Anneal v0.9.0 — Developer Preview 9

Anneal v0.9.0 — Developer Preview 9

This page is the release notes for v0.9.0, and the source text for the GitHub
Release body of the same tag.

Anneal runs chains of coding agents on your own machine. You write the specs and
queue them on a board; each card is planned, reviewed, implemented, verified and
merged unattended, on the Codex and Claude subscriptions you are already signed
in to. Nothing merges on faith: independent code review, a separate regression
run and a merge gate stand between an agent's diff and your main branch. A chain
only stops when a human decision is needed — an agent asks a question through
the web Inbox, a step you marked as gated waits for your call, or a run
escalates — and everything it did stays observable and durable on your machine:
tasks, agents, repository and file grants, isolated run records, provider event
streams, review evidence and git delivery, in one workflow.

What this release is for. The same envelope as the previews before it:
evaluating Anneal on a machine you own, against repositories you are willing to
have an agent write to. It is not a production install.

What changed since v0.8.0

The headline is the end of a chain. A merge tail that stops now always names a
way out, the merge gate reports its own infrastructure failing as such, and a
Run that dies in the platform's own work is not charged to the agent:

• A stopped merge tail always has an exit. A base-drift recovery that
  stopped on a merge gate FAIL the branch did not cause is re-run with
  POST /tasks/:taskId/merge-tail/rerun, which opens no repair task and charges
  no repair budget. A review-fix or gate-fix repair now gets three automatic
  attempts before stopping for you, a repair Run that fails before producing a
  result spends the repair Task's remaining budget first, and a deferred
  base-drift stop has an exit on resume and after a failed integrator run as
  well. An exception thrown while readiness evaluates a chain requeues the step
  instead of stranding the tail.
• Ready chains can publish through a merge train. Set MERGE_TRAIN_WIDTH
  (0 disables it, maximum 3) and a runtime tool builds, gates and records
  cumulative prefixes for an ordered candidate list, which the executor
  publishes as one fast-forward whose candidate pull requests read as merged. A
  candidate whose head moved mid-train settles under the train's own lease
  rather than aborting it; a contended lease is alerted, and stealing it takes
  an explicit human flag.
• The merge gate says when it did not run. An infrastructure failure inside
  the gate reports GATE NOT RUN instead of a commit FAIL. A dispatch queued
  behind other gates waits while the queue moves and only gives up on a queue
  that has stalled, a runner daemon can name a fallback gate worker that is
  tried after the primary has stayed busy, and a worker reaps orphaned gate
  databases and sizes itself from its own host-share setting. The gate itself
  got faster: on a 14-vCPU shared worker a comparable cache-hit gate moved from
  about 353s to about 288s.
• A Run is not charged for the platform's own failures. A Run that dies in
  PROVISION, DELIVER or COMPLETE is retried by phase rather than spending
  an attempt. Refunded attempts are bounded and re-queued with backoff, a spend
  cap is enforced before an attempt is queued, a slow specification read defers
  the claim instead of parking the Task, and session events are bounded end to
  end — 32 MiB and 20 000 undelivered events per Run, with what was dropped
  recorded rather than silently lost.
• The console shows what a Run is doing while it does it. Board cards carry
  the Run's current phase, its time in that phase and anomaly badges; Task
  detail adds per-run diagnostics — phases, token split, tool statistics,
  effective output rate — and the time to first token of every model turn.
  Sessions searches and filters server-side, and Task detail and the board carry
  a per-template-step baseline for cost and duration.
• Deleting a Project deletes it. DELETE /projects/:projectId removes every
  row the Project owns in one transaction and answers 404 for an unknown id.
  It was reported from outside
  (Issue #624): the route was a
  bare delete, so a Project's own Default staffing profile blocked the cascade
  and the console's "Agents, tasks and runs cascade" confirmation ended in a
  bare 500 on every Project it had created.
• A Repo or Agent delete that cannot succeed says why.
  DELETE /repos/:repoId and DELETE /agents/:agentId refuse with a typed
  409 naming what still references the row — a task, run, session or staffing
  profile — instead of a bare 500, and answer 404 for an unknown id
  (Issue #627). Those deletes
  still do not cascade through history; the Restrict edges are deliberate.
• A resumed Claude session's cost is counted once. Claude keeps its provider
  session id across process resumes while each new CLI process resets its
  counters, so the stored total dropped the earlier process's usage. Recompute
  now reads persisted PROCESS_STARTED boundaries. The historical correction is
  recorded: of fourteen terminal Claude Sessions checked, ten were corrected,
  moving aggregate stored cost from $274.2944 to $106.4807.
• Code review reports are named for what they are, not for the model that
  wrote them. New canonical Direct, Full Assurance and PR chains produce
  review-findings, with model-neutral template filenames, prompts and
  headings; the temporary sol-findings execution alias is retired, and
  historical reports remain readable. The canonical hard staffing tier
  defaults to senior-dev-sol-high, and frontend-dev-opus-high and
  senior-dev-opus-high are canonical roles.
• Deploys name their host and read their own errors. An auto-deploy Inbox
  notice carries the host that wrote it and dedupes per host, so two machines
  publishing the same release no longer collide on one notice. Deploy
  subprocesses run under the C locale, because under launchd git spoke the
  operator's language and every fault classifier reads English. A control-plane
  deploy is green only when the API and every local runner are registered and
  stay healthy.

A refactor wave gave single owners to merge-tail settlement and marker state,
the operator reentry verbs, Run birth refusal settlement, Run budget and refund
accounting, the specification-read deferral, the Task archive lifecycle, the
shared transient-failure vocabulary, and the deployment service definitions.
Those changes are intended to leave external behaviour unchanged.

The full list, by area, is in CHANGELOG.md.

Release identity

Version	0.9.0
Tag	v0.9.0 (annotated)
Prerelease	Yes
Migrations	68 directories, ending at 20260907140000_staffing_profile_tiers
Release commit	The commit the v0.9.0 tag points to, stated on the GitHub Release page.

Install and upgrade

There is no supported upgrade path between developer previews. This release
adds thirteen migrations, so install fresh, following the quickstart in the
repository README.md — it checks out v0.9.0.

You still need a read-only GitHub token for GITHUB_READ_TOKEN before you
start: the API exits 78 without one, whether or not you enable the Direct or
Full Assurance tiers.

Do not install this release over a v0.8.0 database. The supported release path
is npm run db:migrate:release -- --fresh against an empty schema. The host
warnings and verification steps in the
Developer Preview quickstart apply unchanged.

Known limitations

• There is no supported in-place upgrade from v0.8.0. Install this preview
  against an empty schema through the fresh-install path above.
• The pull-request tier stops at an open pull request. Anneal does not review or
  merge it for you, and onboarding a project does not provision a second
  workflow or create a Secret.
• The NO_CHANGES_PRODUCED classification fixes the misleading delivery symptom
  reported in Issue #305, not
  the provider-side cause. A code-producing provider can still end a successful
  session after announcing work without writing or committing it. For a manual
  Task, the final prose remains available in Session events but is not promoted
  to retry handoff output.
• macOS on Apple Silicon and Linux (Ubuntu 24.04 LTS, x86_64) are the verified
  targets. macOS on Intel is expected to work but has not been exercised there;
  Windows is unsupported by design.
• The merge train is off by default: MERGE_TRAIN_WIDTH is 0 unless you set
  it, and its maximum is 3. Until you set it, every chain publishes on its own.
• The phone layout has known gaps that were left rather than half-fixed. The
  data tables — Agents, Projects, Connections, Secrets and the three Costs
  tables — still scroll horizontally instead of becoming card lists. The
  Toggle and Check controls keep their existing hit targets, because a hit
  halo on either would overlap the rows above and below in the stacked lists
  they appear in. iOS Safari zooms when you focus an input, because the whole
  application's type scale is pinned to a 13px root and the alternative,
  maximum-scale=1, would disable pinch zoom.
• Anneal still launches coding CLIs with the operator account's authority and
  is not a sandbox.

Support, security and licensing

The support matrix remains the current statement of what is
supported and on what evidence. macOS on Apple Silicon is the target platform
and Linux is maintainer-verified; macOS on Intel is unverified and Windows is
unsupported. Anneal still launches coding CLIs with the operator account's
authority and is not a sandbox.

The security, license and assets and
migration and recovery documents remain current.