Altitude v0.12.0

Feature release of the early preview.

• Projects have agents: briefs Altitude runs on a schedule, when you press Run now, or when your own scripts on
  this computer send one an event with alt agent send (such as "PR #812 merged", with example scripts on its
  page), each in a fresh copy of the project, telling you in chat what it found. Agents… in the project menu lists
  them, with three built-in agents to turn on (a dependency check, a build health check and a weekly summary of
  what landed), New agent to write your own and a weekly time budget; ask L3 for an agent or a change and it
  drafts one for you to save. The agent screens say things once in plain words, such as why a run was skipped
  ("Your Claude plan is close to its weekly limit"), and the Agents page says when the week's budget is used.
• An agent only reads and reports: it has no GitHub sign-in and no Altitude commands, so it cannot push, open pull
  requests or file issues, and it stops at its limit of 10, 20 or 60 minutes, which is the most it is charged. A
  run that found something may suggest up to three tasks; L3 checks each against the project first, and those it
  keeps wait under Suggestions in Needs you with Make a task and Dismiss, while the run's page shows what L3 didn't
  offer and why. Pausing an agent also skips its run waiting to start, and an agent that pauses itself after three
  runs that couldn't finish waits in Needs you with Resume, without alerting your devices. Monitor lists running
  agents among Sessions and each agent with its next run and how its last one went. In the Altitude project, the
  Weekly improvement review is a built-in agent with its own page, keeping your agreement and switch, as cheap as
  before and outside the agents' budget.
• Agents no longer see the sign-ins and keys your other programs keep in your home folder (SSH and GPG keys,
  GitHub, cloud, cluster and registry logins, publishing tokens, saved Git passwords, keyring and keychain files),
  and on a Mac they cannot ask the keychain. Workers reach GitHub over HTTPS with your GitHub CLI sign-in, also
  for remotes named over SSH; agents can no longer reach other hosts over SSH, sign commits or use cloud tools set
  up in your home.
• Repairs show in Work: an Altitude repairs section under your current tasks holds the repair running and those
  that ended in the last three days, and a repair's page reads like a task's, its steps in one conversation.
  Settings → About keeps Repair… and links All repairs; Monitor no longer lists a repair.
• Monitor's seat meters mark 90%, the point past which Altitude skips optional work such as agent runs and the
  Weekly review, and a line under Seats says so.
• A task that ships several pull requests shows one review card of each kind per pull request, and each merge
  waits only on its own pull request's reviews.
• Ask the coordinator how to address a problem you name and, when it agrees the work is worth doing, it creates
  the task right away with its recommended approach; otherwise it explains and offers Create task, or says why not.
• A task owner's note sent after you answered its questions no longer appears to answer them again, an owner's
  own explanations no longer send its finished reviews back for another assessment while it lands, and an owner
  learns about a malformed final report when it saves it instead of after it finishes.
• The third-party notices in the release archive cover everything the web UI ships, including the IBM Plex fonts
  and the packages that render shown documents, with every licence text they need.

Updating from v0.11.0 needs nothing, unless your Git settings send GitHub's HTTPS address to SSH (an insteadOf or
pushInsteadOf rule for https://github.com/): workers then cannot push, so remove that rule or scope it to your
own shell. From v0.10.0 or older, take the steps in the v0.11.0 notes first.

Known limits: repairs stay unconfined. Events reach an agent only from this computer, and a run that ends while
Altitude is stopped counts up to its whole limit against the budget. Agent runs on the native Mac service,
the hidden sign-ins on a Mac, repairs on the native Mac service, Codex workers under the Mac sandbox, the
paired-device refusal on a Mac and the phone terminal on a real iPhone still await confirmation on a real
installation. The limits the v0.11.0 notes name for a Codex coordinator, Linux older than 6.12 and typed skills
in the project conversation remain. Live providers are not part of release testing.

Altitude v0.11.0

Feature release of the early preview.

• When something does not work, a repair agent finds out why and fixes it: Repair on a failed
  update's notice or Repair… in Settings → About starts one with your full access for two hours. Its
  page shows each step it takes, asks you before it deletes, installs or changes anything outside
  Altitude, and ends with its report and Altitude's own check; Stop ends it and everything it started,
  Keep going adds an hour. When Altitude or its page is down, alt repair starts one in a terminal on
  this computer. A failed update says why it did not finish and leads with Repair, or with Try again
  when the cause usually passes on its own.
• What you press shows at once: an answer or merge approval leaves Needs you and appears in the chat as
  Waiting, settings and model picks change, and voice choices, dismissing or restoring a suggestion and
  skipping a review take effect. Presses Altitude carries out say so in their own words, such as
  Cancelling… or Stopping the reviewer…, until the result shows, and a sent image stays on screen from
  Send to saved. If Altitude refuses, the change goes back and says why, with Retry, and a dropped
  connection never sends an answer twice.
• A held PR's merge card shows the pictures it adds, replaces or removes, with Before / After for a
  replaced one, so a visual change is approved with its pictures in view.
• Needs you gives its space to decisions: one small pill on its title row names this device's alerts and
  opens Settings → Notifications, where the alert switch now lives. A device whose alert subscription
  stopped working subscribes again by itself the next time Altitude opens there.
• The phone terminal keeps its prompt in view as the keyboard opens or closes and the phone turns, opens
  the keyboard only when you tap the screen or press Ctrl, and reads on from where it was when you come
  back to the app. Who can read a terminal is one quiet line above its screen, and Open in terminal
  types a chat command once, never onto an unrun copy of it.
• A Claude task owner uses a skill or custom command you type by name in its conversation
  (/name arguments), your own and the project's alike.
• Confined agents reach less: Codex task workers run inside Altitude's own sandbox, as Claude's do, and
  no job in it can read your own Claude or Codex folder, your Claude state file or the common browsers'
  profiles, or reach the desktop session's sockets. Altitude's own agents can no longer act with a paired
  device's sign-in. Workers therefore no longer use your desktop's SSH or keyring agents, so a worker's
  own SSH fetch needs a key file; landing is unaffected.
• On macOS, logging out stops every job Altitude started instead of leaving it running. A task whose
  check against GitHub goes unanswered is checked again instead of blocking, and a malformed task report
  goes back to its owner.

Updating from v0.10.0 needs nothing, except that a Codex-only installation on Linux now needs bubblewrap,
as setup and alt doctor say. From v0.8.0 or older, take the steps in the v0.10.0 notes first.

Known limits: a Codex coordinator keeps Codex's own sandbox and runs on your Codex folder, and on Linux it
can still read your Claude state file once your own Claude rewrites it during its turn. On Linux older
than 6.12, agents can still reach the desktop's abstract sockets, as setup and alt doctor say. The
project conversation's Claude coordinator does not load typed skills or commands, and Codex is not yet
confirmed to. Repairs on the native Mac service, Codex workers under the Mac sandbox, the paired-device
refusal on a Mac and the phone terminal on a real iPhone still await confirmation on a real installation.
Live providers are not part of release testing.

Altitude v0.10.0

Feature release of the early preview.

• Project chat shows the coordinator typing until its turn ends, not only until its first words,
  and its reply keeps everything it wrote, in order, with a new paragraph after each step.
• A step you already approved in your own words, such as "publish the release once its checks
  pass", is no longer asked again: the coordinator grants the task's request from that message,
  limited to exactly what it says. Taking that approval back ends every permission resting on it,
  stops a command still running under one, and no later request can use it.
• A task asking for a permission the project's standing rules already give is no longer refused
  for a request worded differently from the rule, because Altitude writes the request from it.
• On Linux, validation runs work after the computer restarts without running Podman by hand first,
  and a run that cannot clean up says why.

Updating from v0.8.0 or older: if the update stops because "the only extra files look like generated
Python caches", run alt recover --generated-bytecode && alt update once; on v0.6.0 or older, use
the standalone repair in generated-cache recovery.
Then sign Altitude in to Claude once, with Sign in on the Claude row of Settings › Prerequisites
or alt sign-in claude, as the v0.9.0 notes describe. Updating from v0.9.0 needs nothing.

Known limits: the update from v0.9.0 to this release is the first real-installation proof of the
cache fix (#1029), and first-browser pairing on a Mac (#926) still awaits confirmation on a real
installation. Live providers are not part of release testing.

Altitude v0.9.0

Feature release of the early preview.

• Python cache files that another program writes into the installed application no longer stop an
  update, automatic or not, and need no repair. When an update does fail, the notice, Settings and
  alt doctor say why.
• alt trust adds Altitude's certificate to this computer's browsers after a yes in the terminal;
  the installer offers it, and the pair page shows exact steps for other desktops.
• Altitude's Claude runs use a sign-in of their own, made with Sign in on the Claude row of First
  run or Settings › Prerequisites from any paired browser, or alt sign-in claude. Each Claude task,
  coordinator turn and review gets its own Claude folder, so one run's settings cannot reach
  another, and your own Claude sign-in stays yours. After updating, sign in once; until then, project
  chat reports Claude's sign-in as lapsed.
• An automatic update lets work in flight finish first, and the notice, Settings and alt doctor
  name what it waits for.
• A command only you can run stays in Needs you until it runs, and its question card shows that it
  ran. The task conversation ends at its last message; lifecycle events stay in Live session.
• A Mac account with a long name can add projects, and workers already running keep working after
  Altitude activates newer code.

Updating from v0.8.0 or older: those versions run their own update code, which still refuses Python
cache files in the application folder. If the update to v0.9.0 fails because "the only extra files
look like generated Python caches", run alt recover --generated-bytecode && alt update once; on
v0.6.0 or older, use the standalone repair in
generated-cache recovery.
Later updates need nothing.

Known limits: the update from v0.9.0 to the next release is the first real-installation proof of the
cache fix (#1029), and first-browser pairing on a Mac (#926) still awaits confirmation on a real
installation. Live providers are not part of release testing.

Altitude v0.8.0

Feature release of the early preview.

• A first-timer reaches a working first conversation without a failure. A project added before any
  coding tool is ready waits, says what to install or sign in to (on Linux, also the agent sandbox)
  and then continues by itself. First run's Coding tools step gives each agent's install command in
  one row, a repository that is not on GitHub gets the command that publishes it, alt doctor
  names the one next step, and alt --version prints the version.
• A task waiting for you to do something, such as run a command in its terminal, shows as your
  turn, and its task card names the step.
• Task agents change Altitude's records only by asking Altitude, for their own task, and write only their
  worktree and a scratch folder of their own; Altitude's home is read-only to them on both engines.
  Agents already running at the update keep their earlier sandbox until their session ends.
• The cache repair for an installation on v0.5.0 or older is one line that repairs and updates
  back to back, because a review starting in between brings the cache files back. The repair's own
  output and the release check's error say the same.
• Improvement suggestions draw on real friction instead of routine work. Because what is sent
  changed, Weekly turns off until you turn it on again in the Altitude project's settings and agree
  to the new terms.
• Altitude running from a source checkout stays clean when an update to it is refused, and tries
  again at its next check.

Known limits: per-job Claude folders and alt sign-in claude (#959) come in a later release;
recovery from a failed automatic update on v0.7.0 (#912) and first-browser pairing on a Mac (#926)
still await confirmation on real installations, and a Mac account whose name is longer than 28
characters cannot add a project (#973). Live providers are not part of release testing.

Altitude v0.7.0

Feature release of the early preview.

• A failed update no longer stays stuck: it ends with the release check's reason and Try again. An
  installation on v0.5.0 or older that cannot update because it left Python cache files in its
  folder is repaired with this release's install.py --repair-generated-bytecode, then updates with
  alt update (generated-cache recovery).
• Installation ends with Altitude's address and two steps: trust the certificate, shown with its
  full fingerprint, then open the pairing link. Every browser, the hosting computer's included,
  passes the certificate check before pairing, and First run is three steps that end in a usable
  project. Settings → Network shows where Altitude can be reached.
• One model and effort button sits under each message box and on New tasks. A usage limit or an
  engine refusal stops the task with Change model…; nothing switches engines by itself. Codex
  always runs with a named model and effort, shown on the task.
• Voice settings are option cards, each with its own Use button.
• Task agents cannot act with the coordinator's or your authority. In an Altitude sandbox they also
  cannot read the access key, paired devices or HTTPS keys, change the repository's Git settings,
  or use links in Altitude's data folder to write outside the sandbox. After the update Altitude
  replaces its access key, and once more when the agents running at the update have finished; each
  replacement ends open design-board links, and the first cancels a pairing code in progress.
  Linux needs kernel 6.5 or newer.
• On Linux, Claude agents run inside Altitude's own sandbox, as on macOS; Linux needs bubblewrap,
  which alt doctor checks. On every computer the alert signing key is replaced, so turn alerts
  off and on once on each phone or browser that uses them.
• Live session works for every valid project name, including names with capitals, spaces or dots.

Known limits: the update repair and installer pairing still await confirmation on a real Linux and
Mac installation (#912, #926). Live providers are not part of release testing.

Altitude v0.6.0

Feature release of the early preview.

• A fresh installation ends with a private link: after you trust the certificate, opening it
  pairs that first browser and goes straight to First run, with no separate alt pair step. On a
  Mac, an installed Homebrew OpenSSL is found without changing PATH.
• Settings holds one model and effort default for each engine, and a task's composer can move
  that task to another engine, model or effort while keeping its work, questions and merge holds.
  Opening the chooser starts nothing, and a switch in progress shows who started it.
• Merge approval is offered only once a held delivery is ready, Live session keeps reliable
  command times, and usage limits are tracked for each quota window separately.
• Project names, runtime records and file reads are checked more strictly.

Known limits: an installation whose earlier version wrote Python cache files into its release
folder cannot update to this release, and an automatic attempt can stay stuck (#912); the repair
is not in this release. Native installer and device confirmation of first-browser pairing
remains open (#926). Live providers are not part of release testing.

Altitude v0.5.0

Prepare v0.5.0 release notes and clarify local verification completio…

Altitude v0.4.0

Feature release of the early preview. Altitude keeps running where it used to stop, shows more of
what its agents are doing, and starts suggesting how it could work better for you.

Updating: copies on v0.1.2, v0.2.0 or v0.3.0 install this release automatically at a quiet
point, or offer it in the app and through alt update when automatic updates are off. Copies on
v0.1.0 or v0.1.1 need one manual update. Configuration, TLS identity and data are kept; nothing
needs migrating. Three things to know:

• On Linux, an update leaves lingering as it is. To keep an existing installation running after
  logout and at boot, run sudo loginctl enable-linger <account> once; alt doctor shows whether
  it is on.
• On a Mac, Altitude stays out of Desktop, Documents, Downloads, iCloud Drive and the other places
  macOS guards. A project kept in one of them can no longer be worked on; move it to another folder
  and add it again.
• Host voice installs a newer speech runtime, so an existing one reads "Voice needs an update" once.

Watching and steering work:

• Live session shows work an agent keeps running in the background, such as a long command or a
  helper, in a small tray under the stream: what it is, how long it has run, and whether it finished,
  failed or was stopped.
• An agent can show you a document or images from its task before anything is published. The
  conversation shows a page card or thumbnails; the document opens beside the conversation on a wide
  screen and full screen on a phone, rendered as GitHub does, and a set of images opens as a gallery.
  An answer applies to the files you saw; an older version is marked Earlier.
• A pull request waiting for your review shows exactly one Approve merge, on the agent's question or
  on the review card, never both.
• Ask the coordinator for improvement suggestions in the Altitude project's chat. It reviews the
  finished tasks for recurring friction, checks each suggestion against the records it cites and posts
  the ones worth your time as a card: each suggestion says what it would change, where it was seen and
  how often, with Make a task and Dismiss. Make a task has the coordinator open the task; Details shows
  what the review read and left out. Suggestions still waiting for you are listed under Suggestions in
  Needs you, without adding to its count. The review runs on Claude's plan, starts only after five
  finished tasks, can be stopped while it runs and stays out of Claude's reserve.

Engines:

• When an engine's sign-in lapses, the coordinator answers on the other engine and project chat says
  so once, in plain words, with the command that signs you back in. The provider's error text never
  appears as a reply. With no other engine, your message waits under that line.

Running Altitude:

• On Linux, a first installation turns on lingering, so Altitude keeps running after you log out
  and starts at boot with nobody logged in, which a host you reach only over SSH needs. When the
  system refuses, installation still completes and prints the one command to run.
• Host voice runs on Macs with Apple silicon and is the default there, with the same model and
  privacy as on Linux. Its newer speech runtime brings the final words in sooner after Stop.
• On a Mac, Altitude never asks for access to your private places: every sandbox it applies refuses
  them, and the folder browser leaves them out. If macOS still asks, click Don't Allow; nothing
  depends on the answer. Confined agents also cannot script other running apps.
• The setup and operations guides say plainly that a Mac runs Altitude after someone logs in, why
  macOS allows nothing earlier, and what automatic login changes.
• Activating merged changes retries by itself when it was refused for a passing reason, such as a
  slow answer on a busy host, and parks with a fault only when the problem persists. A failed
  activation keeps showing that the web app is out of date, and its fault names the real cause.
• On a phone, a touch right after a swipe between Conversation and Terminal goes to the view the
  swipe settled on.

Task agents and the coordinator:

• Pull requests merge in the order they became ready. A waiting pull request keeps its green check
  and catches up with main only at its turn, so each one needs at most two checks. A merge to main
  whose files a pull request's check already tested reuses that check instead of running the full
  suite again.
• A validation run waits through an activation instead of giving up its place in line.
• History search finds records containing every word of the query, in any order.
• On a Mac, the full test suite passes inside Altitude's confinement, the container lanes run in a
  throwaway Linux guest, and a standing approval covers bounded runs of both VM lanes.

Documentation:

• The README opens with a short loop of a decision answered on the phone and explains the team in
  one drawing.
• The setup guide is a short walk a new operator follows top to bottom on Linux or macOS. Running
  from a source checkout and the configuration settings are in the operations guide.

Known limits: native macOS behavior still being confirmed on another Mac (#225), relaxed host
checks (#818) and notification preferences on a real iPhone (#829) stay tracked on their issues.
Live providers are not part of release testing.

Altitude v0.3.0

Feature release of the early preview. It is mostly about reading Altitude at a glance: decisions
show how they were reviewed, every message you send shows its own state, alerts are yours to tune
and every time is in your own zone.

Updating: copies on v0.1.2 or v0.2.0 install this release automatically at a quiet point, or
offer it in the app and through alt update when automatic updates are off. Copies on v0.1.0 or
v0.1.1 need one manual update. Configuration, TLS identity and data are kept; nothing needs
migrating.

Decisions and alerts:

• A question asking you to approve a proposal or a merge shows a small review box: whether its
  review was requested, is running, found nothing, had findings resolved or still open, did not
  finish, covers an earlier version or was skipped. Opening task details is no longer needed to see it.
• Pressing a choice on a decision shows as that choice ("Approve merge", "7 days") with the question
  or PR it answers beneath, not as a message you typed. Answers written under Other… stay messages.
• Settings › Notifications lets each device choose what a decision alert shows (project and task,
  project only, or only that a decision waits), how often alerts come (every new decision, at most
  every 15 minutes, or at most once an hour, with the ones in between grouped) and whether they make
  a sound. The defaults keep the earlier behavior.
• Alerts wake a device only for a new decision that still needs you, and every banner says what it
  is about. A decision is held while the coordinator or the task's owner is still handling it, and
  alerts once the task rests or an hour after it was asked. Pull requests awaiting your review,
  faults and stops wait in Needs you without waking the device, and no bare "from Altitude" banner is left behind.
• A decision asked again after you replied alerts like a new one, and an alert never says nothing
  is new while a decision waits.

Conversations:

• In project chat and in a task's conversation, every state of a message you send shows on the
  message itself. It appears at once and settles when saved; one that was refused says why and
  offers Retry and Edit; one Altitude cannot confirm is marked Unconfirmed with Copy to draft.
  Messages on their way stay in view when you switch to Work or leave the task and come back.
  New messages enter with a short, calm motion.
• Coordinator notices in project chat read as one line, what happened, which task and what it
  needs, with Needs you or Open task. The text Altitude writes for the coordinator is never shown.
• A coordinator turn that created a task or filed an issue keeps its own line in project chat with
  Open task or Open issue, instead of folding into "handled N system events".
• A task page no longer puts a status paragraph between the header and the tabs. What the task
  waits on is the last line of its conversation, and task details lists the full reasons, which gives a
  waiting task's conversation more room on a phone. An interrupted task's state shows in red.
• The Create task button under a coordinator reply no longer repeats as reply text.

Everywhere in the app:

• Every time is shown in your own time zone, including times written in owner and coordinator text;
  hovering a time shows it exactly, with its zone.
• Loading and pending actions show spinners, and saved or copied show checks. Repeated status
  explanations are gone; an unavailable voice, terminal or alert control says why when pressed.
• Fonts ship with the app, so pages make no requests to other sites.

Installation:

• Altitude runs on Linux with a systemd user manager and on macOS 15 or newer. The installer
  accepts any processor architecture and says when a host is not yet validated; releases are
  validated on Ubuntu 24.04 x86_64 and Apple silicon Macs. Host voice input still needs Linux
  x86_64, and features that need a particular architecture say so when used.

Task owners and the coordinator:

• Owner and coordinator text written for you leads with the plain idea: what it does for you, why,
  and what you need to decide.
• Every proposal that changes the interface gets a design review that reads the written design and
  sees its screenshots, and offers up to two alternative directions for you to choose from.
• Owners have one way to message the coordinator and can see that it was queued. An owner turn that
  ends with only a message is resumed once before it counts as a failed worker, and an owner can
  act on a review that finished while it waited for your answer.
• Landing reads GitHub sparingly and waits out rate limits instead of failing, and optional checks
  that end neutral or cancelled no longer block a merge. A task's newer validation request replaces
  its earlier one.
• Native checks that only the other installation can run are tracked on the change's own issue with
  a verify:macos or verify:linux label.

Releases:

• Version numbers follow semantic versioning: a release of fixes only raises the last number, and a
  release with anything else you would notice raises the middle one
  (cadence and versions).
• The installation test VM checks that a published release updates itself to the candidate, and
  the macOS VM lane checks automatic updates.

Known limits: notification preferences still await checks on a real iPhone
(#829), and the relaxed host checks await
confirmation on each installation (#818).
If an update fails to activate, Altitude restores the previous version. Use alt recover from a
desktop or SSH terminal for interrupted activation, or retry an offered update explicitly after
checking its error. Native macOS confirmation and real-provider compatibility remain limited as
described for v0.1.1.