v0.3.0

Added

• Docker releases now publish multi-platform Linux images for linux/amd64,
  linux/arm64, and linux/arm/v7 to GHCR, with optional Docker Hub publishing
  when Docker Hub credentials are configured. The default image uses a minimal
  BusyBox/musl runtime and matching Alpine runtime tags use an -alpine suffix.
• scoot setup interactive command generates a config directory in a few
  prompts (config dir with overwrite confirmation, backend base_url/model,
  token source via env/0600 file/command, max_turns, policy), creates the
  runtime tree, and writes config.toml without ever inlining the token —
  the fast path for provisioning multiple isolated instances on one host.
• Release workflow now publishes explicit ReleaseSmall assets with -small
  suffixes for every supported target.
• Installer supports SCOOT_INSTALL_FLAVOR=small to select the small release
  artifact instead of the default ReleaseSafe artifact.
• Native recall action can retrieve exact earlier messages from the current
  session transcript archive after active context compaction (#99).
• Stable embedding API surface now separates the public package root from the
  CLI/internal module and includes a compiled minimal embed example (#106).
• backend.store config key and SCOOT_BACKEND_STORE override to opt into
  Responses API server-side response persistence; defaults to off so Scoot
  stays stateless and local-first (#110).
• Client-side MCP support through a guarded mcp_call meta-action and
  [[mcp.servers]] config. The client now supports stdio, Streamable HTTP, and
  legacy SSE transports behind the same config and policy seam, including
  per-server header authentication via environment-backed values (#103).
• External context compressor plugins can now be selected with
  agent.compactor = "plugin:<name>" and configured under
  [agent.compactor_plugin.<name>]. Packages reuse the wasm_tool descriptor
  boundary with kind = "compressor" and run as bounded subprocesses with
  extractive/drop fallback (#98).

Changed

• Scoot now speaks only the OpenAI Responses API (/v1/responses): leading
  system messages map to the top-level instructions field, the rest become the
  input array, and transport is stateless by default (full input resent each
  turn) so local context compaction stays in control. Requires a Responses-capable
  backend such as Ollama >= 0.13.3, vLLM, or OpenAI (#110).
• Guarded mode now confines file writes to the project root by default, wraps
  tool observations in an explicit untrusted-data boundary, and requires an
  opt-in for repository-carried <cwd>/.agents/skills (#113).
• Context compaction now goes through a Compressor strategy seam with drop
  retained as the smallest fallback strategy (#97).
• Added the built-in extractive compactor and agent.compactor /
  SCOOT_AGENT_COMPACTOR selection (#97).

Removed

• OpenAI Chat Completions transport, the backend.api selector, and the
  SCOOT_BACKEND_API override; the Responses API is now the only transport.
  Configs that still set api are ignored with a one-line deprecation warning
  (#110).
• The backend.prompt_cache hint and SCOOT_BACKEND_PROMPT_CACHE override
  (with the Anthropic-style cache_control breakpoint); the instructions
  field is natively prompt-cached, so the manual hint is obsolete. Stale keys are
  ignored with a deprecation warning (#110).

Fixed

• -e and REPL runs now get per-process session transcript ids instead of
  appending every run to shared cli.jsonl and repl.jsonl files (#95).
• Default agent configuration now enables a conservative context budget with
  extractive compaction, while context_budget_bytes = 0 still explicitly
  disables the guard (#96).
• Catastrophic shell-command detection now also catches whitespace-obfuscated
  fork-bomb patterns (#113).
• GitHub workflows now pin action references to commit SHAs and verify the
  downloaded Zig toolchain tarball checksum before extraction (#113).
• MCP stdio tests now use per-process temp directories, so the parallel
  zig build test artifacts no longer race on shared /tmp paths (#122).
• MCP SSE transport now enforces a single cumulative timeout across the entire
  session (connection setup, receiveHead, every POST, and every event read) so
  a server that accepts the connection but never sends headers, or that dribbles
  one event just before each per-event deadline, can no longer hang the agent
  indefinitely (#123).
• MCP remote header values sourced from environment variables (value_env) are
  now checked for CR/LF, closing a header-injection gap where the literal
  value and prefix were validated but the resolved env value was not (#124).
• MCP stdio transport now bounds the child-process stdin write with the
  configured timeout. Previously a server that never drained its stdin blocked
  the write forever once the OS pipe buffer filled with the model-controlled
  request, and the defer child.kill cleanup could never run (#125).
• zig build test now runs its three test artifacts sequentially instead of
  in parallel, so tests that share hardcoded /tmp/scoot_* paths across
  binaries no longer race (one binary's deleteTree removing a file another is
  mid-exec on); compilation still parallelizes (#127).