v0.2.17

What's Changed

• fix(desktop): attach to running Xavier; release 0.2.17 by @iberi22 in #2749

Full Changelog: v0.2.16...v0.2.17

v0.2.16

What's Changed

• chore(deps): bump mdns-sd from 0.13.11 to 0.21.4 by @dependabot[bot] in #2534
• chore(hygiene): minimal root — drop dead scripts, disabled workflows, untrack generated docs by @iberi22 in #2536
• fix(health): integrity/FTS probe on ephemeral read-only connection (#2479) by @iberi22 in #2537
• chore(hygiene): root minimal round 2 — community files to .github, drop archive/legacy docs, untrack .svelte-kit by @iberi22 in #2538
• fix(maloca): unify store path, CORS/auth on Maloca routes, nested backlog scan by @iberi22 in #2540
• feat(skills): integrate skill-fusion wave #304 + docker hardening + telegram fixes by @iberi22 in #2539
• feat(auth): xavier users create/totp-enroll/totp-disable CLI onboarding by @iberi22 in #2541
• fix(memory): exclude telemetry noise from search, fix ranking root cause + /memory/get 404 by @iberi22 in #2542
• fix(panel): make panel 2FA actually work end-to-end over /auth/* by @iberi22 in #2543
• fix: deprecate dead /v1/auth/* user-login API, document real /auth/* flow by @iberi22 in #2546
• fix(memory): degrade to lexical/FTS instead of hanging when embeddings are unavailable by @iberi22 in #2548
• fix(panel/memory): fix hidden e2e failures, memory/delete cache bug, and token leak (#2547) by @iberi22 in #2549
• fix(panel): move ProvidersPage hooks above conditional loading return by @iberi22 in #2552
• 🛡️ Sentinel: [HIGH] Fix timing side-channel in OAuth state validation by @iberi22 in #2551
• chore(deps-npm): bump jsdom from 30.0.1 to 30.1.1 by @dependabot[bot] in #2550
• Fix observability defects in Skill Dispatcher and Registry by @iberi22 in #2567
• chore(deps-npm): bump vite-plugin-dts from 5.1.0 to 5.1.1 by @dependabot[bot] in #2533
• chore(deps-npm): bump svelte from 5.57.0 to 5.57.1 by @dependabot[bot] in #2509
• chore(deps-npm): bump @tauri-apps/cli from 2.11.4 to 2.11.5 by @dependabot[bot] in #2508
• 🎨 Palette: Improve ThemeToggle focus ring contrast by @iberi22 in #2512
• 🎨 Palette: Improve accessibility in MessagingConfigModal by @iberi22 in #2535
• fix(health): stop reporting unmeasured embedding coverage as healthy (WAVE-29.01) by @iberi22 in #2568
• fix(cli): bound xavier doctor probes and always print the report (WAVE-29.05) by @iberi22 in #2571
• test(panel-e2e): fix flaky settings sidebar iteration (#2569) by @iberi22 in #2570
• fix(memory): reject corrupt content and stop indexing one path twice (WAVE-29.09) by @iberi22 in #2573
• fix(panel): stop Providers page crashing on the real /v1/system/scan shape by @iberi22 in #2572
• fix(cli): report real version, degraded reasons and stats in xavier health (WAVE-29.07) by @iberi22 in #2574
• fix(guardian): env_status user scope, log_scan newest-first (WAVE-29.03) by @iberi22 in #2575
• fix(codegraph): honour dump path and cwd; drop trivial constructors from hubs (WAVE-29.08) by @iberi22 in #2576
• fix(mcp): stop sys_health/health_check fabricating values; gods() skips constructors (WAVE-29.02) by @iberi22 in #2577
• fix(improve): bound every cycle stage and persist partial progress (WAVE-29.06) by @iberi22 in #2579
• test(observability): E2E contract that MCP health agrees with GET /health (WAVE-29.10) by @iberi22 in #2578
• docs(skill-controller): research & design phase — ADR-034, specs, task DAG by @iberi22 in #2626
• docs(pipeline): trunk-based Ship/Show/Ask, autonomous pipeline and DONE protocol (ADR-035 draft) by @iberi22 in #2627
• docs: remove retired-model (Kimi) attributions by @iberi22 in #2628
• [S01] Make skill store paths configurable with identical defaults by @iberi22 in #2678
• [R01] Extract the shared registry constructor by @iberi22 in #2686
• chore: drop stale model attribution from two doc comments by @iberi22 in #2687
• [R04] Unify fusion construction and document confidence constants by @iberi22 in #2688
• [V1] T3: at-rest permissions (0600/0700) and no shadow fallback write when the keyring works by @iberi22 in #2689
• [R02] Use shared registry construction in REST by @iberi22 in #2690
• [R03] Use shared registry construction in MCP by @iberi22 in #2691
• [V1b] T3b: stronger fallback wrapping-key derivation with backward-compatible reads by @iberi22 in #2692
• [V0] Isolate node-secret tests from the real vault by @iberi22 in #2693
• [V2] T1a: library core for value-from-stdin and .env parsing (no value ever in argv) by @iberi22 in #2695
• [J01] Parse and validate TOML manifest v1 by @iberi22 in #2696
• [V3] T1b: CLI surface -- secrets put --stdin, import-env --dry-run|--apply, vault set/get without leaking by @iberi22 in #2699
• [J02] Implement host policy and publication secret gate by @iberi22 in #2700
• style(skill-controller): drop rustfmt::skip and format manifest/policy by @iberi22 in #2703
• docs(skill-controller): split per-issue size cap (D14 amendment) by @iberi22 in #2704
• [V4] T2a: in-process secret execution engine (resolve, lease, inject into child env, revoke) by @iberi22 in #2706
• [D2698] Docs/messages still show the removed 'xavier vault set KEY VALUE' form by @iberi22 in #2708
• [V5] T2b: POST /secrets/exec endpoint, secrets exec CLI, and degrading secrets lend to internal by @iberi22 in #2709
• [J04a] Link-Object Backups and Atomic File Persistence by @iberi22 in #2714
• [J03a] Plan Data Schema, Package Hashing, and Source Inventory by @iberi22 in #2715
• [V6] T4: MCP secret tools and resolve_tool_secret reading from the vault instead of std::env by @iberi22 in #2716
• [J04b] Ownership Journal and Transaction State by @iberi22 in #2717
• chore(hooks): light pre-commit; clippy and panel-ui build run in CI by @iberi22 in #2718
• [OBS] Flaky: observability_contract tests time out waiting for GET /health (90s) by @iberi22 in #2719
• docs(agents): remote sandboxes must not build the full workspace by @iberi22 in #2721
• [CLI2707] src/main.rs compiles the cli module twice (mod cli;), breaking cfg(test) seams by @iberi22 in #2725
• [V6c] by @iberi22 in #2727
• [J03b] Deterministic Dry-Run Plan Generation and Precondition Recheck by @iberi22 in #2728
• [CLI2697] CLI: clap debug_assert fails on the full command tree by @iberi22 in #2720
• [V6b] by @iberi22 in #2726
• [J05] Apply plans with atomic per-skill publication by @iberi22 in #2730
• [V7] by @iberi22 in #2731
• [V8] by @iberi22 in #2734
• feat(pageindex): tree-based document retrieval (ADR-036) — crate, PDF cascade, MCP/HTTP tools, search, hybrid arm by @iberi22 in #2735
• [OBS2736] Flaky: observability_contract servers exit at startup with 'SQL error or missing database' (shared ~/.xavier) by @iberi22 in #2738
• [V9] by @iberi22 in #2737
• [J06] Conditionally roll back owned projections by @iberi22 in #2733
• [J07] Implement the CLI skills handler by @iberi22 in #2740
• [J08] Wire controller modules and CLI subcommands by @iberi22 in #2742
• [SECDEPS-X] security(deps): bump astro/js-yaml/nanoid/sharp/svgo (2 critical, 5 high Dependabot alerts) by @iberi22 in #2743
• [V10] by @iberi22 in #2739
• release: v0.2.16 — PageIndex docs + Linux desktop app (AppImage/deb) by @iberi22 in #2745
• [V11] by @iberi22 in https://github.com/i...

v0.2.15

What's Changed

• chore(deps): bump tauri from 2.11.5 to 2.11.6 in the rust-minor group by @dependabot[bot] in #2511
• 🛡️ Sentinel: [HIGH] Fix token comparison timing attacks in memory module by @iberi22 in #2513
• fix(license): embed AGPL text from src-local mirror (Docker-proof) by @iberi22 in #2531
• chore(release): prep v0.2.15 (license embed release) by @iberi22 in #2532

Full Changelog: v0.2.14...v0.2.15

v0.2.14

What's Changed

• fix(docker): COPY LICENSE into builder stages by @iberi22 in #2529
• chore(release): prep v0.2.14 (Docker LICENSE release) by @iberi22 in #2530

Full Changelog: v0.2.13...v0.2.14

v0.2.13

What's Changed

• fix(docker): bump builder image rust 1.90 -> 1.94 (MSRV) by @iberi22 in #2527
• chore(release): prep v0.2.13 (Docker builder release) by @iberi22 in #2528

Full Changelog: v0.2.12...v0.2.13

v0.2.12

What's Changed

• fix(docker): allow dependency build scripts in image build by @iberi22 in #2525
• chore(release): prep v0.2.12 (Docker flag release) by @iberi22 in #2526

Full Changelog: v0.2.11...v0.2.12

v0.2.11

What's Changed

• fix(installer): drop invalid skipfsreqterminate flag from setup.iss by @iberi22 in #2523
• chore(release): prep v0.2.11 (installer flag release) by @iberi22 in #2524

Full Changelog: v0.2.10...v0.2.11

v0.2.4

What's Changed

• feat(e2e): add live server clearance e2e proof suite by @iberi22 in #2275
• feat(security): mirror clearance audit decisions into canonical SQLite audit log by @iberi22 in #2276
• chore(deps-npm): bump @biomejs/biome from 2.5.12 to 2.5.13 by @dependabot[bot] in #2234
• feat: dedicated document space for lab 10% segments by @iberi22 in #2279
• [WAVE-22.04] feat-drop-client-declared-requirement (recovered) by @iberi22 in #2280
• chore(deps-npm): bump @playwright/test from 1.62.1 to 1.63.0 by @dependabot[bot] in #2227
• chore(deps-npm): bump react and @types/react by @dependabot[bot] in #2226
• chore(deps-npm): bump lucide-react from 1.40.0 to 1.44.0 by @dependabot[bot] in #2230
• [Ola 23.06] private-mesh-isolation-test — Missing Cross-Wallet Isolation Test by @iberi22 in #2293
• [Ola 23.08] service-publish-guard — Service Publish INTERNAL-Only Guard by @iberi22 in #2296
• [Ola 23.09] telemetry-internal-retention: Telemetry INTERNAL Constructor Plus Retention by @iberi22 in #2294
• [Ola 23.10] network-prune — Prune Expired and Revoked Grants Audited by @iberi22 in #2295
• [Ola 23.04] fallback-degraded — Fallback Bounded Retry With Degraded Flag by @iberi22 in #2297
• [Ola 23.07] wallet-challenge-helper — Ephemeral Challenge Verify Helper (recovered) by @iberi22 in #2298
• chore(deps-npm): bump astro from 7.2.10 to 7.3.2 by @dependabot[bot] in #2231
• chore(deps-npm): bump motion from 13.1.1 to 13.2.0 by @dependabot[bot] in #2233
• [Ola 23.03] iroh-guards — Iroh Addr Guard Plus Handshake Timeout (recovered) by @iberi22 in #2300
• [Ola 23.05] libp2p-stub — Libp2p Explicit Deprecated Stub (recovered) by @iberi22 in #2299
• [Ola 23.01] mesh-contracts — Visibility + JoinRequest (recovered) by @iberi22 in #2301
• [Ola 23.02] pairing-join-decision — Pairing Consumes JoinDecision With Secret and Expiry by @iberi22 in #2302
• [Ola 23.11] HTTP POST Join Plus Visibility Filter by @iberi22 in #2303
• 🎨 Palette: Fix button types and missing disabled states by @iberi22 in #2278
• ⚡ Bolt: Memoize NotificationItem in NotificationsDropdown by @iberi22 in #2258
• 🛡️ Sentinel: [CRITICAL] Fix DoS and timing issues in auth token check by @iberi22 in #2259
• [Ola 23.12] mesh-e2e-live — Live E2E Private Mesh Plus Telemetry Plus Join by @iberi22 in #2304
• chore(deps): bump the rust-minor group across 1 directory with 6 updates by @dependabot[bot] in #2326
• ci(deps): bump dorny/paths-filter from 3 to 4 by @dependabot[bot] in #2325
• ci(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2324
• ci(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #2323
• ⚡ Bolt: Optimize channel list rendering in MeshChatView by @iberi22 in #2322
• chore(deps-npm): bump recharts from 3.8.1 to 3.10.1 by @dependabot[bot] in #2305
• chore(deps-npm): bump lucide-react from 1.44.0 to 1.45.0 by @dependabot[bot] in #2306
• chore(deps-npm): bump eslint from 10.8.0 to 10.10.0 by @dependabot[bot] in #2307
• chore(deps-npm): bump @tailwindcss/vite from 4.3.0 to 4.3.3 by @dependabot[bot] in #2308
• chore(deps-npm): bump picomatch from 4.0.4 to 4.0.7 by @dependabot[bot] in #2309
• chore(deps-npm): bump zustand from 4.5.7 to 5.0.15 by @dependabot[bot] in #2310
• chore(deps-npm): bump @astrojs/node from 11.1.4 to 11.1.5 by @dependabot[bot] in #2311
• chore(deps-npm): bump @testing-library/dom from 10.4.1 to 10.4.2 by @dependabot[bot] in #2312
• chore(deps-npm): bump @sveltejs/vite-plugin-svelte from 5.1.1 to 7.3.0 by @dependabot[bot] in #2313
• chore(deps): bump candle-nn from 0.9.1 to 0.11.0 by @dependabot[bot] in #2315
• chore(deps): bump which from 6.0.3 to 8.0.6 by @dependabot[bot] in #2316
• chore(deps): bump zstd from 0.13.3 to 0.14.0 by @dependabot[bot] in #2317
• chore(deps): bump tree-sitter from 0.26.11 to 0.27.0 by @dependabot[bot] in #2318
• chore(deps): bump tokio-tungstenite from 0.29.0 to 0.30.0 by @dependabot[bot] in #2319
• chore(deps): bump tower-http from 0.6.11 to 0.7.1 by @dependabot[bot] in #2320
• chore(deps-npm): bump devalue from 5.8.1 to 5.9.2 by @dependabot[bot] in #2327

Full Changelog: v0.2.3...v0.2.4

v0.2.3

What's Changed

• 🎨 Palette: Add disabled loading states to InputArea control buttons by @iberi22 in #2237
• ⚡ Bolt: Extract mesh hub components to prevent O(N) re-renders by @iberi22 in #2236
• fix(memory): bound gestalt bus auto-capture growth (#2264) by @iberi22 in #2269
• feat(security): clasificación por identidad y segmentos internos (feat-classified-clearance F1-F4) by @iberi22 in #2277

Full Changelog: v0.2.2...v0.2.3

v0.2.2

Full Changelog: v0.2.1...v0.2.2

Full Changelog: v0.2.1...v0.2.2

Full Changelog: v0.2.1...v0.2.2

Full Changelog: v0.2.1...v0.2.2

What's Changed

• 🛡️ Sentinel: [HIGH] Fix timing attack in auth token comparison by @iberi22 in #2250
• feat(panel-ui): deterministic viewport and retry strategy for E2E tests by @iberi22 in #2251
• feat(codegraph): implement Windows IPC HTTP loopback fallback by @iberi22 in #2254
• feat: streaming diff token compression in CLI and kernel proxy by @iberi22 in #2253
• Resilient Hardware Vault Fallback on macOS & Headless CI by @iberi22 in #2256
• feat(notifications): add resilient SSE retry and keepalive ping by @iberi22 in #2255
• feat(panel-ui): React ErrorBoundary telemetry & graceful recovery by @iberi22 in #2252
• feat(memory): Vector Search Benchmark & Quantization Evaluation by @iberi22 in #2257
• feat(husky): strict multi-platform pre-push matrix & leak verification by @iberi22 in #2249
• feat(docker): add build cache mounts and robust healthcheck by @iberi22 in #2248

Full Changelog: v0.2.1...v0.2.2