Release v0.10.0 · mrveiss/AutoBot-AI

[v0.10.0] - 2026-09-28

Highlights

Bug Fixes

(frontend) Admin-only controls are hidden from non-admins instead of offered and then refused: the Feature Flags settings tab, the telemetry toggle (its public state display stays visible), and theme install/uninstall. (#16494)
(infra) Adding an apt repository during provisioning now retries with a bounded backoff, so one transient keyserver or repository-host failure (gpg: keyserver receive failed) no longer aborts the whole play. A repository that still cannot be added once the retries are spent stops the deploy as before, but now only after up to five attempts 10 seconds apart, so a permanent failure such as a mistyped or retired repository takes up to about 50 seconds longer to surface. (#17230)
(backend) An admin can now propose an orphan-storage deletion for human approval (POST /api/admin/orphan-storage/deletion-requests), and an approval naming an action no handler is registered for is refused when it is created rather than recorded as a failure after someone approves it. (#17315)
(backend) Agent-terminal session creation now refuses (404) a conversation_id the caller does not own, so a user can no longer bind another user's conversation and inherit its pending command approval. (#17422)

Commit Log

Bug Fixes

(deps+security) Consolidate six packages into the constraints SSOT and confine repo_path (#17304, #17300) (#17309) (#17309)
(security) Close an arbitrary file write and two path-injection holes (#17300) (#17301) (#17301)
(pricing) Migrate LLM cost tracking off hardcoded price tables (#16230, #16233, #16316) (#17187) (#17187)
(rag) Preserve per-view provenance and multiplicity through RRF fusion (#17207) (#17216) (#17216)
(code-intelligence) Wire the code indexer and give the graph its own collection (#4835, #17254) (#17256)
(deploy) Provisioning aborts on every non-manager host, and the failure summary hid it (#17240, #17242, #17243, #17244) (#17241)
(slm-tests) Real-load capability_tiers and node_capability (#15495) (#17206) (#17206)
(billing) Record LLM spend from the chat path and both compat gateways (#16845) (#16853) (#16853)
(gui) Defect sweep — escaped entities, dead styles, unserved sockets, missing hygiene page (#17153) (#17153)
(ansible) Cert provisioning chain — own privilege, and before nginx's install (#16020, #17172) (#17184) (#17184)
(ci) Baseline a secrets false positive and re-pin the SLM-frontend contract ratchet (#17174) (#17174)
(frontend) Stop routing build through npm-run-all2's broken {@} re-spawn (#17169)
(slm) Stop repair's own success clearing itself via fetchOrphans (#17157)
(ci) Keep test_self_update_systemd_detach_11492.py at its frozen 691-line ceiling (#17150)
(tests) Set _ansible_dir_explicit on the init-skipping test double (#17150)
(updater) Re-detect ansible_dir per execute_playbook call, not once at construction (#17150)
(slm) Address bb's review nits on the Data hygiene page (#17040)
(ci) Re-pin hooks-path-override 6486 -> 6488 for the security batch (#17154)
(security) Match injection patterns against what a model reads, not the raw text (#16354)
(security) Redact secrets in npu_client log, bound ReDoS-vulnerable regexes (#17104)
(docs,tests) Re-point four THREAT_MODEL anchors and drop two forbidden line citations (#17147)
(ci) Re-pin hooks-path-override 6484 -> 6486 for the consolidated batch (#17147)
(approvals) Dispatcher records every failure to reach a handler's own trail (#17141)
(knowledge,plugin_sdk) Resolve connector/jsonschema imports lazily, not at package init (#17138)
(sync) Is_shallow_repository distinguishes "not shallow" from "could not tell" (#17118)
(ci) Re-pin prompt-injection-detector-strict-mode floor 2940 -> 2944 (#17072)
(ci) Re-pin hooks-path-override floor 6473 -> 6481 (#17072)
(security,tests) Give the human-gated approve-command tests a human, re-anchor THREAT_MODEL, collect the validation-handler tests (#17134)
(repo_tests) Re-pin the four ratchets the merged train moved, and split the reason table out (#17134)
(deploy) Run the pre-flight unshallow from the synced source, not the not-yet-updated install (#17137)
(ssot) Drop the step executor's stale timeout baseline entry now it reads an env var (#17074)
(security) Take the harness's human role from the RBAC Role enum (#17052)
(agents) One PTY command runner for the agent terminal and the overseer (#17078, #17079)
(agents) Multi-line output, truncation and the deadline edge in agent command results (#17074)
(agents) Agent commands finish when they finish; a timeout is never a success (#17074)
(agents) A chat-granted conversation keeps its agent session owned; one locked singleton (#17053)
(agents) Agent-terminal sessions act only for their owner or an admin (#17052)
(security) Allowlist 9 non-secret literals the whole-tree scan flags — model revision SHA, reasons hash keys, X-API-Key header name (#17087)
(api) Isort + a runtime auth negative control for #16375
(api) Import get_current_user before the router that depends on it (#16375)
(i18n) Route TranscriberLayout's settings labels through vue-i18n (#16335)
(kb) Rename legacy shared-facts key to a backup, audit each migration (#16709)
(kb) Default migrate_shared_facts_index.py to dry-run, require --apply (#16709)
(kb) Share_facts routes through the canonical ownership index (#16709)
(security) Stop the model integrity check from failing open (#16899)
(security) Allowlist #17087's new pinned-SHA occurrences in the reasons file
(ci) Audit 2 pre-existing i18n Secret Keyword false positives (#13034)
(ai-ml) Resolve #16899 CI reds — SSOT URL dup, black, secrets baseline (#13034)
(secrets) Route SYSTEM-visibility UI secrets to the envelope vault (#17099)
(security) Resolve #16444's CodeQL red -- reuse secret_log_ref, not a raw id (#16428)
(secrets) The vault mirror's failure log names a registry label, not a tainted parameter (#16444)
(guards) Trim secrets.py by one line instead of raising its ratchet (#16428)
(secrets) Enforce ownership on the connector-bridge read path (#16428)
(secrets) Give GET and PUT their own value-key contract for a bridged secret (#16428)
(secrets) An empty credentials dict is present, not absent (#16428)
(auth) A failed key-request audit write answers an explicit 503, never a bare 500 (#16294)
(security) An agent nobody classified is refused to an external originator, not reached unchecked (#16957, #16950)
(security) Key A2A trust on the verified credential presenting a peer id, with an audited admin re-grant (#16950)
(security) Remove DISCOVERY -- the agent card is public by protocol design, so no trust level can restrict it (#16957)
(security) An A2A peer's task is refused the agents its trust level may not reach (#16957, #16950)
(security) A token a parent holds costs a claude_code child its Bash when no finer tool covers it (#16950)
(security) Only the trusted overlay can give a run an executor identity (#16950)
(security) A delegated subagent inherits its parent's authority, so it cannot do what the parent is held from (#16950)
(approvals) Pin decided_at's ALTER COLUMN to UTC, add a non-UTC-session test (#17072)
(approvals) Match decided_at's column type, fix post-downgrade query (#17072)
(approvals) Fix migration CI red — bind/cast SQL bug and downgrade round-trip (#17043)
(approvals) Close 4 review gaps on the general/LLC unification (#17043)
(rest-train) 8 CI reds on vehicle-v090-2026-09-19-rest (#17133)
(ci) Rest-train reds — SLM publisher contract accepts templated build:slm, sanitized source-delete error, audited doc placeholder (#17133)
(agents) Retain the idle-notice publish task via fire_and_forget; allowlist a fake test key (#16949)
(ci) Make same-scope batching check vehicle-aware and advisory (#17128)
(updater) Filter _sd_own_marker_is_legacy through | bool at assignment (#16310)
(updater) Unshallow code_source and re-bootstrap legacy markers (#16310)
(media) Parse office and ODF documents instead of plain-texting them (#16784)
(hooks) Repair pre_push_open_pr_cap_17006_test's sandbox for #16728's selection call (#17008, #16711)
(ci) Address open-PR cap review findings (#17006)
(tests) The deploy_artifacts lockstep test binds the module it registers onto the parent, so the two never diverge (#16722)
(tests) The slm services stub is a hollow package, not a MagicMock with a path (#16722)
(tests) The services stub answers pytest's package-module attributes, so Package.setup doesn't read an invented pytest_plugins (#16722)
(tests) The slm conftest's services stub carries path, so pytest never re-imports the real package over it (#16722)
(hooks) Pre-push selects tests by pytest.ini's python_files, so a changed test_*.py runs (#16711)
(analytics) Sanitize error text, direct registered_source_ids() tests (#17065)
(backend) Close the remaining fail-open gaps and surface outages (#17039 review)
(backend) Fail closed on a source-registry outage (#17039 review)
(slm) Address #17096 review — SSOT autobot.base_dir, restart-write race, malformed-tracker robustness, exhaustion cause (#16020, #16712, #16970)
(slm) Stop services/*_test.py collection from leaking the real package into sys.modules (#16020, #16712)
(slm) Ensure the shared TLS cert on vnc/redis-only nodes and persist the reconciler's service-restart cap (#16020, #16712)
(deploy) Ensure the shared TLS cert for vnc/redis-only nodes, persist the reconciler's service-restart cap, fix a hardcoded frontend path (#16020, #16712, #15603)
(ci) Repoint the hardcoded-values baseline at the renamed frontend path (#15603)
(deploy) Drop the dead exec_start from the user-frontend manifest too (#15603)
(deploy) The user-frontend build sites publish through a staged swap (#15603)
(agents) Claim an agent id atomically, answer a shed request at once, one overload log per episode (#16986)
(agents) Bound in-flight handlers and inboxes, one live owner per channel, peer requests through tracking and claims (#16986)
(agents) The peer channel delivers to the recipient, broadcast reaches every other agent, a forwarding hop gets its reply (#16986)
(agents) Clamp presence env vars, real tenancy test, per-company isolation (#16947, #16965)
(agents) Wire production callers for the presence registry (#16947, #16965)
(agents) Refuse AI_STACK peer messages with no wired drain (#16948)
(agents) Extract the shared heartbeat-run join to kill duplication (#16947)
(agents) Wire real busy/idle for SESSION and AI_STACK presence (#16947)
(agents) Persist tenant_id across a session's Redis reload (#16975)
(agents) Fail-closed tenancy for presence, tenant-scoped list_live (#16947)
(repo_tests) Re-pin prompt-injection-detector-strict-mode floor for #17048's combined population (#17129)
(security) Echo the bearer subprotocol when the intelligent agent accepts a WebSocket (#17000)
(ci) Pr-preflight.sh mentions python-suite now that it is required (#17129)
(security) Audit 2 remaining unaudited base-branch secret findings (#17130)
(repo_tests) Unblock python-suite on main -- 6 more failures (#17129)
(repo_tests) Record #15317's .service/.service.j2/docker/*.yml globs (#17124)
(knowledge) Carry forward legacy-id facts instead of duplicating them (#17124)
(knowledge) Scope claude_memory_importer's fact_id by owner (#17124)
(repo_tests) Add tracked reasons for #17102's 18 carried .secrets.baseline entries (#17108)
(security) Audit #13708's redaction-test fixtures into the secrets baseline
(repo_tests) Correct a mislabeled SPECIFIC_REASONS entry (#17108 review)
(ci) Prune the now-stale 0.0.0.0:11434 baseline entries (#16771)
(repo_tests) Ratchet two reach floors for the #13708/#16771 redaction feature's ~211 new test files (#17108)
(repo_tests) Red-main base fixes — nginx floor migration, python-suite filter gap, secrets baseline reasons, hermetic subprocess env, stale hardcoded-value entries
(test) Give result.metadata a real dict in 3 multimodal perf/scalability mocks (#16990)
(infra) Gate doc-sync to main-at-origin-tip, move it off post-commit (#16934)
(security) Restore empty-bind alternation and catch chromadb host networking (#15317)
(security) Close 3 nits from the chromadb bind guard's re-review (#15317)
(security) Close the chromadb bind guard's two review gaps (#15317)
(tests) Add negative control that _python_files pruning happens during the walk, not after (#16601)
(tests) Add negative control that pruning happens during the walk, not after (#16601)
(tests) Prune SKIP dirs during the walk, not after rglob returns (#16601)
(hooks) Back up a superseded pre-commit hook before overwriting (#16923)
(hooks) Stop post-checkout reverting the #16923 pre-commit hook
(ci) Chain formatter dispatch after the branch guard in pre-commit (#16923)
(session) Short SHA in the handoff — a 40-hex string trips detect-secrets HexHighEntropyString (#16778)
(kb) Hold both #16707/#16708 ceilings at their original values instead of raising them
(kb) /knowledge-maintenance/lint reads kb.chroma_collection, which the knowledge base never defines (#16707)
(ci) Audit_api_wiring.py imports dead_surface without a broken sys.path assumption (#16816)
(ci) The dead-surface test imports from dead_surface, and carries its license header (#16816)
(llc) Read the stall timeout via env_int so a malformed value cannot fail at import (#16817)
(llc) Declare stalled_run_sweep as an eager task module in the split-import guard (#16817)
(slm-backend) Retain the last five discarded background-task launches (#15524)
(admin) Add the missing adminMenuItems entries for pricing/mcp-servers (#16933)
(llc) Isort costs.py imports; fix double /costs prefix in the new quota-windows test (#16951)
(agents) Stop dropping real quota headroom that names an unlisted window (#16951)
(ci) Bump the mcp CI floor mirror to match the landed dependabot bump (#16449)
(hooks) Use stdin JSON instead of $TOOL_ARGS in settings.json hooks (#17024)
(reconciler) Stop a DB-level failure poisoning the heartbeat session (#17070)
(security) Redact identifier-shaped passwords, tighten basic-auth URL scan (#13708)
(knowledge) Resolve file-size-ratchet overages from #13708's redaction chokepoints (#13708)
(security) Move the credential chokepoint to sanitize_fact_content, close the version-rollback gap (#13708)
(security) Redact credentials at the true KB write chokepoint (#13708)
(security) Wire credential redaction into gdrive/onedrive PDF+text branches and manual upload (#13708)
(secrets) Resolve #16895 CI reds — black formatting, secrets baseline (#13708)
(multimodal) The response says whether a result was stored, and if not, why (#16926)
(security) Route smart_retrieve_knowledge/retrieve_combined_knowledge through the content firewall (#16771 AC5)
(security) Re-firewall budget_grounded_context's own rebuild (#16930)
(ci) Resolve #16930's code-quality red -- zero-growth ratchet fix (#16771)
(session) Short SHA in the handoff — a 40-hex string trips detect-secrets HexHighEntropyString
(ci) Replace a fixed-sleep test assertion with a real lock-wait proof, add research-to-issues to the agent tier map (#16255, #17021)
(ci) Size the trailer gate's fetch to the PR so a release is scanned whole (#16931)
(backend) Split multi-agent orchestration out of ai_stack_integration.py (#16716)
(backend) Consolidate #16908 duplicate-route dedupe into #16716's branch (#16665, #16908)
(kb) Move the knowledge_rag_loop import to the top of knowledge_rag.py (#16665)
(security) Remove admin read bypass from KB-fed chat/RAG synthesis (#16716)
(kb) Configure rag_integration_api_test.py's ownership_manager mock for advanced_search's permission filter (#16665)
(deploy) Guard play-level nginx reload handlers, safe the unused nginx role handlers (#16979)
(deploy) Order nginx handlers test-before-reload, harden non-symlink checks (#16979)
(deploy) Enable rendered nginx sites on self-update, not just full provision (#16979)
(deploy) The align tasks must only replace the known default, not any value (#16299)
(deploy) Remove the AUTOBOT_BACKEND_SECRET_KEY/GRAFANA_ADMIN_PASSWORD backfills (#16299)
(hooks) The non-git guards tell invoking a command from naming one (#14144)
(test) The unreachable tolerance is empty — neither hyphenated spelling is gated on (#14288)
(test) Drop browser-automation from the unreachable tolerance now its last gate is gone (#14288)
(deploy) Browser cleanup targets the plain 'browser' group, not the deprecated underscore spelling (#14288)
(deploy) Point the cleanup plays at group names an inventory actually emits (#14288)
(kb) The RAPTOR tree is built at all, and its nodes cite their chunks (#14968)
(security) Strip the stray line_number field #17067 reintroduced into .secrets.baseline (#16353)
(chat) Guard every remaining post-unmount await in chat init (#16274)
(chat) The init stops at its first await once the component unmounts (#16274)
(hooks) Pre-push's targeted vitest run strips the autobot-frontend/ prefix (#16470)
(collaboration) Stay under the frontend fragmentation ratchet after rebase, fix a ref-unwrap test bug (#16470)
(collaboration) Show an inline error when responding to an invitation fails (#16470)
(docs) Correct two stale THREAT_MODEL.md line anchors for auth_middleware.py (#17042)
(ci) Pin explicit parametrize ids in orphan_repair_test.py to stop pytest-xdist worker mismatch
(ci) Record the frontend-source glob dependency of the #16299 VNC-password guard (#16299)
(ci) Trigger the whole-tree secret scan on .secrets.baseline changes too (#17067)
(security) Audit the test_orphan_secret_repair.py fixture in .secrets.baseline
(ci) Mark the login token_type label as not a credential for bandit (#17042)
(ci) Split the Cipher construction so the B305 nosec lands on bandit's flagged line (#16299)
(ci) Audit 2 false-positive secret-detection findings, suppress the mandated DES-ECB bandit finding (#16299)
(auth) Lower the mirrored size ceiling for auth_middleware.py too (#17042)
(auth) Request-revision on an approval gate needs a person too (#17042)
(auth) Know a login token by positive evidence, not absent claims (#17042)
(auth) Attribute approval decisions to the verified human caller (#17042)
(merge) Un-squash two dict entries the conflict resolution merged onto one line
(slm-agent) Mirror the heartbeat GPU changes into the Ansible role's agent copy (#16280)
(backend) GPU availability sees any NVIDIA GPU, not only an RTX 4070 (#16289)
(ci) Read each queued job's labels, so hosted saturation is never reported as a self-hosted outage (#16309)
(deploy) Stop rescuing genuine registration failures, defer only the expected one (#16299)
(deploy) Fix the real deploy-ordering bug, not just delay it (#16299)
(deploy) Fix 4 review findings on #17069 -- deploy ordering, plaintext transit, protocol, no_log
(frontend) Keep the WebSocket protocols option out of Required<> defaults (#17009)
(ops) A resumed operation's raw checkpoint never reaches the panel, migrate creates and records its creator, resume tested for creator and admin (#17017)
(ops) Await get_operation — every status, cancel, resume and progress lookup received a coroutine, not an operation (#17017)
(ops) Operations reach the panel in the shape it reads; the old conversion answered 500 for every status and list (#17017)
(ops) The test-suite route creates an operation that records its creator, unimplemented start routes answer 501, and every read or control is its creator's or an admin's (#17017)
(security) The operation progress socket authenticates before it reveals whether the framework is up (#17009)
(security) An unreadable session owner is unowned, and a raising WebSocket authorization check refuses with 1008 (#17009)
(frontend) The five clients of the newly authenticated WebSocket endpoints send the bearer subprotocol (#17009)
(security) Authenticate nine WebSocket endpoints before accept, scope the overseer and workflow sockets to their owners, and make /api/long-running admin-only (#17009, #17010)
(ci) Resolve #16891 CI reds — oxlint spread, black formatting (#16457)
(frontend) MockWebSocket supports addEventListener, not just onX properties (#16457)
(docs) Move bug-pattern checklist to CLAUDE_REVIEW.md per lean-instructions rule (#17028)
(docs) Correct diff-semantics and worktree-exception wording in CLAUDE.md (#17021)
(frontend) Fix components_declaring_styles' own +1, recount the 2 approved size counters (#16972)
(i18n) Recount 10 locales' untranslated-string baseline (#16973)
(frontend) Bring #16875's ratchet growth back down, 4 of 7 metrics clean (#16875)
(ci) Audit 2 missing .secrets.baseline entries blocking every PR (#16960)
(test) Resolve the sidebar path with node:path, not a relative URL base (#16901)
(llc) The workflow builder reaches the Company OS menu (#16901)
(terminal) The legacy workflow-step modal can open (#16312)
(files) The extension guard reads deny sets too, and says so (#16521)
(files) .con was a truncated .conf, and the guard now checks every entry against a named list (#16521)
(files) .con was a truncated .conf, and the guard now checks every entry against a named list (#16521)
(security) Judge an envelope secret under a row lock held to the write; a refused store write is an error, not a refusal (#15779, #16940)
(security) Repair an orphan through its own type's service, and only a genuine one (#15779, #16927, #16940)
(api) Move the repair-grant models out of the router into a companion schemas module (#15779)
(skills) Route the catalog-fetch timeout through SSOT config (#16595)
(security) Admin break-glass repair for unreachable null-scope resources (#15779)
(backend) Dedupe channel authorization between subscribe and command paths (#14893)
(ci) The batching gate stops claiming one issue where it counts zero (#16855)
(guards) The git-write scrub guard gates clone, and exemptions cite an issue (#15490)
(ci) Use the named timeout constant at the call site (#16859)
(ci) Name the gh timeout constant, matching the convention in pipeline-scripts (#16859)
(ci) The gh timeout is an env-overridable helper, not a hardcoded literal (#16859)
(ci) Tell "gh failed" apart from "no open PR" in pre-push's body check
(ci) Allowlist the header-check token fixtures so the whole-tree secret scan passes (#15204)
(hooks) Remove core.hooksPath on presence, not on value (#16812)
(collaboration) Keep the #16580 rationale out of the published API description
(ci) A missing PR template heading is reported as missing, not empty (#16793)
(ci) Only a closing keyword makes a pull request batched (#16795)
(infrastructure) Keep the #16426 rationale out of the published API description
(guards) Filter entry instead of a raised MAX, fix a stale test signature (#16442)
(guards) Record the new concrete-literal frontend read for #16427's test (#16442)
(slm) Restore the underscore-prefixed alias names in slm_frontend_build.py (#16717)
(tests) Bypass the #13312 subprocess guard for real git calls in the shallow-clone bootstrap tests
Pay for #16640/#16717 growth by moving code out, not raising file-size ceilings (#14236)
(slm) Update-all no longer reports completed while a co-located deploy failed (#16640)
(slm) A forced resync of autobot-slm-frontend no longer deletes its live bundle or rollback (#16717)
(repo) Add the missing SPDX header to the changelog-branch guard (#16563)
(release) Changelog branch carries no slash, and the PR step classifies its own failure (#16563, #15167)
(kb) An update keeps the route that wrote the fact (#16770)
(vehicle) Chain the kb visibility backfill migration after collaboration_events so alembic has one head (#16693)
(vehicle) Drop the unused CollabEventResponse import oxlint flags in services/api.ts (#16460)
(ansible) Resolve two update-path regressions (#16750) (#16752) (#16752)
(vehicle) Derive #16471's collaboration response types from the API contract; responses back to 187 (#16460)
(vehicle) Drop #16471's local Session*Response copies; main imports them from the api contract (#16460)
(kb) The backfill's candidates are a migration-set column, so adoption observes it and decided facts drop out (#16693)
(vehicle) Repoint the references #16454's mcp rename stranded (#16449)
(test) Restore sys.modules['mcp'] after the shadow guard runs (#16449)
(ci) Install the real mcp SDK in CI so the shadow guard means something (#16449)
(mcp) Fix stale path, root-cause the SSOT red, generalize AC3's guard (#16449)
(mcp) Rename autobot-backend/mcp/ off the name it shadows (#16449)
(i18n) Translate the two collaboration-panel strings copied English into fr (#16460)
(ratchet) Bump 4 baselines for this PR's own new collaboration UI (#16460)
(collaboration) Tailwind @reference and stop colliding with the fake-shape banlist (#16460, #16443)
(kb) Six callers and a doc pass get_fact(query=...) to a synchronous get_fact(fact_id) (#16710)
(deps) Raise dependency_patching's pypdf floor to 6.18.1 to match the manifests (#16742)
(kb) Lower UNFILTERED_READ_CEILING to the count after #16691, #16706 land together (#16667)
(knowledge-ui) Dedupe stat-card CSS against the shared components.css classes (#16695)
(knowledge-ui) Move Watch Folders under Knowledge → Manage and fix its form styling (#16695)
(kb) /rag/scoped never takes the admin read bypass -- it no longer calls the /scoped route, whose role-derived bypass it inherited (#16662)
(kb) Explicit read APIs pass the admin read input, and fact store and delete degrade without an ownership manager (#16662, #16685)
(kb) Read shared_with and group_ids back as lists on share, unshare and cleanup; pin the admin read bypass to explicit read APIs (#16662)
(kb) Restore the category-counts allowlist entry the guard's scan can't clear (#16665)
(kb) Restore 2 allowlist entries the guard's single-hop scan can't clear (#16665)
(kb) Correct the analytics import path, and decode JSON-encoded fact metadata before filtering (#16665)
(kb) Correct the response-schema import path in the two extracted routers (#16665)
(ansible) Apply constraints/shared.txt on every path filling /opt/autobot/venv (#15684)
(ansible) The remaining 13 venvs create with python -m venv, no guard exemptions left (#16641)
(ansible) Venvs create with python -m venv, chdir their relative editables, single-source two venvs (#16641)
(tests) Raise the real redis ConnectionError in TestPersistHeadroomFrom429's mock (#15026)
(llm) Treat a None Redis client as unavailable too, not an AttributeError (#16483)
(llm) Narrow quota_headroom's Redis fallback to real Redis errors, stop one bad entry sinking the whole store (#16483)
(redis) The deploy scripts survive a missing secret key under pipefail, and redis-cli arguments are shell-quoted so an empty password keeps ping as the command (#16678, #16686)
(ratchet) The audio-extension-allowlist floor must clear completed(), not just examined() (#16702)
(ratchet) Raise the audio-extension-allowlist REACH floor for the combined vehicle tree (#16702)
(vehicle) Reconcile 3 CI regressions surfaced by the combined tree (#16702)
(ratchet) Recount fa/he/ur locale baselines on the combined vehicle tree
(ratchet) Recount ar locale's untranslated baseline on the corrected 14-member vehicle
(tests) Use a long-lived child to avoid the pid-reuse test's own race (#13097)
(llc) A finished run polled after its stall deadline never touches a vanished pid (#13097)
(llc) Drop the duplicated registry docstring paragraph (#13097)
(llc) Survive a missing boot time and honour the SIGKILL grace period (#13097)
(llc) Never signal a process the run no longer owns, and judge a dead run by its exit (#13097, #13099)
(llc) Kill a stalled agent run instead of holding its slot for the full timeout (#13099)
(llc) Kill the agent's whole process tree on cancel and timeout, not one PID (#13097)
(guard) Shrink the remaining 47 cleared import-hermeticity offenders (#16262)
(guard) Shrink 4 cleared import-hermeticity offenders (#16262)
(config) Drop @computed_field on external_url, keep it out of dumps (#16262)
(config) Defer external_url's socket probe past import time (#16262)
(guards) Clear the three guard findings on the sync-deletion branch (#16310)
(slm-frontend) The drift panel's helpers accept the readonly data the template passes (#16310)
(slm) Cleanup can't abort the fleet, the bootstrap switch is a real bool, and each shared pin is bounded (#16310)
(tests) Expect bootstrap_required in the planner CLI's JSON, and test the unknown-commit path (#16310)
(slm) Dash-safe deletion shell, target-side delete list, bootstrap fallback for an unknown marker commit (#16310, #16322)
(tests) Site.yml's real path, an unmasked xfail, move two tests under tests/services/ (#16310)
(tests) Slash-free injection payload, --allow-empty no-op commits, restore "services" (#16310)
(drift) Stop the source-disk walk from hiding a kept, gitignored file (#16310)
(deploy) Reach the update path, not just main.yml, for #16310 deletion + AC4 (#16310)
(deploy,drift) Re-deliver AC4 via ansible, wire full-tree drift into the SLM GUI (#16310)
(sync-deletions) Catch rename-only paths, prove injection resistance, quote non-ASCII names (#16310)
(deploy) Bound the bootstrap enumeration, contain a fleet failure, stop the marker being wiped (#16310)
(deploy) Move deletion into the ansible roles themselves (#16310, closes #16322)
(sync-deletions) Never write .deployed_commit, skip host state, stay contained (#16310)
(code-sync) Remove files deleted from source on every update, never untracked host state (#16310)
(guard) Tighten octal-digit check and share the offense loop (#16522)
(guard) Reject a non-string TLS key mode instead of misreading it (#16522)
(infra) Route the shared TLS cert-ensure through the builtin updater, fix frontend key mode (#16522, #16566)
(infra) Consolidate the last 3 private TLS-cert-generation copies (#16020)
(frontend) Retire four dead settings API paths, stop a fifth calling admin-gated settings from non-admin surfaces (#16481)
(guards) Recount ur untranslated-string ratchet at the rebased tree (#16245)
(guards) Recount he untranslated-string ratchet at the rebased tree (#16245)
(guards) Recount fa untranslated-string ratchet at the rebased tree (#16245)
(guards) Recount ar untranslated-string ratchet at the rebased tree (#16245)
(guards) Recount distinct_class_names at the rebased tree (5619 -> 5617) (#16245)
(guards) Recount css_rule_declarations at the rebased tree (9401 -> 9398) (#16245)
(guards) Recount inline_generics at the rebased tree (564 -> 562) (#16245)
(secrets) Audit Batch B's locale translation keys into the detect-secrets baseline (#15031)
(frontend) Design tokens for ProviderOAuthConnect's status and error colours (#15031)
(gui) Batch B, i18n gaps and reduced-motion wiring (#15031, #15665, #13960, #14807, #15749)
(llm) Fail open when prompt compression raises (#16526, #16527)
(llm) Read prompt-compression config live per call, not baked into the singleton (#16526, #16527)
(ci) Lower the print/console ratchet baseline and dismiss a CodeQL false positive (#16526, #16527)
(tests) Lower the print/console known-violations count to 352 (#16318)
(comments) Describe role-based placement, not a VM count (#15194)
(agents) Report progress on every exit of every LLM attempt, and bound the stall window by the token wait too (#15950)
(agents) Report progress per LLM attempt, end a run's claim on exit, and give refusals one shape (#15950, #16208)
(slm) An env file must sit strictly under the deployed root, so the guard CodeQL reads leaves no equality branch (#16236)
(slm) Check the env file's containment where CodeQL can see it (#16229)
(slm) Fix the two CI reds blocking the merge train (#16229, #16231)
(pricing) An admin override outranks the live price and survives the refresh (#16229)
(auth) Keep permissions.py at 600 lines instead of grandfathering it (#11542)
(mcp) Update the admin-role dispatch test's _call_bridge stub for the new role param (#11542)
(mcp) Forward reserved_names into discover_and_resolve (#16458 delta)
(collaboration) Wire ShareSecretDialog, fix build/ratchet/i18n regressions (#16443)
(security) Deny an SLM token when its revocation check cannot run, HS256 and RS256 (#16387, #16412) (#16413) (#16413)
(hooks) Pre-push always uses the merge-base range, not remote_sha..local_sha (#16637) (#16639) (#16639)
(ci) Reconcile the dependabot train's ansible-floor-sync and CI pin fixes onto main (#16591) (#16636) (#16636)
(migrations) Port 6 orphaned tables into the canonical Alembic chain (#16464) (#16467) (#16467)
(code-sync) Fetch --prune before self-update, so a moved branch tip doesn't stall the fetch stage (#16610) (#16612)
(slm-frontend) Give the service-log fetch one path and its real timeout (#16256) (#16500)
(guards) Fold shell continuations in the hooksPath guard via one shared helper (#15961) (#16414)
(files) Conversation uploads accept PDF and GIF, not the truncated '.pd' and '.gi' (#16521) (#16523)
(tooling) Scope protect-files.sh's secrets/ rule to real credential storage (#16446) (#16448)
(a2a) Cooperative cancellation checkpoints in execute_a2a_task (#16174) (#16498)
(security) Generate the vault root key from 32 random bytes, not alphanumeric characters (#16405) (#16410)
(security) The dev proxy stops granting admin without a login, and the session check endpoint is tested (#16382, #16385) (#16390)
(config) Register AUTOBOT_BROWSER_SERVICE_HOST/PORT, AUTOBOT_VNC_PORT (#15151) (#16555)
(chat-knowledge) Contexts can be deleted, cascade with their chat, and orphans get cleaned (#16490) (#16503)
(frontend) Converge the permission vocabulary onto the backend's real Permission enum, wire in v-permission (#16243) (#16493)
(security) Require sign-in on seven ungated routers, and admin where they change shared state or reach outside (#16375) (#16418)
(fragmentation) Re-derive the frontend ratchet baselines after batch 2b's combined effect (#16596) (#16596)
(sdk) TypeScript SDK request/response parity + missing /api prefix (#15528, #16495) (#16497)
(frontend) Point artifact-cells/CodeCell.vue at the shared --codecell-syntax-* tokens (#14853) (#16437)
(knowledge) Wire real grounding:stats counters, replacing the hardcoded claim_sources split (#14981) (#16434)
(knowledge) Give _CPUBackend a non-recursive vector-search leaf (#15165) (#16564)
(infra) Clear the debt blocking the last four branch-name swaps, and default install.sh to main (#16540) (#16558)
(ci) Keep line numbers out of the secrets baseline, so a line move no longer rewrites it (#16353) (#16362)
(rag) Wire GPU faiss onto an automated install, gated on GPU alone (#15163) (#16560)
(scripts) Detect-environment.sh only selects files this repo tracks (#15143) (#16553)
(security) Agent_config, sync and hardware-priority record the real caller, not "admin" (#16547, #16541) (#16550)
(llm-shared) Remove dead SemanticLLMCache, keep live semantic cache (#16528) (#16536)
(security) The SLM proxy checks the caller's SLM session before it adds the backend key (#16374) (#16386)
(tests) Stop gating a disk-bound model load on a CPU work budget, and prove it stays offline and import-free (#15055, #15235) (#16404)
(ci) Keep the drift-checked SLM agent mirror out of the duplication scan (#16401) (#16402)
(ci) Bring CI's pytest environment up to its declared floors, and gate on them (#16264) (#16391)
(ci) Retire the CodeQL suite file nothing loads, and record the real guard behind alert #1030 (#16283, #16302) (#16377)
(security) Write the service-key export only to its configured directory, never into a checkout, and keep one (#16348) (#16372)
(security) Authenticate every skills route, and require admin to change, fetch or execute (#16368) (#16370)
(ci) Let the system-package retry recover from its own timeout, and fetch before unpacking (#15515) (#16367)
(terminal) Render TerminalModals in TerminalWindow, with each action reporting the parent's real outcome (#16285) (#16313)
(ci) Stop the regen bot's approved runs cancelling the job that approved them (#16360) (#16363)
(docker) Retry apt fetches and fail apt-get update on a lost index, set once for every image (#16291) (#16356) (#16356)
(kb) Make three summarisation paths do what they claim (#14840, #15700, #16110) (#16345) (#16345)
(ci) Gate the frontend npm audit on one report, retry it, and report 'could not check' apart from advisories (#16337) (#16357) (#16357)
(guards) Tell a baseline entry that matches nothing apart from one that under-matches (#16334) (#16365) (#16365)
(guards) Scope no-local-schemas to the lines a change added, and point at modules with headroom (#16178) (#16241) (#16241)
(pre-commit) Run detect-secrets serially and refresh the baseline's line numbers (#16343) (#16349) (#16349)
(slm) A failed manifest read evicts its cache entry (#16204) (#16235) (#16235)
(guards) The URL rule stands down in .github/workflows/ (#16260) (#16271) (#16271)
(coordination) Make task a reserved kind in work_claims, and record why the claim primitives stay separate (#15957) (#16215) (#16215)
(gui) Batch A, canonical vocabularies (#14993, #14937, #14939, #15002, #15401) (#16265) (#16265)
(agents) Refuse a malformed declared scope by name on the agent path, and make the tests reach the parser (#16209) (#16267) (#16267)
(a2a) A caller's typo in declared_scopes wedged the task in WORKING forever (#16209) (#16213) (#16213)
(ci) The parked-branch merger has never merged anything (#15938) (#16128) (#16128)
(guards) Name the duplication env var, and stop the reach exemptions growing silently (#16163, #16147) (#16226) (#16226)
(security) Match scan-gate allowances by alias, so a re-keyed advisory cannot redden base (#16222) (#16223) (#16223)
(eval) Give the trajectory gate a candidate that can disagree with it (#16157) (#16160) (#16160)
(guards) The router sweep was wrong four ways, and three guards swept at IMPORT (#16187, #16188, #16202) (#16189) (#16189)
(slm) The manifest cache TTL was hardcoded and its bypass was unreachable from the one caller that needed it (#16026) (#16197) (#16197)
(guards) The reach meta-test could not see .glob(, could not say what it does not check, and the duplication guard could not name its failing scope (#16147, #16154, #16163) (#16168) (#16168)
(ci) One helper for check-run status, and stop truncating the listing (#16120) (#16167) (#16167)
(guards) The hooksPath guard could not read a single git hook (#16139, #15961) (#16141) (#16141)
(kb) The summary evaluator must see more than the opening 200 characters (#16110) (#16130) (#16130)
(guards) Bind the hooksPath guard to what it examined (#16150) (#16151) (#16151)
(ci) Clear the three defects every open PR is inheriting (#16089, #16104, #16122) (#16129) (#16129)
(redis) The guard's own skip was hiding three live instances (#16071) (#16094) (#16094)
(redis) Name the Stack unit everywhere it is operated (#16071) (#16072) (#16072)
(hooks) A non-deny permissionDecision must exit 0 to be read (#15956) (#15996) (#15996)
(hooks) Run autobot-slm-backend as its own pytest invocation (#16069) (#16074) (#16074)
(vnc) Ensure the shared TLS keypair through the shared task (#16020) (#16070) (#16070)
(slm) Manage Redis by the unit the role installs, and fail a restore that cannot stop it (#16061) (#16061)
(slm) A healthy oneshot and a templated unit must not report unknown (#16027) (#16027)
(llc) A status transition's comment reaches the store, not the floor (#16054) (#16054)
(ci) The PR gates accept the readable rationale and let the body override a stale branch (#16053) (#16053)
(auth) An API key's authority is the key's, not its owner's (#16040) (#16049) (#16049)
(tools) The merge gate's blind spots, and naming the ones that remain (#16046, #16044) (#16052) (#16052)
(hooks) The health-route guard reported prose, including warnings against itself (#16011) (#16012) (#16012)
(llc) Stop /heartbeat/report declaring four fields it never stores (#15966) (#16018) (#16018)
(ansible) Nginx and redis must ensure the shared TLS keypair exists (#16020) (#16023) (#16023)
(guards) A bare file name in exclude= excluded nothing (#16013) (#16014) (#16014)
(guards) Three review findings I merged past on #15994 (#15900) (#15998) (#15998)
(guards) The import resolver followed a WSL2 symlink, inverting its own control (#15986) (#16005) (#16005)
(hooks) A timed-out pre-push check fails the push instead of skipping (#15985) (#16006) (#16006)
(guards) Allowlist the #15926 scrub contrast fixture, which turned base red (#16002) (#16002)
(llc) Three review findings I merged past on #15920 (#15905) (#15964) (#15964)
(llc) GH#8252's blocked-by rule had never fired (#15931) (#15939) (#15939)
(test) Assert protobuf parity, not a version literal, in the reach check (#15981) (#15982) (#15982)
(guards) Key path checks on the scan root and on composition, not on spelling (#15900, #15510) (#15954) (#15954)
(pricing) One literal price table, and a guard that found three live disagreements (#15912) (#15918) (#15918)
(analysis) Revive five dead analyzer constructors and widen the F821 guard past the tree that hid them (#15914) (#15915) (#15915)
(llc) Make cost events accrue — wire the routes and price the default model (#15859, #15860) (#15906) (#15906)
(llc) Repair the CEO rows 088 provisioned for non-companies, with executing tests (#15892) (#15883) (#15883)
(tasks) Resolve the man-page indexer from the repo root, not the cwd (#15853) (#15895) (#15895)
(update) Make the update surface say what the update did (#15879, #15881) (#15880) (#15880)
(security) Scope the agent budget slug to its company (#15812) (#15864) (#15864)
(ci) Anchor every trailer arm so documenting the rule does not violate it (#15848) (#15850) (#15850)
(ansible) Remove become from a TaskInclude — it aborts the self-update play (#15823) (#15870) (#15870)
(docs) Give the doc-sync hook an indexer it can actually run (#15845) (#15854)
(install) Make the install-path error handlers reachable and surface provision failure (#15825) (#15851)
(auth) Decide the reporting-line permission without acquiring a DB session (#15805) (#15852)
(safety) Treat a ref-sourced path checkout as destructive, and match at command position (#15835) (#15849)
(ci) Make the ansible fact guard fail on the defect it exists for (#15824) (#15831)
(ansible) Rebind the self-update socket around the backend restart (#15823) (#15832)
(guards,docs) Close a trailer hole, warn on uncommitted work, fix the anonymization rule (#15830, #15836, #15841) (#15842) (#15842)
(ansible) Survive set_fact bool coercion and restore wrong-node cleanup (#15822) (#15827)
(security) Reject escaping segments before building the path expression (#15786) (#15818) (#15818)
(guards) Gate by default and name only what always runs (#15820) (#15821)
(lint) Bind the SPDX header check to a floor of files examined (#15817) (#15819)
(guards) Give the fixture-teardown guard a reachability model (#15810, #15811) (#15815)
(lint) Add the missing SPDX header to the destructive-migration marker check (#15776) (#15816)
(security) Scope agent reporting-line writes to the caller's company (#15794) (#15804)
(guards) Close five scope and derivation gaps in the fixture-teardown guard (#15797) (#15809)
(guards) Sweep the whole tree for unregistered env vars, not just staged files (#15807) (#15808) (#15808)
(test) Contain the auth stub to the import that needs it (#15799) (#15799)
(tooling) Gate every unscrubbed git subprocess, not just --show-toplevel (#15783) (#15784) (#15784)
(security) Gate the agent org routes — reporting-line writes took no caller identity (#15794) (#15798) (#15798)
(api) Map database integrity errors onto 409/422 instead of 500 (#15775) (#15787) (#15787)
(user-mgmt) A concurrent duplicate returns the same 409 as a sequential one (#15780) (#15780)
(security) The cognition-store seed admin gate now actually executes (#15768) (#15768)
(auth) Change-password gates on caller identity, closing the account-takeover path (#15752) (#15752)
(auth) Make the ungated-core-router sweep repeatable (#15745) (#15760) (#15760)
(user-mgmt) Make the authorization posture of user-management routes legible and testable (#15744) (#15744)
(user-mgmt) 409s carry the real conflict, plus test/lint scope cleanup (#15730, #15736) (#15740) (#15740)
(auth) Exempt npu status from service-auth 401s, guard the drift (#13008, #13365) (#15735) (#15735)
(test) Auth_middleware stub: real contract for every name, no catch-all (#15729) (#15729)
(deploy) Give pip a cwd where its relative editables resolve (#15733) (#15734) (#15734)
(deploy) Stop localhost plays touching the autobot mapping (#15731) (#15732) (#15732)
(deploy) Give the shell SLM-frontend publishers the #15557/#15610 shape (#15721) (#15721)
(config) Clamp 58 os.environ.get-wrapped module-level env casts (#15710) (#15716) (#15716)
(deploy) Resolve infra-tree paths against a root something maintains (#15726) (#15727) (#15727)
(config) Clamp module-level env casts against crash-at-import (#15711) (#15711)
(test) Make the ansible repo_tests resolve role defaults that derive from the SSOT (#15714, #15632) (#15712) (#15712)
(prompts) Give three LLM prompts the inputs they were already promised (#15630, #15681, #15682) (#15699) (#15699)
(deps) Make each worker manifest declare what its ansible role installs (#15660, #15671) (#15686) (#15686)
(slm) Clamp the release-keep bound so a bad value cannot break import (#15610) (#15688) (#15688)
(workflow) Send the intent-analysis prompt the request it names, screened and data-framed (#15651) (#15683) (#15683)
(deploy) Publish the SLM frontend by flipping a symlink, not by two renames (#15610) (#15654) (#15654)
(guards) Carry the ternary and emitted-bare placeholder classes the detector could not see (#15627, #15628) (#15652) (#15652)
(backend) Stop two background paths from capturing request-scoped ORM rows (#15611, #15612) (#15618) (#15618)
(async) Schedule watchdog events across the thread boundary, retain the launches that were dropped, and stop the pool leaking a mid-create container (#15636, #15637, #15638) (#15644) (#15644)
(guards) Widen the background-task retention ratchet to both backends and triage the population it could not see (#15619) (#15639) (#15639)
(ssot) Derive the ansible constraint fallback and the journal SSH ceiling from the SSOT (#15601, #15620) (#15634) (#15634)
(config) Split the backend component out of env_registry so variables can be registered again (#15624) (#15625) (#15625)
(ci) Pair the required code-quality context with a complement shim over a shared filter file (#15608) (#15631) (#15631)
(strings) Drain the placeholder census and carry both halves it dropped (#15613, #15614, #15617) (#15626) (#15626)
(ansible) Bring ansible pip declarations back onto the requirements they provision against (#15596, #15597, #15598) (#15623) (#15623)
(slm) Give the background replication job its own DB session (#15549) (#15615) (#15615)
(tests) Make an unavailable real-load announce itself instead of vanishing (#15563) (#15605) (#15605)
(ci) Publish startup-import-smoke from a complement shim so a non-backend PR can merge (#15606) (#15607) (#15607)
(ansible) Stage the SLM frontend publish and repair three backend path defects (#15557, #15560) (#15602) (#15602)
(logging) Read config through the accessor that walks a dotted path (#15575) (#15594) (#15594)
(config) Declare the four logging toggles, wire the one that can be wired (#15587) (#15593) (#15593)
(config) Point install.sh at a live redis key, and drop the LLMSettings collision (#15577) (#15591) (#15591)
(config) A live agent crash found behind a test that reported it as a pass (#15255, #13382) (#15582) (#15582)
(logging) Read the log level key that is actually published (#15575) (#15586) (#15586)
(infra) Eleven generators emitted their own placeholder syntax (#15585) (#15588) (#15588)
(infra) Clear the lint backlog, and the three real bugs hiding inside it (#14505) (#15584) (#15584)
(skills) Validate uploaded documents against the data root, not just the code root (#15293) (#15583) (#15583)
(config) Remove three inert project-root placeholders and one orphaned copy (#15044) (#15570) (#15570)
(deploy) Make the autobot_shared symlink relative and unify backend_install_dir (#13539) (#15559) (#15559)
(deploy) Publish the SLM frontend atomically and give recovery its own surface (#15462, #15475) (#15556) (#15556)
(api) Give POST /api/agent/execute_command a JSON body model both SDKs can send (#15527) (#15541) (#15541)
(slm) Retain seven background tasks; record five blocked on the file-size ratchet (#15524) (#15548) (#15548)
(deps) Clear the two advisories that redden every PR from base (#15520, #15540) (#15550) (#15550)
(api-contract) Give the five untyped SLM endpoints a response_model (#13139, #13138) (#15539) (#15539)
(sdk) Send the fields the routes read and align the SDK docs with the shipped packages (#15057, #15058, #15141, #15170) (#15526) (#15526)
(slm-frontend) Point the self-service password change at a served route and guard the class (#15533, #15236) (#15538) (#15538)
(slm) Retain self-update tasks, bind the verdict to its run, unbreak the reconciler (#15522, #15523) (#15525) (#15525)
(terminal) Stop naming an SLM SSH route that was never built; make post-checkout stop rewriting itself (#15236, #15532) (#15535) (#15535)
(deps) Declare the hard dependencies nothing installs and pull nested manifests into dependabot's reach (#15035, #14562) (#15517) (#15517)
(paths) Resolve phantom autobot-user-backend references and untrack scheduled workflow state (#15193, #14479) (#15514) (#15514)
(tests) Anchor guard sweeps to their own scan root, not the working directory (#12993, #14484) (#15511) (#15511)
(lint) Floor every full-repo sweep and gate git ls-files (#14896, #14895, #13200) (#15504) (#15504)
(security) Watch the secrets store from the health surface and state why the pattern sets diverge (#14126, #14042) (#15458) (#15458)
(automation) Count landed files, not just surviving lines, in the branch sweeps (#15036) (#15489) (#15489)
(security) Bump browserslist in the TypeScript SDK past the same advisories (#15467) (#15481) (#15481)
(terminal) Send RiskLevel on the wire and surface the blocked-command warning (#14995, #14992) (#15474) (#15474)
(chat) Apply the page parameter and describe the session and message rows (#15186, #15138) (#15470) (#15470)
(deploy) Make installer-written units obey the ansible unit rules, and guard label keys (#14100, #14123) (#15457) (#15457)
(i18n) Translate the terminate confirmation and ratchet untranslated strings (#14209) (#15448) (#15448)
(security) Bump browserslist past the OOM and prototype-write advisories (#15467) (#15468) (#15468)
(deploy) Ship the libs/ and autobot-plugins/ workspace packages the frontends build against (#15462) (#15464) (#15464)
(ci) Accept slashed scopes, skip enum unions, and stop the print hook spawning awk per line (#14076, #14073, #14115) (#15436) (#15436)
(deploy) Give the installer's chromadb unit a reachable start limit and document the gateway variables (#14100, #14145) (#15453) (#15453)
(security) Stop a broken secrets store reading as empty, and normalise before pattern matching (#14126, #14042) (#15450) (#15450)
(security) Own imported sessions and stop unreadable ownership reading as unowned (#14026, #14033) (#15433) (#15433)
(frontend) Consolidate the duplicated load-failure styles and unblock the ratchets (#12731, #15429) (#15454) (#15454)
(llc) Make the board data contract honest and surface load failures (#14044, #14064, #14074, #14075) (#15429) (#15429)
(deploy) Diff dependencies across the whole deployment and stage the frontend build (#15430, #15418) (#15432) (#15432)
(config) Restore 9 more pre-#7437 ssot_config defaults (#13264) (#15425) (#15425)
(ansible) Install browser worker deps into its venv and guard pip isolation (#15417) (#15419) (#15419)
(slm-frontend) Surface failed per-service actions and record the full capability diff (#15224) (#15420) (#15420)
(frontend) Restore the SPDX header on both useToast shims (#14907) (#15412) (#15412)
(ci) Sweep open PR heads for the infrastructure-retry watchdog (#15139) (#15399) (#15399)
(test) Unwrap config_consolidation_p2_test.py's swallowed asserts, lower the #15189 ratchets (#15393) (#15393)
(config) Restore 22 more pre-#7437 ssot_config defaults (#15343) (#15343)
(automation) Branch sweeps must test landing, not ancestry (#15036) (#15366) (#15366)
(ci) Re-dispatch infrastructure-caused reds, and close the merge_group gaps (#15139) (#15396)
(frontend) IsAdmin rejects superadmin, mirror backend is_admin_role() (#14937) (#15356) (#15356)
(slm) Close post-sync silent-divergence window and detect stale processes (#15371) (#15371)
(ci) Three stale action pins, a closed-issue citation, and two guards to catch both recurring (#15347) (#15347)

CI/CD

(migration-gate) Add jsonschema and prometheus_client, found by walking the import graph (#17134)
(migration-gate) Install defusedxml, which the eager connector package makes mandatory (#17134)
(migration-gate) Install aiohttp for the #17099 coordinator test (#16444)
(security) Exclude secrets_baseline_legacy_keys.json from detect-secrets (#17130)
(python-suite) Queue the shards first in, first out across PRs, with a per-shard job-level queue: max group (#16320)
(filters) Run the python suite when the files the reduced-motion guards read change (#15749)
(python-suite) Dump a hung test's traceback via faulthandler_timeout from one shard setting (#16516) (#16602)
(release) Open a weekly sync PR from Dev_new_gui into main, never merging it (#16246) (#16263) (#16263)
(duplication-guard) Gate each scope on its absolute duplicated-line count, so deleting unique code can't fail it (#16319) (#16323) (#16323)
(codeql) Return code scanning to advanced setup, gated by paths (#16283) (#16304) (#16304)
(codeql) Stop claiming exclusions a query filter cannot make, and make pin labels agree per SHA (#16302, #16303) (#16311) (#16311)
The trailer gate cloned 12,874 commits to read about five (#16207) (#16210) (#16210)
Make python-suite reportable on stacked PRs and in a merge queue (#14747, #14353) (#16098) (#16098)
(duplication-guard) Scan the three trees it never opened (#13044) (#16095) (#16095)
(perf) Delete the formatting bot — it is the third application of the same tools (#15934) (#16081) (#16081)
(npm) Gate four ungated npm test runners and record the measured reason for the rest (#15674, #15675, #15676, #15677) (#15697) (#15697)
(slm-frontend) Run the vitest suite in CI, repair the four suites it red-lights, and guard the class (#15667) (#15685) (#15685)
(python) Report the real shard count, and hold it to the matrix (#14353) (#15565) (#15565)
(guard) Enforce same-scope batching and documented blanket skips (#15492, #15488) (#15493) (#15493)
(perf) Scope enforce-precommit to the PR diff and cache its hook environments (#15358) (#15392)
(runners) Merge_group triggers for every required context, and off self-hosted (#14054) (#15394)

Documentation

(research) Correct a false orphaned-role claim and record the issues filed (#17257) (#17269) (#17269)
(research) Paraphrase quoted source copy — a verbatim sentence is a searchable fingerprint (#17217)
(research) Correct three citations and record the citation audit (#17217)
(research) Land the regulated-readiness source analysis (#17217)
(claude) Finish what you started — append to an open PR before opening a new one (#17128)
(secrets) Correct index.ts's stale ShareSecretDialog wiring note (#16429)
(changelog) Add fragment for #16429
(claude) One Closes per line; record the same-file one-PR rule (#17110)
(hooks) No bypass in the hooks README — only the conforming route, and a blocking hook is a defect to fix or file (#17029)
(chat) Drop the literal bind URL from outbound_url's docstring so the hardcoded-values gate passes (#16771)
(changelog) Add fragment for #16785 (DocumentExtractor csv/json/html)
(deploy) Note the accepted edge case in grafana_admin_password's generate guard (#16299)
(changelog) Name the browser group the cleanup play actually targets (#14288)
(changelog) Add fragment for #14288 (cleanup group names)
(ci) The two PR gates name their importer, because pre-push cannot warn you (#16859)
(security) Move two THREAT_MODEL anchors that this branch's comment reflow shifted (#16457)
(claude) No agent cleans up data or credentials on its own — human-approved, always-reviewable, paper-trailed (#17038)
(claude) Known Self-Inflicted Bug Patterns checklist (#17028)
(claude) Pre-push checklist, verification rule, research-to-issues skill+agent (#17021)
(research) Add a third confirming data point to the NAS app-store generalization
(research) Compose-based NAS/homelab app-store distribution channel
(research) Correct index scope and self-review audit for multi-agent-executive-advisor (#16766)
(research) Compare Company OS against an external multi-agent executive-assistant product (#16762)
(rules) Forbid privilege escalation, with a tested guard proposed for whoever can apply it (#12662)
(ci) The runner-health probe is live, not dormant as its header claims (#14444)
(roadmap) Replace the December 2025 snapshot with measured current counts (#16803)
(research) Land the sandboxed agent VM orchestration analysis (#16867)
(architecture) Map every control-plane layer to its doc and enforcing code (#16835)
(tools) Check_run_status cites #16046, not the unrelated #16040 (#16046)
(research) Index row follows the voice pipeline status (#16814, #16815)
(research) Voice pipeline status names all five filed issues (#16814, #16815)
(research) Second comparison pass — eval framework and per-provider formatting findings
(research) Index both orphaned research passes
(research) Add streaming-voice-agent-pipeline-architecture.md
(research) Add document-to-markdown-conversion-pipeline.md
(store-authority) Trim activity_audit_trail's write_sites after #16466 (#16460)
(changelog) Add fragment for #16443
(positioning) Add NIS2 fit alongside EU AI Act, ISO 42001, ISO 14001 (#16733)
(positioning) Add ISO/IEC 42001 and ISO 14001 fit alongside EU AI Act (#16733)
(positioning) State Why/How/What and the EU AI Act governance fit in README and Platform Model (#16733)
(env-vars) Regenerate CLAUDE_RULES.md's env-var table (#16483)
(rules) Count the two LLC stall-watchdog variables in the env registry footer (#13099)
(changelog) Document the update-all-nodes.yml wiring and #16566 fix (#16522)
Describe role-based placement instead of a fixed VM count (#15194)
(security) State blast radius by role, not a fixed VM count (#15194)
(env) Move the generated env-var table into ENV_VARS.md and drop its count line, so env-var PRs stop conflicting (#16317)
(architecture) One count-free distributed architecture document (#15194)
(adr) Supersede ADR-001's fixed VM count with role-separation placement (#15194)
(changelog) Add fragment for #16443
(infra) Record redis role tools as binary names, not units (#16060, #16071) (#16511)
(research) The disk-tiered MoE streaming analysis against llm_shared/optimization (#13030) (#16571)
(research) Add internal audit of LLM request-pipeline gaps (#16559)
(process) A report whose text is not derived from its measurement (#15953) (#16206) (#16206)
(process) Four corrections found in review, two of them missing criteria (#16126, #15953) (#16127) (#16127)
(research) Prompts.chat source analysis and AutoBot comparison (#16108) (#16119) (#16119)
(process) Name the selector — an empty result is not a true negative (#15953) (#16102) (#16102)
(architecture) State that the installer and the Ansible fleet are sequential stages (#15993) (#16004) (#16004)
(guards) Write down the ratchet-baseline convention and its worked examples (#15897) (#15959) (#15959)
(guards) Fix eight stale referents and guard the two classes behind them (#15877, #15887) (#15896) (#15896)
(process) Never work from a stale base (#15884) (#15886) (#15886)
(guards) Correct nine comments asserting mechanisms that had moved (#15873, #15876, #15877) (#15878) (#15878)
(playwright) Say what omitting session_id does on every model that takes it (#15802) (#15875) (#15875)
(skills) State the anonymization invariant in research and adopt (#15829) (#15829)
(deps) Correct the stale protobuf instruction and drop the orphaned markdown declaration (#15600, #15622) (#15647) (#15647)
Move external_apps out of the repository (#15223) (#15573) (#15573)
(design) Release-directory-with-atomic-flip scheme for the live-tree rewrite (#13539) (#15558) (#15558)
(process) Batch same-scope issues per PR and never block on CI (#15434) (#15435) (#15435)
(skills) Align area taxonomy with labels in use, add cluster areas (#15423) (#15428) (#15428)
(process) Adopt GitHub native issue relationships as the default (#15423) (#15424) (#15424)
(deps) Align the openvino floor in four docs and guard documentation drift (#15415) (#15416) (#15416)
(research) Why commit progress feels slow — patterns, fixes and corrections (#15306) (#15413) (#15413)
(changelog) Restore 12 releases of notes and rebuild the version index (#15376) (#15377) (#15377)

Features

(ci) Gate the CodeQL backlog and the squash subject (#15333, #15473) (#17303) (#17303)
(ui-kit) Vitest harness + behavioral tests for the 5 Base* components (#17171) (#17171)
(admin) Coming-later panel for fine-grained permission scopes (#16825)
(slm) Data hygiene page -- orphan storage propose, orphan repair, audit view (#17040)
(secrets) Bridge connector credential templates to ConnectorCredentialStore (#16428)
(auth) The SLM accepts a user API key only on routes that declare one, refuses it with 403 elsewhere, and audits every key request (#16294, #16040, #16999)
(agents) A peer request carries its originator across every relay (#16950)
(approvals) Wire orphan-storage delete_candidate() behind approval-gate execution (#17039)
(secrets) Wire in SecretAuditLog, consolidate SecretVault into SecretsManager (#16429)
(ci) Add an open-PR cap to the pre-push gate (#17006)
(backend) Orphan-storage detector framework + code-source clone detector (#17038, #17039)
(agents) One-shot idle notice, split from #16948's PR (#16949)
(agents) Peer-to-peer messaging and idle notice (#16948, #16949)
(agents) Capture a terminal session's tenant at creation (#16975)
(agents) Live presence registry, one query across all three agent kinds (#16947)
(knowledge) Import Claude Code auto-memory into knowledge_facts (#16642)
(ci) Report backend capability the GUI cannot reach, split three ways (#16816)
(llc) Close out heartbeat runs whose agent stopped reporting (#16817)
(agents) Wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (#16951)
(knowledge) DocumentExtractor handles .csv/.json/.html like the GUI upload path (#16785)
(kb) Accept spreadsheet, presentation and OpenDocument uploads (#16775)
(documents) Verify ZIP-based office and ODF formats by content (#16773)
(collaboration) Add an always-visible pending-invitations indicator (#16470)
(collaboration) Surface pending invitations in the collaboration panel (#16470)
(slm-frontend) Type the GPU nodes read from the generated contract, not an inline generic (#15226)
(slm-frontend) The monitoring view shows each node's GPU, and says when it can't (#15226)
(slm) Nodes report their GPUs in the heartbeat, and the SLM serves them per node (#16280, #16281)
(knowledge) One Research surface — Web Tools and Settings become tabs (#16900)
(knowledge) Fold Connectors into Manage as a tab (#16897)
(admin) MCP server admin CRUD + live model pricing GUI (#16825) (#16875) (#16875)
(ci) Catch PR body gate failures before push, not after (#16859)
(llc) Give an agent workspace an owner and an expiry (#16818)
(collaboration) Persist activity/notification history, add invitation list+respond endpoints (#16460)
(collaboration) Wire the collaboration UI onto the real backend (#16443)
(llm) Add the cross-worker quota headroom store, persist real 429 headroom (#15026)
(drift) Check every file, name every exclusion (#16310)
(slm) Run the Redis panel on the SLM's node-service API, with logs, and colour AdminMonitoringView by what the backend sends (#16245, #16252)
(llm) Wire extractive prompt compression and enforce per-provider concurrency cap (#16526, #16527)
(agents) Renew work claims only while the run makes progress, and refuse writes under a lapsed claim (#15950)
(pricing) Refresh on every install and update, at first boot, on a set cadence, and on demand (#16231)
(pricing) Fetch live prices from LiteLLM and OpenRouter, cross-checked, with honest freshness (#16229)
(mcp) Apply isolated-runtime resource limits to admin-configured stdio servers (#11542, #3229)
(mcp) Standalone chat-tool bridge for external MCP servers, wired into prompt+dispatch (#11542)
(mcp) Admin CRUD for user-configured external MCP servers (#11542)
(mcp) Thread credential headers through MCPClient's remote transports; add stdio launcher allowlist (#11542)
(mcp) Thread an opt-in egress guard through MCPClient's remote transports (#11542)
(collaboration) Wire the collaboration UI onto the real backend (#16443)
(tooling) Check_run_status gains a pending-with-age helper (#16126) (#16534)
(preflight) Run every reproducible required check through the workflow's own command (#15933) (#16416)
(secrets) Wire in SecretAuditLog, consolidate SecretVault into SecretsManager (#16485) (#16486)
(auth) One permission vocabulary, key scopes as bundles, /me permissions, and API-key scope enforcement (#16270, #16040) (#16298)
(frontend) Wire router meta.minRole into a real guard, ranked against the backend's role order (#16244) (#16489)
(agents) Agents hold the scopes they declare, and a guard keeps the declaration honest (#15950) (#16175) (#16175)
(site) A landing page for the user root, which is currently a 404 (#16135) (#16136) (#16136)
(coordination) Project work claims onto the bus and expose the claim table (#15949) (#16085) (#16085)
(preflight) Run the two frontend gates locally when the workspace allows (#15933) (#16093) (#16093)
(coordination) Unlanded changes keep a scope spoken for, and stewardship transfers (#15987) (#16067) (#16067)
(coordination) Queue behind a held scope, ask the holder to yield, arbitrate (#15948) (#15992) (#15992)
(tooling) A required-contexts gate that can see an unreported check (#15995) (#16001) (#16001)
(ci) Make pr-preflight name every required status check (#15933) (#15960) (#15960)
(coordination) Work_claims — agents announce and reserve the scope they hold (#15947) (#15958) (#15958)
(llc) The three remaining agent routes do their work (#15905) (#15920) (#15920)
(llc) Expose the company CEO designation over HTTP (#15872) (#15921) (#15921)
(guards) Declare what a guard examined, and prove the floor fires (#15826) (#15840) (#15840)
(browser) Make an unscoped Playwright caller visible via path-scoped middleware (#15802) (#15855) (#15855)
(llc) Give every company a CEO, including the ones that already exist (#15770) (#15856) (#15856)
(api) Idempotency keys so a retried creation replays instead of duplicating (#15778) (#15813) (#15813)
(migrations) Require a data-loss statement on destructive migrations (#15776) (#15806) (#15806)
(llc) One reporting relation spanning people and agents, and an org chart that is a hierarchy (#15763) (#15792)
(auth) Mint admin.reporting_line.write with its enforcement gate (#15765) (#15793) (#15793)
(guards) Standing checks for bare-default route deps and fixed-path fixture teardown (#15769, #15785) (#15790) (#15790)
(llc) A company tool catalogue over the registry, not a second identity store (#14852) (#15753) (#15753)
(slm) Credential-free self-update trigger over a permission-gated local socket (#15746) (#15746)
(backlog) Report umbrella-label drift from the native sub-issue relation (#15440) (#15595) (#15595)
(backlog) Read umbrella checklists into native relationships (#15439) (#15581) (#15581)
(update) Gate venv removal on install provenance, not a name diff (#15067) (#15572) (#15572)
(health) Report the served frontend bundle, not just the process (#15462) (#15465) (#15465)
(llc) Mirror the contact API validation as field errors and say what delete destroys (#14105) (#15471) (#15471)
(llc) Wire contact create and delete to the endpoints that already exist (#14105) (#15456) (#15456)
(llc) Offer the tool colour dimension and surface variable i18n keys (#14190, #14123) (#15452) (#15452)
(document) Fold PDF/DOCX tables into every ingest path (#14970) (#15372) (#15372)

Miscellaneous

(vehicle) Land 4 small branches (#16249, #16394, CodeQL fixes, dependabot uv) (#17116) (#17116)
(deps) Consolidate 13 dependabot PRs into one CI run (#17205) (#17205)
(vehicle) V0.9.1 — consolidate 6 ready PRs into one CI run (#17194) (#17194)
(vehicle) V0.9.0 2026-09-20 -- consolidate 5 orphaned branches (#16249, #16394, #16466, #16143, #15021) (#17149) (#17149)
(frontend) Remove the two dead useVncControls shims (#14907) (#17180) (#17180)
(vehicle) Carry issue-16354-unicode-normalisation into the security batch (#17148)
(guards) Re-pin prompt-injection-detector-strict-mode floor 2944 -> 2945 (#16354)
(vehicle) Carry issue-17141-approval-failure-trail into the 2026-09-20 batch (#17146)
(vehicle) Carry issue-17138-lazy-connectors into the 2026-09-20 batch (#17145)
(guards) Re-pin hooks-path-override floor 6481 -> 6484 (#17138)
(vehicle) Carry issue-17118-shallow-tristate into the 2026-09-20 batch (#17140)
(vehicle) Carry the command-approvals branch into the security train (#17052) (#17106)
(vehicle) Merge the rest train into command approvals for the security train (#17052)
(types) Regenerate generated API types from OpenAPI schema(s)
(agents) Consolidate the agent-output fix into the session-ownership PR (#17052, #17074)
(agents) Merge main into PR-A (#17052)
(agents) Merge main now that #17051 has landed (#17052)
(vehicle) Drop stale a2a.py size-baseline entry, now compliant (#17048)
(secrets) Tracked reasons for #17087's 21 new baseline entries
(secrets) Audit worker_settings.py's pinned-model hex entries as non-secrets (#17087)
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Carry #17113 (d69a1d1) into the security consolidation train (#17048)
(vehicle) Merge main into the 7b security train (#16957)
(security) Carry SLM API key scopes (#16040, #16294, #16999)
(security) Carry a2a capability gating (#16957)
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Carry #17129 (75878df) into the rest consolidation train (#17048)
(vehicle) Carry #17117 (9fc5356) into the rest consolidation train (#17048)
(vehicle) Carry #17122 (4ecfcd1) into the rest consolidation train (#17048)
(vehicle) Carry #17119 (e1533c9) into the rest consolidation train (#17048)
(vehicle) Carry #17008 (9d2e036)
(vehicle) Carry #16728 (9de661f)
(vehicle) Carry #17050 (e0416f3)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Carry #16970 (809f350)
(vehicle) Carry #17107 (74dc31b) into the rest consolidation train (#17048)
(types) Regenerate generated API types from OpenAPI schema(s)
(agents) Consolidate peer routing (#16986)
(agents) Consolidate the idle notice (#16949) (#17015)
(agents) Consolidate the presence stack onto main (#16947, #16975, #16948) (#16996)
Lower service.py's ratchet to match the merged #16947+#16975 result
(vehicle) Carry f4's strict-mode floor re-pin into the ws-auth train (#17129) (#17127)
(vehicle) Carry main's base fix #17127 (8bb7591) and #17131 into the ws-auth train (#17124)
Claim worktree for issue #17130 secrets baseline exclusion fix
(vehicle) Merge #16959 cd87aab into vehicle-v090-2026-09-18-ci-hooks
(vehicle) Merge #16882 9410b8c into vehicle-v090-2026-09-18-ci-hooks
Claim worktree for #15317
(vehicle) Merge #16958 c3d8b47 into vehicle-v090-2026-09-18-ci-hooks
(vehicle) Merge #16952 c19678e into vehicle-v090-2026-09-18-ci-hooks
(vehicle) Merge #17032 0114377 into vehicle-v090-2026-09-18-ci-hooks
(hooks) Take the root from the hook's working directory, not a bare rev-parse; document finishing a pick of an old subject (#17029)
(hooks) Track the commit-msg hook, install it, and reject a subject without the issue-reference convention (#17029)
(vehicle) Merge #16938 705a0f8 into vehicle-v090-2026-09-18-ci-hooks
(session) Update handoff with post-hoc audit findings (#16642)
(session) Write end-of-session handoff for issue-16642 (#16642)
(types) Regenerate generated API types from OpenAPI schema(s)
(ratchet) Lower knowledge_population.py's file-size ceiling to 1525 (#16642)
(types) Regenerate generated API types from OpenAPI schema(s)
(session) Write end-of-session handoff for issue-16707-16708-kb-bugfix-batch (#16707, #16708)
Merge main into #16778 (refresh behind by #16597, #16761)
Claim worktree for #16820 ratchet resolution
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Regenerate generated API types from OpenAPI schema(s)
Session handoff for issue-17024-tool-args-hooks (#17024)
Claim worktree for #17024
(ci) Merge main into the ws-auth vehicle (#17009)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge #16790 c5f51c0 into vehicle-v090-2026-09-18-docparser
(session) Write end-of-session handoff for issue-16784-16785-document-format-gaps (#16785, #16784)
Merge main into #16790 (refresh behind by #16597, #16761)
Claim worktree for #16784, #16785
(vehicle) Merge #16788 cfb0d49 into vehicle-v090-2026-09-18-docparser
(vehicle) Merge #16783 ca95302 into vehicle-v090-2026-09-18-docparser
(documents) Merge main into the #16773 format-verification branch (#16773)
(ci) Merge main into the ws-auth vehicle again (#17009)
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge #17037 f0b8b13 into vehicle-v090-2026-09-18-ansible
(changelog) Add fragment for the secrets-baseline reasons guard (#16299)
Claim worktree for #14288
(ci) Merge main into the ws-auth vehicle (#17009)
(vehicle) Merge #16911 35cd9e6 into vehicle-v090-2026-09-18-chat (#16911)
(vehicle) Merge #16472 0550f48 into vehicle-v090-2026-09-18-chat (#16472)
(types) Regenerate generated API types from OpenAPI schema(s)
Claim worktree for #16280
(types) Regenerate generated API types from OpenAPI schema(s)
(claim) Helper-02 takes the node GPU data path (#16280, #16281)
Claim worktree for #16320
(claim) Helper-02 takes FIFO queueing for the heavy suites (#16320)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge #17027 abce3e7 into vehicle-v090-2026-09-18-ws-auth
(changelog) #17017 fragment carries its PR number (#17017)
(changelog) #17017 fragment (#17017)
(changelog) #17009 fragment carries its PR number (#17009)
Session handoff for issue-17028-bug-ledger (#17028)
Claim worktree for #17028
Claim worktree for #17021
(types) Regenerate generated API types from OpenAPI schema(s)
(session) Write end-of-session handoff for docs/research-multi-agent-executive-advisor (#16766)
(types) Regenerate generated API types from OpenAPI schema(s)
Claim worktree for #15234
Claim worktree for #16835
(hooks) Merge main into the #16812 core.hooksPath branch (#16812)
Merge main into #16811 (refresh past #16824's SPDX fix)
(types) Regenerate generated API types from OpenAPI schema(s)
Merge main into #16810 (refresh past #16824's SPDX fix)
(secrets) Merge main into the #16426 admin-gate branch (#16426)
(types) Regenerate generated API types from OpenAPI schema(s)
(kb) Merge main into the #16770 chokepoint branch (#16770)
(deps) Bump the uv group across 1 directory with 2 updates (#16597) (#16597)
(deps) Update scikit-learn requirement (#16761) (#16761)
(train) Land vehicle, 9 PRs (#16751) (#16751)
(vehicle) Merge main into vehicle 2f after #16752 landed (#16751)
(vehicle) Lower the frontend contract responses baseline to 193 after dropping #16471's duplicates (#16460)
(vehicle) Keep mcp_server/autobot_server.py at its 948 ceiling after the import union (#16449)
(vehicle) Merge PR #16723 into vehicle 2f (#16723) (#16723)
(kb) Merge main into the #16693 backfill, keeping ownerless SYSTEM facts indexed (#16693)
(vehicle) Merge PR #16732 into vehicle 2f (#16732) (#16732)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge PR #16454 into vehicle 2f (#16454) (#16454)
(vehicle) Merge PR #16730 into vehicle 2f (#16730) (#16730)
(vehicle) Merge PR #16471 into vehicle 2f (#16471) (#16471)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge PR #16719 into vehicle 2f (#16719) (#16719)
(vehicle) Merge PR #16725 into vehicle 2f (#16725) (#16725)
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Restore generated API types to origin/main's current state
(settings) Drop two tests superseded by independently-merged PRs (#16278, #16279)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge PR #16734 into vehicle 2f (#16734) (#16734)
(vehicle) Merge PR #16738 into vehicle 2f (#16738) (#16738)
(deps) Bump actions/upload-artifact in the all-dependencies group
(train) Land vehicle, 7 PRs (#16747) (#16747)
(vehicle) Merge main into the deps vehicle after 2e landed (#16747)
(train) Land vehicle, 9 PRs (#16746) (#16746)
(vehicle) Merge PR #16696 into vehicle 2e (#16696) (#16696)
(vehicle) Merge PR #16705 into vehicle 2e (#16705) (#16705)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge PR #16706 into vehicle 2e (#16706) (#16706)
(vehicle) Merge PR #16691 into vehicle 2e (#16691) (#16691)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge PR #16703 into vehicle 2e (#16703) (#16703)
(vehicle) Merge PR #16689 into vehicle 2e (#16689) (#16689)
(types) Regenerate generated API types from OpenAPI schema(s)
(vehicle) Merge PR #16721 into vehicle 2e (#16721) (#16721)
(vehicle) Merge PR #16483 into vehicle 2e (#16483) (#16483)
(vehicle) Merge PR #16700 into vehicle 2e (#16700) (#16700)
(vehicle) Merge PR #16743 into vehicle deps (#16743) (#16743)
(deps) Bump the all-dependencies group across 1 directory with 11 updates
(vehicle) Merge PR #16742 into vehicle deps (#16742) (#16742)
(deps) Bump the all-dependencies group
(vehicle) Merge PR #16741 into vehicle deps (#16741) (#16741)
(deps) Update huggingface-hub requirement
(vehicle) Merge PR #16740 into vehicle deps (#16740) (#16740)
(deps) Update huggingface-hub requirement
(vehicle) Merge PR #16739 into vehicle deps (#16739) (#16739)
(deps) Bump the all-dependencies group across 1 directory with 13 updates
(vehicle) Merge PR #16737 into vehicle deps (#16737) (#16737)
(deps) Update psycopg2-binary requirement
(vehicle) Merge PR #16474 into vehicle deps (#16474) (#16474)
(deps) Bump the npm_and_yarn group across 4 directories with 2 updates
(train) Land batch 2d vehicle, 14 PRs (#16702) (#16702)
(ssot) Prune stranded hardcoded-value baseline entries from #16713 (#16702)
(vehicle) Merge main into the 2d vehicle (#16702)
(types) Regenerate generated API types from OpenAPI schema(s)
(claim) Helper-02 takes the Redis service and detailed-health move into the SLM (#16245, #16252)
(worktree) Claim for GUI consistency batch (#15031)
(claim) Helper-02 takes the env-docs merge hotspot (#16317)
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Regenerate generated API types from OpenAPI schema(s)
(types) Regenerate generated API types from OpenAPI schema(s)
Re-trigger CI after bot type-regen push (#11542, #16458)
(types) Regenerate generated API types from OpenAPI schema(s)
(deps) Bump the all-dependencies group (#16587) (#16587)
(deps) Bump mcp (#16586) (#16586)
(deps) Bump the all-dependencies group (#16585) (#16585)
(deps) Bump the all-dependencies group (#16582) (#16582)
(deps) Update numpy requirement (#16581) (#16581)
(deps) Bump the all-dependencies group (#16578) (#16578)
(deps) Bump the all-dependencies group with 3 updates (#16576) (#16576)
(deps-dev) Bump the all-dependencies group (#16574) (#16574)
(deps-dev) Bump the oxlint group (#16573) (#16573)
(deps) Bump the all-dependencies group across 1 directory with 9 updates (#16572) (#16572)
(slm-frontend) Retire getApiUrl(), route its display-only callers through getSlmApiBase() (#15761) (#16432)
(frontend) Retire useApi.ts, the deprecated useApiWithState composable family (#15025) (#16424)
(docker) Retire the four agent Dockerfiles whose modules no longer exist; agents run in-process (#16361) (#16409)
(deps) Carry dependabot's npm security bumps onto main (hono 4.13.7 and transitive; supersedes #16171) (#16408)
(git) Rename Dev_new_gui to main and main to release across the repo (#16461) (#16487) (#16487)
(deps) Bump the all-dependencies group across 1 directory with 22 updates (#15980) (#15980)
(deps) Bump the all-dependencies group in /autobot-infrastructure/shared/docker/ai-stack with 12 updates (#15977) (#15977)
(deps) Bump the all-dependencies group in /autobot-tts-worker with 4 updates (#15978) (#15978)
(deps) Bump the all-dependencies group in /autobot-backend with 16 updates (#15972) (#15972)
(deps) Freeze the ansible-core pin against dependabot (#15983) (#15999) (#15999)
(deps) Bump the all-dependencies group across 1 directory with 21 updates (#15971) (#15971)
(deps) Bump pydantic (#15979) (#15979)
(deps) Bump the all-dependencies group (#15976) (#15976)
(deps) Update torch requirement (#15974) (#15974)
(deps) Bump the all-dependencies group (#15973) (#15973)
(deps) Bump the all-dependencies group with 2 updates (#15970) (#15970)
(deps-dev) Bump the oxlint group (#15969) (#15969)
(deps) Bump the all-dependencies group (#15968) (#15968)
(browser-worker) Retire the orphan playwright config, record why (#15695, #15694) (#15702) (#15702)
(ci) Configure CodeRabbit so it reviews the branch pull requests actually target (#15658) (#15658)
(deps) Resolve the nltk declaration and enforce ansible/requirements version parity (#15551, #15568) (#15599) (#15599)
(deps) Bump qs to 6.16.0 across the five npm workspaces (#15521) (#15546) (#15546)
(deps) Bump the all-dependencies group (#15381) (#15381)
(deps) Bump the all-dependencies group (#15384) (#15384)
(deps) Bump the all-dependencies group with 16 updates (#15385) (#15385)
(deps) Bump the all-dependencies group (#15383) (#15383)
(deps) Bump the all-dependencies group with 3 updates (#15382) (#15382)
(deps) Bump the all-dependencies group (#15380) (#15380)
(deps) Raise every guarded openvino pin to the SSOT floor (#15388) (#15406) (#15406)
(deps-dev) Bump the oxlint group (#15378) (#15378)
(deps) Bump the all-dependencies group (#15390) (#15390)
(deps) Bump the all-dependencies group (#15389) (#15389)
(deps) Bump the all-dependencies group (#15386) (#15386)

Other / Uncategorized

(api) Gate captcha, metrics and diagnostics routers (#16375)
(models) Pin 3 unpinned HF loads, widen bandit to npu-worker (#17087)
(ai-ml) Pin HuggingFace model revisions and verify weight integrity (#13034)
(secrets) Fix the live NPU worker's 422 payload echo too (#16444 review)
(secrets) Shared FastAPI validation-error handler, all 4 real apps (#16444 review item 1)
(secrets) Fix 5 findings from #16444's independent review
(kb) Re-scope #16985 to a guard -- every connector already reaches store_fact (#16985)
(security) Redact connector content at the base-class ingestion chokepoint (#16985)
(infra) Stop binding ChromaDB to every interface by default (#15317)
(a2a) Widen pii_pipeline credential/PEM detection (#16642)
(knowledge) Redact ssh command targets, widen redaction test coverage (#16642)
(knowledge) Redact secrets at import, scope imported facts to admin-only (#16642)
(kb) Multi-source relation-graph/citation expansion reads the wrong key shape from get_fact_relations() (#16708)
(websocket) Authenticate /api/intelligent_agent/stream before processing (#17000)
(knowledge) Close remaining credential-redaction gaps (#13708)
(secrets) Content-scanning credential redactor -- catches a credential in free text (#13708)
(rag) Route the chat's RAG path through the content firewall (#16771)
(kb) Ai-stack and RAG search routes filter results by the caller's access (#16665, #16654)
(deploy) Generate backend_secret_key and grafana_admin_password on first run (#16299)
(secrets) Guard every .secrets.baseline entry for a tracked reason (#16299)
(desktop) Authenticate to VNC server-side, close the VITE_* password leak (#16299)
(websocket) Throttle the fallback-usage warning per route (#16457)
(websocket) Stop leaking tokens into logs on read (#16457)
(websocket) Migrate two more clients, guard the rest (#16457)
(websocket) Close remaining echo gaps and fix red CI (#16457)
(websocket) Migrate LiveEventService's /ws/live to the subprotocol (#16457)
(websocket) Every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457)
(websocket) Auth token travels via Sec-WebSocket-Protocol, not the URL (#16457)
(deps) Sync two non-shipping manifests to the fastapi/uvicorn security floor (#15661)
(skills) Route catalog fetch through fetch_safe_url, closing CodeQL alert 1030 (#16595)
(multimodal) _store_result no longer swallows every exception, including the tenancy refusal (#15234)
(collaboration) The REST presence read enforces its documented VIEWER check (#16580)
(ci) A malformed token cannot reach a CI log or a traceback (#15204)
(secrets) Get_secret returns the owner, unblocking connector credentials (#16579)
(secrets) Admin-gate infrastructure hosts, fix vault-backed template names (#16426, #16427)
A shallow code_source checkout no longer poisons the deletion-planner's bootstrap (#16310)
(kb) Sanitize every knowledge-base write at the store_fact chokepoint (#16770)
(kb) Backfill ownerless ingested documents as SYSTEM, frozen to the facts present at deploy (#16693)
(memory) Make UNSCOPED_ALL_USERS a non-str sentinel, not a comparable string (#16701)
(memory) /verbatim-memory/search and session delete are scoped to the caller (#16701, #16654)
(kb) The MCP knowledge tools return non-private facts only (#16666)
(settings) Record the real caller on /sync and /hardware-priority, and test the anonymous and cross-org refusals (#16278)
(kb) Admit knowledge search and the aggregator as explicit read APIs for the admin bypass (#16745)
(kb) The MCP add route drops a non-admin's org, group and share fields again -- keeping them let a caller file facts into orgs and groups they are not in (#16663)
(kb) The MCP add route refuses a non-admin's platform-wide request with 403 instead of silently stripping it (#16663)
(kb) Scope the category-count cache and drop admin-gated CRUD routes from the T3 allowlist (#16665, #16654)
(kb) The multi-source search/context/graph routes filter results by the caller's access (#16665, #16654)
(kb) The canonical POST /search route filters results by the caller's access (#16665, #16654)
(kb) The raw ChromaDB explorer is admin-only, and its link and route are hidden from non-admins (#16666)
(redis) Every Ansible-rendered client pairs its Redis password with a username, and the deploy scripts drop the hardcoded password (#16678, #16686, #16657)
(code-sync) Check the symlink parent's realpath so CodeQL sees the containment (#16713)
(code-sync) Fix two #16713 review findings (#16702)
(kb) Only admins make a fact platform-wide; visibility writes keep the store, ChromaDB and ownership indexes current (#16663, #16670) (#16677) (#16677)
(redis) Backend.env always sends a username with the Redis password (#16668) (#16679) (#16679)
(code-sync) Resolve py/path-injection CodeQL alerts in code_sync.py (#16713)
(mcp) External tool names can't shadow internal ones; fix owner_id drift (#16458)
(mcp) Gate external server tools through the real RBAC path, no bypass (#11542, owner decision on #16458)
(collaboration) Authenticate and authorize the session-presence WebSocket (#16455)
(auth) Fail closed when the password-epoch check cannot reach Redis (#16411) (#16433) (#16433)
(redis) The SLM generates the Redis password and every client sends it as default while the server stays nopass (#16627) (#16660) (#16660)
(kb) The ownership helpers fail closed and read list metadata as lists (#16662) (#16669) (#16669)
(redis) Optional ACL username in every Redis client, unset by default (#16626) (#16632) (#16632)
(routers) Gate knowledge_search, knowledge_search_aggregator, knowledge_suggestions and voice_stream (#16507) (#16508) (#16508)
(lint) Classify test_first_remediation.py as production, fix the 2 real gaps it surfaced (#16514) (#16518)
(chat) Finish #16545's PII/injection scan on /stream-ai-stack and resume (#16561) (#16567)
(collaboration) Authenticate and authorize the session-presence WebSocket (#16455) (#16456)
(imports) Every module under api/ and autobot_shared/ must import inertly (#16198) (#16199)
(research) Treat fetched repos and pages as untrusted data (#16488) (#16492)
(browser) Validate the URL in capture_screenshot (#13204) (#16544)
(auth) Authenticate every transcriber route, and stop anonymous callers owning every recording (#15758) (#16259)
(chat) Scan/redact PII and flag injection risk on every raw chat message (#16529, #16530) (#16545)
(auth) Admin-gate the open routers, settings, teams and user-account routes (#15745, #16278, #16276, #16277, #15738, #16279) (#16240) (#16240)
(voice) Make POST /check evaluate without touching the shared detector (#16247) (#16266) (#16266)
Untrack two committed key files and make secret scanning see the whole tree (#16275) (#16300) (#16300)
(reach) Raise the meta-floors to measured size and migrate four hand-rolled floors (#16147, #15928) (#16296) (#16296)
(git) Scrub the environment at six production git call sites (#16179) (#16184) (#16184)
(ci) The npm audit workspace loops word-split, so a path with a space would be skipped (#16190) (#16193) (#16193)
(git) Scrub shell git ls-files, and gate it so it stays scrubbed (#15506) (#16118) (#16118)
(ci) The npm audit gate scanned one workspace and read failed scans as clean (#16131, #16185) (#16169) (#16169)
(auth) Enumerate router gating by mechanism, before fixing anything (#15745) (#16170) (#16170)
(reach) Ratchet the hooksPath floor before it turns every open branch red (#15928) (#16181) (#16181)
(auth) Name the two password-change limiters for the surfaces they guard (#15757) (#16176) (#16176)
(prompts) No shipped prompt may instruct the model to refuse nothing (#16105) (#16117) (#16117)
(git) Refuse the hooksPath override that silently disables every hook (#15961) (#16097) (#16097)
(slm) The js-yaml advisory is live in an unaudited workspace (#16131) (#16132) (#16132)
Allow the two unfixable dev-only npm advisories (#16089) (#16103) (#16103)
(size) Count the oversized files the size hook's exclusions hide (#15897) (#16068) (#16068)
(reach) One measured TRACKED_PY_FLOOR instead of seven copies of 3000 (#15928) (#16073) (#16073)
(reach) Pin every declared floor to its population (#15928) (#16048) (#16048)
(repo_tests) Route nine ls-files sites through tracked_paths (#15926) (#16057) (#16057)
(hooks) A CLI entry point may print, and the exemption says which files it applied to (#16010) (#16010)
(repo) Five guards walked into other checkouts of this repository (#15955) (#15962) (#15962)
(mcp) Git_mcp ran git with the ambient environment, so GIT_DIR bypassed its validated repo_path (#15991) (#16003) (#16003)
(ci) Record glob-declared guard reads, and say what the green covers (#15900) (#15994) (#15994)
(primitive) Git-side exclusions on tracked_paths, and a shrink-only bypass baseline (#15926) (#15990) (#15990)
(primitive) One repo_root() for 161 hand-rolled tree roots (#15925) (#15984) (#15984)
(llc) Scope the goal ancestry walk, and stop it defaulting off (#15930) (#15944) (#15944)
(tasks) Discover the indexer's callers instead of naming two of them (#15902) (#15919) (#15919)
(config) Fail a dict literal that repeats a key, and fix the two that do (#15908) (#15913) (#15913)
(deploy) Four deploy facts stated twice, now stated once and checked (#15707, #15724, #15687, #15604) (#15901) (#15901)
Log-flood guard + unsaved-work guard on recursive sandbox delete (#15774, #15777) (#15782) (#15782)
(ci) Make the python filter reach the trees its guards read (#15713) (#15715) (#15715)
(ansible) Derive the git_repo_root aliases, keep the sudoers-bound literal (#15705, #15601) (#15706) (#15706)
(ansible) Derive every code_source_dir fallback from the SSOT (#15632, #15601) (#15704) (#15704)
(state) Give every persisted concept a declared system of record (#15663) (#15668) (#15668)
(infra) Make both generators dry-run by default, and prove the scheduler survives a missing store (#14563, #14479) (#15579) (#15579)
(agents) Gate extract_content and delegate at BEFORE_TOOL_EXECUTE, and record the three that stay ungated (#14529, #14491) (#15461) (#15461)
Consolidate cross-GUI composable/type duplication into @autobot/ui (#14907, #14908) (#15403) (#15403)
(enums) Collapse CausalSeverity, IngestVerdict/EgressVerdict, and verification_method into canonical types (#15404) (#15404)
(secrets) Close the final two #15276 tail sites in the vault-resolution sweep (#15355) (#15355)

Refactoring

(agents) Conversation-owner resolution gets its own module (#17053)
(ai-ml) Extract load_verified() to shrink ai_hardware_accelerator.py under its ratchet (#17087)
(approvals) Unify the general and LLC approval systems (#17043, #17056)
(orphan-storage) Consolidate safe_error_reason into safe_response (#17065)
(slm) Extract the service-remediation tracker helpers, trim reconciler.py back under its ratchet ceiling
(test) Extract a shared mock-result helper, fixing a file-size ratchet trip (#16990)
(knowledge) Re-derive the firewall guard through the new indirection (#16771)
(knowledge) Split three files back under their size ceilings (#16771)
(gpu) Build both collectors' GPU metrics from one mapping in gpu_telemetry (#16289)
(backend) Gpu_detection reads nvidia-smi and rocm-smi through gpu_telemetry (#16289)
(backend) Both GPU metrics collectors read rows through gpu_telemetry (#16289)
(backend) Worker_node and diagnostics read GPUs through gpu_telemetry (#16289)
(tests) Move conftest.py's module-loading helpers to testkit (#16480)
(frontend) Remove the unreachable user-GUI Redis client and SettingsPanel's unrendered health loader (#16245, #16252)
(slm-frontend) One useFleetTools for the tools ToolsView and FleetToolsTab share (#15665)
(mcp) Extract multi-server aggregation, add streamable-HTTP transport (#11542)
(slm) Derive the role list's names, units, health and ports from the role manifests (#16025) (#16441) (#16441)
(agents) Extract NPUCodeSearchAgent's pattern helpers, add declared_scopes (#16173) (#16496)
(lifespan) Split cleanup_services and _init_graph_rag_service into steps under the length limit (#16250) (#16509)
(slm-backend) Retire the 7 dead SLM monitoring modules whose function is live elsewhere (#16282) (#16308)
(api) Split analyze_diff so the last unscrubbed git call site could land (#16186, #16179) (#16212) (#16212)
(slm) Split four frozen modules so their ceilings stop blocking work (#15495, #15496) (#16099) (#16099)
(agents) Extract the exchanged data types so base_agent clears its ceiling (#15950) (#16106) (#16106)
(site) Remove the root-page copy, its source is now one repo (#16145) (#16149) (#16149)
(shared) Extract the model pricing table so it can grow (#15860) (#15910) (#15910)
(shared,npu-worker) Decompose http_client.py and the Windows npu_worker so their discarded task launches can be retained (#15641, #15642) (#15655) (#15655)
(guards) Split the budget ledger out of the detector that enforces it (#15590) (#15592) (#15592)
(config) Consolidate the orphaned settings module onto SSOT (#12750) (#15574) (#15574)
(config) Put four restated versions on the source of truth they already had (#15408, #13842, #13843, #15298) (#15567) (#15567)
(deploy) Split get_default_deployed_dir into a reader and a writer (#13539) (#15564) (#15564)
(slm) Collapse the forked SLM REST and node-proxy clients onto one each (#14039, #14886) (#15544) (#15544)
(slm-frontend) Consolidate /services and replication surfaces onto Orchestration (#15224, #15225) (#15405) ([#15405](https://

Navigation Menu

Repository navigation

v0.10.0

Choose a tag to compare

Sorry, something went wrong.

Sorry, something went wrong.

Uh oh!

No results found

[v0.10.0] - 2026-09-28

Highlights

Bug Fixes

Commit Log

Bug Fixes

CI/CD

Documentation

Features

Miscellaneous

Other / Uncategorized

Refactoring

Contributors

Uh oh!