixed

• capabilities: admit real-vendor tool manuals in the photograph screen (738d758)
• ci,docs: strengthen false-green asserts; correct the go_url residual disclosure (#32) (fb65948)
• ci: bindings-e2e � instant provisioning failure via dead-registry image ref; settle budget 300s (#31) (033ace0)
• ci: CI round 2 � __Host- flow cookie, DB fixture shapes, family lockstep, AWS SDK rustls stack (#32) (2d7657b)
• ci: identity-e2e � curl -w composition, psql tuple-only captures, fail-fast preconditions (#30) (196e2a7)
• ci: read gate-proof evidence through a container, not from the host (23a44ab)
• close the three P2s, pin the runner supply chain, gate publishing (#112) (19b7f7d)
• codex: correct item/tool/requestUserInput response schema to {answers:{}} (Step 6 re-review) (b68a300)
• codex: incorporate Step 6 review � governance completeness, move-path, state dirs, schemas (codex/gpt-5.6-sol) (d080064)
• codex: make the codex harness actually start (it never did) (b7a4d8f)
• core: govern every tool the pinned CLI advertises; deny sub-execution (c0aa531)
• core: register ToolSearch in the canonical tool vocabulary (92fec3c)
• db,ci,docs: final-review wave � RLS blast radius, e2e port, runtime-role coverage (#32) (6c0e5f9)
• db,server: Codex verify � ingress scope-after-verify, switch config-lock, residual predicates (#30) (5549e5b)
• db,server: drop the unused delivery-claim index; scope the epoch-fence claim (#33) (b626ba8)
• db,tools: catalog importer targets the global partial slug index; isolate mcp-shape CHECK negative (#31) (ff6c74e)
• db: 0013 conversion � branch coverage tests, mixed-bundle drop notice, safe string-pin parse (#31) (357762c)
• db: 0013 conversion � floating keep-lists, append-only clone for sandbox-latest (#31) (f622fb7)
• db: 0013 conversion � fresh next-rev per appended revision (#31) (9c99601)
• db: 0013 conversion � per-source revisions, keep-list-preserving repoints (#31) (eafad54)
• db: Codex round-1a � write-side tenant proofs, switch-claim hardening, audit truncate guard (#30) (187fb6d)
• db: final-review minors � projections, user_status symmetry, bootstrap/migrate test gaps (#30) (581f26f)
• db: RLS review wave � role posture validation, enumerated grants, audit tenant floor (#32) (09e1cdf)
• db: scope the sweeper tests to their own session (#33) (d4fb57d)
• db: switch-claim takes the config lock first; jwks cache active-only (#30) (d00d348)
• db: the 0013 conversion is a GLOBAL scan � confine the tests to one tenant (#32) (2932aa9)
• demo: fail when the run fails; agree with the server on the docker daemon (40ce3c9)
• demo: prove the daemon can read the checkout before running (18fc153)
• demo: the from-source first run was broken; add static self-checks (b52a554)
• e2e,core: three SCRIPT defects behind the first hardening run (#33) (14d6f64)
• e2e,ledger: codex phase green (16/16) � summarize() lists edit paths; replay assertion counts (41a3081)
• e2e: deflake trigger rotation race; align github phase with #33 identities (9817bf1)
• e2e: make no-live mode zero-spend and deterministic (closes the CI flake class) (#23) (89f518c)
• e2e: strip stray ellipsis byte that broke e2e.sh preflight under set -u (8c4657a)
• e2e: suite fixes surfaced by the full local run (611/0 across the five phase suites) (ccaf199)
• e2e: WRONG ASSERTION � (i.4) demanded 'cancelling' its own fixture cannot produce (#33) (0f0da8e)
• eval: quote the required-token message, and make the guard parse the file (4377c96)
• eval: require an admin token; loopback the dashboard; guard both in CI (3bbf73b)
• facade,e2e,web: post-ship Phase 6 correctness review (894cbc4)
• facade+gate: incorporate Step 4 review � dup-key differential, verdict CAS, NULL-digest fail-closed, dialect errors, SSE cap (gpt-5.6-sol xhigh) (30bc78c)
• final-review follow-ups � preserve next_fire_at on cadence-neutral PATCH, no-op {} schedule, clearer errors/hints (37ac1db)
• gate: CAS-first on the budget + approval-timeout paths (Step 4 re-review) (c9e5d75)
• gate: server-side /result idempotency across revoke + /permission terminal check (Step 5 re-review) (94a854a)
• github: drop default_events with the webhook on non-public deployments (9185202)
• github: omit the webhook from manifests on non-public FLUIDBOX_PUBLIC_URL (6de3334)
• k8s: archive streaming � pack to disk with a size cap, stream the GET, reclaim leaks (M4, L3) (1b238a2)
• k8s: batch-5 Codex round 2 � toleration fidelity, render-time validation, release binding tightened (c45f90b)
• k8s: batch-5 Codex round 3 � strict toleration fields, semver tag guard, doc truth (09bab0d)
• k8s: batch-6 Codex round 2 � pod-side streaming, atomic pack, fail-closed caps, safer archive lifecycle (bed3217)
• k8s: batch-6 Codex round 3 � symlink-entry ceiling, session-state-aware TTL sweep, quieter-never-silent failures (8b945be)
• k8s: batch-7 Codex round 2 � rolling-deploy-safe reconcile, guarded adoption, honest no-handle collection (8a6a2af)
• k8s: batch-7 Codex round 3 � boot-sweep parse parity, honest label mismatch, launch-mins floor (732334e)
• k8s: buffer the archive file reader in workspaced init (7ddacad)
• k8s: cleanups � fail-closed gate resolution, UID-guarded deletes and collection, quiesce replay (L2, L10, L11) (8c78339)
• k8s: cleanups � fail-closed gate resolution, UID-guarded deletes, quiesce replay (L2, L10, L11) (4ec0b09)
• k8s: close the Codex round-2 findings on the finalizer (M1 pre-handle window + 8 defects) (8d01bfe)
• k8s: close the netpol admission race with a bounded observation protocol (95e8459)
• k8s: enforce a fresh destination before extract/copy (Codex batch-3v3) (98f4ebb)
• k8s: extract in-tree symlinks in the workspace archive (H4, L4-pack) (db11f77)
• k8s: extract in-tree symlinks in the workspace archive (H4, L4-pack) (09230b6)
• k8s: finalizer durability � winning intent is the single source of truth (H2,H3,H5,M1,L6,L7) (f10e3ce)
• k8s: harden symlink extraction + preserve links in copy_tree (Codex review of #61) (a0fa0a8)
• k8s: helm�provider wiring � sandbox values reach the provider, digests render, probe gate parity (M3, M9, M10, L12) (428a5dd)
• k8s: helm�provider wiring � sandbox values reach the provider, digests render, the boot probe gains gate parity (M3, M9, M10, L12) (9adb745)
• k8s: install ring CryptoProvider so the Kubernetes provider boots (3fc508e)
• k8s: install ring CryptoProvider so the Kubernetes provider boots (54a292b)
• k8s: integrity-check exec-collected diffs, resume dropped streams (M2, L4-exec) (7e8e95c)
• k8s: listener hardening � no /internal on the public plane under K8s (M8, L1, L5, L8) (4453b11)
• k8s: make canonicalize the sole symlink-containment authority (Codex re-review) (06f518c)
• k8s: make the kind-calico CI tier a real check (H1) (#60) (e84ea64)
• k8s: numeric runAsUser for bundled LiteLLM (365e657)
• k8s: numeric runAsUser for bundled LiteLLM (root image + runAsNonRoot) (319a8b3)
• k8s: reconcile � periodic adopt-or-terminate sweep, graded config errors, node-loss visibility, Docker-parity pre-launch diffs (M5, M6, M7, L9) (bd4fdeb)
• k8s: reconcile � periodic adopt-or-terminate sweep, graded config errors, node-loss visibility, Docker-parity pre-launch diffs (M5, M6, M7, L9) (f80b74b)
• k8s: refuse a symlinked destination in clear_dir_contents (Codex batch-3v4) (f3276c8)
• k8s: remove a duplicated match line that broke the build (batch-3 docs commit) (1c6bc5c)
• k8s: round-3 finalizer hardening � durable budget sweep, settle-window, verified RunResult (1efca79)
• k8s: round-6 � transactional attach fence, evidence-preserving abandon (7a225f6)
• k8s: rounds 4-5 finalizer convergence � intent-aware launch ownership, gated collection, self-cleaning losers (799ff63)
• make an audience mismatch fail loudly; tighten audience disclosures (#33) (787396e)
• oauth: gate CIMD on a fetchable public URL; re-resolve stale client identities (f55a588)
• policies: codex confirmation nits � fail-closed seeds, direct RLS probe, sharper e2e pins (5ddebeb)
• policies: codex final-review fixes � divergent YAML, preview staleness, strict imports (b688960)
• policies: review-response hardening � proportional seed refusal, policy delete, precise wildcard fold (adaa74c)
• release: close the three RC verification blockers (7647357)
• release: don't let the Cargo.lock step mask the real release-please error (#110) (1f28e3e)
• release: drop README.md from release-please extra-files (2d10b5d)
• release: let the version guard express a prerelease (4d6abf3)
• release: make release-please work with a virtual cargo workspace (#109) (f699bbe)
• review: address PR #27 whole-branch external review � 4 P1s, 3 P2s, 3 minors (0bec91a)
• runner-test: an unopened fd is a platform assumption, not a fact (#34) (b74d990)
• runner+e2e: Step 5 review � e2e build context, self-rescheduling renew, /result ack-on-revoke (gpt-5.6-sol) (1540d77)
• runner: gate EVERY Claude tool call via a PreToolUse hook (66e0bb2)
• scale-e2e: bound each concurrent gate request (#34) (b53fa43)
• scale-e2e: wait on the burst PIDs, not the whole job set (#34) (aee65df)
• scripts: governance e2e runs from any cwd; .env.example uses reachable bind (9d6dd7b)
• seed: bootstrap policies insert-if-absent so UI edits survive reboot (fc770ba)
• seed: source the curated agent's harness id + defaults through the registry (steps 1-3 review) (38a2f7d)
• server,ci,docs: refresh-singleflight bug, restore-drill fixture, global-row RLS asserts, runbook truth (#32) (ff9b00c)
• server,ci: audited JSON rejections; SSE exit-code assertion; comment accuracy (#30) (4562053)
• server,ci: oauth critical section on one pooled connection; AS error log sanitization; per-bearer init assertion after refresh (#31) (d533f24)
• server,ci: socket-peer client IP unless trusted proxy; e2e readiness path (#30) (1718a26)
• server,core: bound schema validation cost; close ambient-proxy, git-env and OAuth redirect holes (#33) (478707d)
• server,core: linear SSE parsing, capped server-request replies, bounded OAuth reads (#33) (8de3630)
• server,db,ci: connector_oauth_flows verifier joins the sealed-family lockstep (#32) (518a2bc)
• server,db,runner: adopt durable outcomes on lost CAS; tenant-partition the governor; stable shim idempotency (#33) (d5a974e)
• server,db: bound claim churn, unify the terminal refusal, gate the legacy path (#33) (3846b38)
• server,db: charge only on a durable usage write; repair two false-green guards (#33) (aa9e9ca)
• server,db: codex round findings � recheck seam, oauth atomicity, snapshot guards, xss (#31) (51f739c)
• server,db: land the OAuth custody bag inside the start's lock-holding txn (#32) (2e945ab)
• server,db: oauth bump-in-update + post-lock generation gate; sanitized upstream errors; capped discovery reads; trigger-token principal (#31) (d87fb88)
• server,db: OAuth review wave � activation CAS, bounded key recovery, mint cleanup (#32) (27bcc43)
• server,web,ci: Codex round-1c � arming locks, strict PATCH, proxy strictness, acceptance tightening (#30) (fa72847)
• server,web,ci: Codex verify 1c � lock-coherent PATCH/deactivation, audited refusals, interleaving tests (#30) (07058cb)
• server,web: tenant-scoped GitHub App flows; Phase C UI cutover fixes (#31) (8207972)
• server: approval decide_own excludes brokered calls; strict Decision body (#30) (89d5762)
• server: authorize the terminal MCP session DELETE (#33) (2dbe42b)
• server: bind the CAS to the real start epoch; tighten key-rejection classification (#32) (6a5989f)
• server: bindings � reject unknown explicit slots, github_app publish assert, authority-branch tests (#31) (40dd6e0)
• server: CIMD arm adopts existing registration identity (#32) (0ab091d)
• server: claim a deployment KEK identity before serving; sweep expired DEKs (#32) (7fda061)
• server: close the connector-OAuth SSRF pre-flight gap; admission layer + hardening asserts (#33) (dbdc7ed)
• server: Codex round-1b � artifact scoping, JWKS/claims hardening, redirect canonicalization, SSE bound (#30) (c6da453)
• server: Codex verify 1b � JWKS pairing/persistence, null claims, alg canonicality, SSE bound (#30) (797f255)
• server: conservative reservation bound; no duplicate GitHub effects; fence the launch writes (#33) (343c80d)
• server: final-review wave � retirement gate quadrant, registration FK + heal semantics, transit AAD purpose, tenant-key 401 recovery (#32) (b51cdb2)
• server: KMS review wave � KEK compatibility gate, DEK singleflight, bounded cache, audit fidelity (#32) (6950f21)
• server: oauth custody commits are checked � fail closed, never cache on ambiguity (#31) (1b830fe)
• server: oauth refresh � commit check dominates both result branches (#31) (d11d0bd)
• server: owner-role grants take the config lock; audit label + doc nits (#30) (cfe24d2)
• server: per-hop SSRF client for identity fetches; JWKS negative-cache scoping (#30) (f5cd53e)
• server: re-stamp delivery claims per attempt; tighten Task 6 disclosures (#33) (a9d27de)
• server: release the finalization claim when the driver lacks the lease (#33) (ea11853)
• server: route global registration writes through the audited bypass (#32) (2dd59d3)
• server: SSE re-auth bound holds across query awaits and backoff (#30) (0a4f6d2)
• web,ci: add-server wizard shapes; bindings-e2e coverage � ambiguity, publish binding, exact negotiation (#31) (24f50be)
• web,ci: requirement owner-aware binding mode; wizard snapshot settling; e2e � signature verification, workspace consumer proof, per-photograph negotiation (#31) (f927641)
• web: extract + test proxy security helpers; bare login route; apiPatch (#30) (a3acc5e)
• web: hide revoked registrations/connections; e2e leaves no live fixtures (6b70d02)
• web: label credentialless connections "no auth", not "api key" (#31) (90b20db)
• workers: sweep sessions stalled before launch; allow Created�Failed (b7d56f4)
• workspace,scale-e2e: two stale comments the whole-branch review caught (#34) (9019a48)

Changed

• db,server: TenantScope wave A � sessions, events, approvals, workers (#30) (9ad0abe)
• db,server: TenantScope wave B � agents, connections, triggers, create_run (#30) (6d3bff7)

Documentation

• $17 #1-#3 recorded settled; event-spine invariant + env seams in CLAUDE.md/.env.example (a5bb7f9)
• add a full Kubernetes deployment guide (acdb27a)
• add root CLAUDE.md for future Claude Code instances (81eb75d)
• CHANGELOG 0.2.0 section + EKS-acceptance handover (3d33a2f)
• CHANGELOG 0.2.0 section + EKS-acceptance session handover (1c533a1)
• claude: harness registry + canonical-tool-vocabulary invariant + two-image note (Phase 6) (f1ba07e)
• connector-catalog & OAuth-custody slice � research findings + dense session brief (user-selected next, ahead of Phase 6) (ff4b53f)
• correct four stale claims in the Phase E handover (#33) (ab484cd)
• correct Phase D truth-pass overstatements (#32) (d775dcb)
• correct the gate, egress and acceptance claims to what is actually proven (c8c61cc)
• correct the scale-hang root cause in the handover (#34) (26ff201)
• db: add insert_audit_standalone to the bypass inventory (#32) (5836e14)
• db: the migrate! reminder was stale for four migrations (#34) (76760d4)
• design agent workspaces and trigger integrations (fb1f4d3)
• design for the five-minute first-run demo + launch media (4e415b6)
• document the outbound rate-limit and circuit-breaker knobs (#33) (aa3491c)
• drop references to the removed source-spec file (4ec6037)
• eks: Phase-F live EKS acceptance � PASS, zero-orphan audited (f6bf7b9)
• full Kubernetes deployment guide (c967192)
• handover � 6.A hardening shipped; next is borrow-the-agent (user decision) (67e83b8)
• handover � Phase 3 (scheduled borrowing) design intent + �17 #5 recommendation (1fb37e9)
• handover rev 4 � design-doc Phase 2 (API triggers + signed callbacks) shipped (0d8cd78)
• handover rev 5 � design-doc Phase 3 (scheduled borrowing) shipped; �17 #5 settled defaults recorded (95177e5)
• handover rev 6 � design-doc Phase 4 shipped (github pr-review fan-out on the connector seam) (01a7f17)
• handover: rev 10 � Codex (second harness, Phase 6) shipped (31ebd84)
• handovers: 2026-07-13 governance/GTM brief + 2026-07-14 codex-MCP debug session (#53) (1eaf724)
• hosted: incorporate Codex adversarial review round 1 (11 findings) (539e818)
• hosted: incorporate Codex adversarial review round 2 (5 findings) (f58cf0e)
• hosted: incorporate Codex adversarial review round 3 (2 findings) (8ff83c0)
• hosted: incorporate independent fidelity review (3 findings) (74e14c8)
• hosted: Phase A draft � hosted product boundary (matrix, admission policy, network, threat model) (0cab245)
• hosted: rollout gates with checkable exit criteria (#34) (ba5c6b7)
• implementation plan for automation API contract + template clarity (b6b6be9)
• implementation plan for the five-minute demo + launch clips (742992b)
• independent prime-time red-team assessment (reports only) (3faaac3)
• k8s: continuance handover for the PR #47 fix series (batches 5-7) (329765b)
• k8s: document the residual symlinked-dest hardening as a follow-up (L15) (0e2ddc4)
• live EKS acceptance for the Kubernetes-native provider (closes #48) (e8a162c)
• mark the red-team findings superseded by this integration (72f572d)
• minimal hatchet-style README � link out, don't inline (b62ed76)
• next-session brief for design-doc Phase 4 (GitHub PR-review fan-out) (5fec7ba)
• next-session brief for design-doc Phase 5 (capability & MCP catalog) (357281e)
• overnight integration review � four branches, independently verified (2e57b5c)
• phase 4 brief � condense paste block to <=4000 chars (8ce4902)
• phase 4 brief � emphasize the connector seam (GitHub as first tenant of the five-duty boundary) (4639cbd)
• phase 4 brief � pin the current pushed HEAD (97b33a6)
• phase 4 brief � self-stable tree-state wording (code-freeze hash only) (23851e5)
• phase 5 brief � add MCP-ecosystem research-first step (5915965)
• Phase 6 codex-harness design (approved) + session brief; phase 4 review record (68bfc56)
• Phase 6 live bring-up + post-ship review round (HANDOVER rev 11) (3421257)
• Phase B shipped-surface truth pass (#30) (57be435)
• Phase C shipped-surface truth pass (#31) (3b14d4c)
• Phase D session handover (#32) (634ffd6)
• Phase D truth pass (#32) (b6f832e)
• Phase E handover � CI fully green (#33) (246450f)
• Phase E handover � closeout state and corrected lessons (#33) (491d226)
• Phase E truth pass + handover (#33) (35e8c4d)
• Phase F handover (#34) (71a4fc5)
• plans: identity design v2 � incorporate Codex adversarial round 1 (336ad28)
• plans: identity design v3 � incorporate Codex adversarial round 2 (9df9582)
• plans: identity design v4 � incorporate Codex adversarial round 3 (563f1dc)
• plans: identity design v5 � fix the bootstrap RETURNING defect (Codex round 4) (15a30ed)
• plans: k8s design v1.1 � dual-provider permanence (settled Q17) (c6ab3a5)
• plans: k8s design v1.2 � operator journeys + per-cloud presets incl. DOKS (56b1565)
• plans: kubernetes-native execution provider + Helm deployability design (65641b9)
• plans: multi-user MCP control plane design � FINALIZED v2 (8553873)
• plans: multi-user MCP v3 � browser-bound OAuth callbacks, 4-state execution claims, missing migrations (76acb01)
• plans: multi-user v4 re-baseline + IdP-agnostic identity companion design (9bc0a8e)
• plans: public site + docs platform + WorkOS /app boundary design (a42ea49)
• point next-phase handover at the user's workspaces/triggers design doc (0b75bd8)
• policies: close the live-agent gap � real run proves the governance loop (a0342a8)
• policies: correct two errors in my own validation output (d74755f)
• policies: design DB-native policies � versioned storage + structured authoring (80c950a)
• policies: prove the governance loop on Kubernetes too, and explain the EKS 503 (a5681b6)
• policies: route every unfixed finding to a tracking item (69d0df6)
• policies: run the loop on REAL EKS; correct my own EKS 503 explanation (31702cf)
• policies: two-environment validation report + correct the upgrade guidance (0f0f662)
• professional open-source pass � community health files, templates, metadata (548cacc)
• readme: lead with the product film instead of a still (881dec4)
• readme: lead with the product film instead of a still (ec1d301)
• readme: raise the product film above the fold (c49c526)
• readme: raise the product film above the fold (01ec08a)
• record Step 5 review resolution (ACCEPT after 3 passes) (cbb17d2)
• record the scale job's first real execution (#34) (c005350)
• record whole-branch review outcome in the handover (#34) (fc3d231)
• reframe README around the agent control plane (#70) (046c5dc)
• release: claims matrix, compatibility matrix, upgrade guide, beta package (3a4a5af)
• release: correct the commit inventory in the readiness report (f59a6ec)
• release: Linux/amd64 is validated for CI-executed paths (ae12b9e)
• release: pin the next release to 0.4.0 and explain why (#116) (dcbe1e1)
• release: v0.1.0 changelog + dashboard screenshot in the README (07749b8)
• review: adversarial verification of the RC readiness report (6545868)
• revise automation-contract plan per external review (rev 2) (7db471f)
• rls: document the runtime-role posture gates, bypass opt-out, and audit tenant floor (#32) (42dffd5)
• scale job is green � record the fix and what it proved (#34) (e01e4ae)
• session handover (state, running services, decisions, next steps) (29e2bcd)
• spec for durable automation API contract + template clarity (96a5224)
• surface just demo as the no-key first-run path (5b45838)
• threat-model: two Phase F residuals narrowed, honestly (#34) (c1982d7)
• update multi-user release README (646ac3d)
• web: run-composer pickers � unleak connections, one card vocabulary, working + new (#42) (a9ead8f)