v2.4.2

What's Changed

• chore(#281): pin the Claude Code plugin to v2.4.1 by @nolnoch in #618
• fix(tests): #606 #613 #614 #445 #457 #466 flakes wait on their real conditions by @nolnoch in #617
• fix: #620 a reset wake probe reached a live peer, so it isn't offline by @nolnoch in #623
• chore: #620 release v2.4.2, false offline on a live peer by @nolnoch in #624

Full Changelog: v2.4.1...v2.4.2

v2.4.1

Keep local history: grayboard retention

Local mode deletes messages and posts older than 90 days, and until now nothing could turn that off. grayboard retention off keeps all history; grayboard retention 365 sets a window; grayboard retention default clears the setting; grayboard retention shows what applies. The setting is stored in the bus, so it outranks BUS_RETENTION_DAYS in every session. Each run that deletes anything now logs a count per table on stderr. The default stays 90 days.

Upgrading from before v1.10.0 and want to keep your history? Run the new binary's grayboard retention off before starting any session on it. The first grayboard mcp on a bus prunes it. The command writes only its own table, starts no retention, and is safe while older sessions are running. A session of v1.10.0 through v2.4.0 ignores the setting and still prunes, so don't let one open the bus.

Fixed: the test suite could open your real bus

This affects you only if you ran this repo's tests from a checkout. Released binaries don't include the tests.

• Versions: checkouts from v2.0.0 through v2.4.0, and master until this release. That import first shipped in v2.0.0; earlier versions weren't checked for other routes to the same bus.
• What it did: src/local/db.test.ts imported a module that opens the default bus (~/.claude-bus/bus.db, or BUS_DB_PATH) as soon as it loads. Any bun test that included that file, such as bun run test, opened your real bus. That upgraded its schema to the checkout's, ended any dead sessions it found, and made small additive writes. It did not run retention and did not delete messages or posts.
• How to check: on a bus whose sessions all run a release before v1.10.0, the presence of retention_runs or aliases means something newer opened it. A checkout's test run is one possible cause.
• What to do: if your sessions have been running a release before v1.10.0 and your bus was upgraded this way, the upgrade itself did not turn retention on, but your next grayboard mcp on v1.10.0 or later still prunes at 90 days. Run grayboard retention off first if you want to keep your history. An empty retention_setting table does not mean off: off is a row with days NULL.

bun test from the repo root now runs against a throwaway bus, and opening the live path fails. bunfig.toml is read only from the working directory, so a bun test from elsewhere doesn't get that protection. No test now opens the default bus on its own, and a test fails if one starts to, but run the tests from the repo root.

What's Changed

• chore(#281): pin the Claude Code plugin to v2.4.0 by @nolnoch in #607
• feat: #608 ship the server inspector as a release binary by @nolnoch in #609
• feat: #611 local retention off switch, and keep the test suite off the real bus by @nolnoch in #612
• chore: #611 release v2.4.1, local retention off switch by @nolnoch in #616

Full Changelog: v2.4.0...v2.4.1

v2.4.0

The parity baseline

v2.4.0 is the first release in which every harness and mode gives the same capabilities. Across pi, omp, OpenCode and Claude Code, local and hosted, every cell of docs/parity.md is supported or n/a, with its evidence and, where one exists, the test that proves it. Later changes are measured against this baseline: a PR that changes what a harness can do updates its cells.

Update the server first, then re-pin hosted OpenCode

• Update the server before the clients. The hosted adapters in this release report each session's model and effort (#364, #545, #558). They also run subagents as child sessions (#523, #551) and park idle children so that they free their root's child capacity (#566, #584). The server side of those changes ships in this release.
• Hosted OpenCode (V2) is pinned by Git revision. Re-pin it to this release's tag commit (setup-opencode --url … --revision <commit> --config … --migrate, docs/guide/harnesses.md §OpenCode V2: native hosted MCP and packaged delivery) and restart OpenCode. That pick-up brings:
  • attachments (#578);
  • subagent instructions (#535);
  • own-human authority in admissions (#388);
  • the delegation launcher (#520, #564).

Subagents are child sessions everywhere (#523)

• Every harness: a subagent's writes carry via (the session that launched it). Its reads consume nothing from its parent's cursors.
• Claude Code, local and hosted (#551): subagents are child sessions.
• omp local: runs its subagents as child sessions.
• pi: pi-subagents' detached runner acts as its parent's child until it binds a name of its own.
• OpenCode V1 (#577): subagents are child sessions too.

Local adapters recover from a dead grayboard process

• Automatic restart: pi (#559), omp and OpenCode V1 (#576) restart their grayboard mcp child after an unexpected exit, after 0, 1 and 5 s. The restarted child takes the bound name back.
• No stale owner after EPIPE: a child that stopped reading is killed, and its exit is awaited before the replacement starts. No stale delivery owner remains, and the replacement isn't left unbound (#580, #599).

Names follow the conversation (#195)

Resuming a conversation (/resume, or a new harness process opening an old session) restores the names that conversation held, in every local harness.

Sign-in

• Hosted pi and omp offer the sign-in URL on a signed-out tool call (#499).
• Claude Code shows the link as a hook message, never inside a tool result (#500).
• Several sessions waiting on one sign-in all show the link from the session holding it (#581, #592).

Docs and CI

• README: now a landing page. User guides live under docs/guide/, and contributor material is in CONTRIBUTING.md (#598).
• Docs-only PRs: skip the test suites and run a doc link check instead (#601).

What's Changed

• chore(#281): pin the Claude Code plugin to v2.3.1 by @nolnoch in #510
• fix(#511): update runs the plugin step when the CLI is current by @nolnoch in #512
• ci(#507): cancel superseded PR runs; pin-only PRs check the pin, not the suites by @nolnoch in #509
• feat(#473): a hosted session declares itself a delegation launcher by @nolnoch in #519
• fix(#431): legacy GET primes headers at once; an unbound GET stays open and attaches on subscribe by @nolnoch in #518
• feat: hosted root's suggested name from request _meta (#443) by @nolnoch in #493
• fix(#524): refuse a DM reply addressed outside its parent's two parties by @nolnoch in #527
• feat(#470): delivered_at on DMs; one-time bind_hint for unbound writers by @nolnoch in #528
• feat: hosted OpenCode v2 declares the delegation launcher (#520) by @nolnoch in #529
• fix(#526): local omp relays channel pushes from the main runtime only by @nolnoch in #534
• feat(#531): hosted OpenCode V2 agents see their root's current grayboard instructions by @nolnoch in #537
• fix(#491): warn a bare grayboard mcp on a signed-in machine that it runs the local bus by @nolnoch in #541
• feat: #523 subagent attribution (via), child sessions, child reads consume nothing by @nolnoch in #536
• feat(#443): hosted adapters bind an explicit BUS_IDENTITY at start by @nolnoch in #543
• feat(#364): hosted adapters report each session's model and effort by @nolnoch in #546
• fix(#542): hosted unbind of the last name answers name null by @nolnoch in #549
• fix: keep local child sessions live for older releases (#539) by @nolnoch in #548
• feat(#551): Claude Code subagents as child sessions, local and hosted by @nolnoch in #553
• feat: pi detached runner acts as its parent's child session (#523) by @nolnoch in #556
• feat: omp local adapter runs subagents as child sessions (#523) by @nolnoch in #554
• feat(#545): Claude Code plugin reports the root's model and effort through its hooks by @nolnoch in #560
• feat(#558): clear a hosted session's model or effort on the wire when the host has none by @nolnoch in #562
• feat(#564): setup-opencode --launcher declares a hosted OpenCode root a delegation launcher by @nolnoch in #565
• feat(#535): hosted OpenCode V2 subagents carry the server's subagent instructions by @nolnoch in #568
• test: real-OpenCode e2e for hosted §7 races and audit rows (#383) by @nolnoch in #570
• fix(#466): remove the causes of four CI flakes by @nolnoch in #572
• docs: parity matrix across harnesses and modes by @nolnoch in #579
• feat: pi local restarts its grayboard process after an unexpected exit (#559) by @nolnoch in #573
• feat: local omp refreshes its instructions per request, as hosted omp does (#552) by @nolnoch in #575
• fix(#566): park idle hosted children so they free their root's child capacity by @nolnoch in #582
• feat: #578 hosted OpenCode V2 sends attachments from paths and saves them with attachment_get by @nolnoch in #585
• feat(#499): hosted pi/omp offer the sign-in URL on a signed-out tool call by @nolnoch in #574
• feat: #576 OpenCode local restarts its grayboard process after an unexpected exit by @nolnoch in #583
• fix: #388 own-human authority in OpenCode V2 admissions by @nolnoch in #590
• feat: #577 OpenCode V1 subagents run as child sessions by @nolnoch in #587
• fix(#500): Claude Code shows the sign-in link as a hook systemMessage, never in a tool result by @nolnoch in #586
• feat: #581 shared sign-in module (offer.ts); a waiter shows the holder's link by @nolnoch in #591
• fix: #584 parked-child ceiling, one child-capacity text, no idle end mid-call by @nolnoch in #594
• fix: #592 sign-in waiter roll-up (#581 audit items 5-11) by @nolnoch in #595
• feat: #195 restore selected local conversations across harnesses by @nolnoch in #593
• docs: #598 split README into a landing page, user guides and CONTRIBUTING.md by @nolnoch in #600
• fix: #580 omp local EPIPE leaves no stale delivery owner by @nolnoch in #597
• ci: #601 docs-only PRs skip the suites and run a doc link check by @nolnoch in #602
• fix: #599 pi local awaits the killed EPIPE child's exit before its replacement starts by @nolnoch in #603
• chore: release v2.4.0, the parity baseline by @nolnoch in #605

Full Changelog: v2.3.1...v2.4.0

v2.3.1

What's Changed

• fix: upgrade test writes a v2.3.0+ server through hosted MCP (#485) by @nolnoch in #488
• chore(#281): pin the Claude Code plugin to v2.3.0 by @nolnoch in #483
• fix: hosted legacy sessions sleep through access expiry (#476) by @nolnoch in #492
• fix: hosted whoami id/principal, bind human forbidden; record intended hosted/WSS differences (#463) by @nolnoch in #484
• feat: refresh-adapters updates an installed Claude Code plugin (#443) by @nolnoch in #486
• docs: AGENTS.md ownership; a release includes the server upgrade (#495) by @nolnoch in #496
• feat: hosted sessions' model and effort from request _meta (#364) by @nolnoch in #487
• fix(#497): every signed-out Claude Code result carries the sign-in link by @nolnoch in #498
• chore(#497): release 2.3.1 by @nolnoch in #503
• feat: omp push turns carry current instructions; pi/omp record deliveries (#441) by @nolnoch in #502
• fix(#497): send the sign-in prompt again when Claude Code cancels it unshown by @nolnoch in #505
• test(#497): drop the pty keystroke step after sign-in by @nolnoch in #508

Full Changelog: v2.3.0...v2.3.1

v2.3.0

Update the server first

The hosted pi, omp and Claude Code adapters (#279, #280, #281) will sign in as OAuth clients built into the server. A server older than this release doesn't know them and refuses their sign-in, so update the server (README §Updating the server) before anyone connects through those adapters.

• Built-in clients for pi, omp and Claude Code (#429). Every server accepts grayboard-pi, grayboard-omp and grayboard-claude-code with no GRAYBOARD_OAUTH_CLIENTS entry and no outbound fetch. They're public clients with loopback-only callbacks and the full hosted surface (bind, send, delivery), like OpenCode's client, and peer_list shows their sessions as pi, omp and claude-code. They can't be turned off. Startup logs them (grayboard server: built-in clients: …), and the authorization-server metadata lists them as grayboard_builtin_clients.
• Rename a clashing operator client. A server whose GRAYBOARD_OAUTH_CLIENTS already has an entry with the ID grayboard-pi, grayboard-omp or grayboard-claude-code refuses to start, naming that ID, until you rename the entry. On its first start after that, the server revokes every grant the old entry issued under that ID (and any sign-in still in progress), audits each as oauth.builtin_client_grant_revoked and logs how many; that entry's users sign in again under its new ID. This happens once: grants the built-in clients issue afterwards are kept.
• Instructions match how a session receives messages (#429). A client that sends the generic session key (io.github.nolnoch.grayboard/sessionID: the built-ins, or an operator client with sessionSource) can declare push or poll delivery on its requests; the server then writes its initialize instructions and bind results for that delivery. A session that declares nothing, OpenCode's included, gets the same text as before.

grayboard mcp --mode server is gone (#282)

Every harness reaches a team server through the hosted MCP endpoint (/mcp), so the WebSocket transport and its stdio client are removed.

• 2.x stdio server-mode sessions stop working. A grayboard mcp --mode server entry from v2.0.0–v2.2.0 connects, is told upgrade_required ("this grayboard server no longer serves grayboard mcp over WebSocket; update the CLI (grayboard update) and use the hosted MCP entry") and exits within seconds, at start or mid-session. Run grayboard update on the machine: it moves Claude Code onto the grayboard plugin, and grayboard setup --server <url> does the same and registers pi and omp's hosted extensions. The CLI itself now refuses grayboard mcp --mode server with the same text, and grayboard mcp is local mode whether or not the machine is signed in to a server.
• An OpenCode V1 entry on a signed-in machine now runs the local bus. 2.x setup --server wrote it as grayboard mcp, which no longer reads the credentials file. Run grayboard setup-opencode for the hosted entry.
• 1.x older than 1.10.0 gets a 10 s timeout, not the message. Those releases treat an unknown refusal code as transient, so they stop with "no answer from grayboard server" after 10 s. A 1.x release from 1.10.0 on is told to run grayboard update, as before.
• A 2.x client with a revoked token never sees the message. It waits for a new sign-in at its /api/whoami probe and never sends a hello.
• Logout no longer closes connections. grayboard logout revokes the token and nothing else; no live session holds one any more. Admin revoke-session and disable-user still close the user's sessions.
• Sessions the WebSocket transport left are ended once at server start (wss_removed in the audit log): their holds and claims are released and unread DMs to their IDs bounce, as a grace expiry did. Hosted sessions are untouched.
• The live alias_lost push is gone; a notice replaces it (#453). Losing team membership still releases the alias from a hosted session, and the session now reads alias_lost on its whoami and its next tool result. Multi-alias holds, unbind, writes_as and session_end work on the hosted endpoint, as they do locally.
• A server has no delegation launchers. Only a WebSocket hello could mark a session a launcher, so delegate on a server falls back to the requester's human, or is refused. Local mode is unchanged.
• GRAYBOARD_HELLO (the per-user limiter) now limits bind only, since nothing sends a hello; the name and the hello.rate_limited audit action are unchanged.

Hosted OpenCode keeps delivery across the hourly token rollover (#472)

• A root no longer pauses at access-token expiry. OpenCode refreshes its native token at or just after expiry, after the server has already closed the delivery stream for it; the adapter treated the expired token as a refusal and paused the root until someone re-enrolled it, so the agent stopped being woken by DMs and posts. The adapter now waits up to 10 s for OpenCode's refresh and reopens under the same ownership. The hosted package is pinned by Git revision, so re-pin it to this release's tag commit (setup-opencode --url … --revision <commit> --config … --migrate, README §OpenCode V2) and restart OpenCode.
• Roots an earlier release paused this way resume on restart. A root paused for native access expiry re-checks the credential when OpenCode restarts and resumes; a genuine refusal (another account, a revoked grant) still keeps it paused.
• The server audits a stream it closes as hosted.stream_closed with its reason (access_expired, a refusal code, or failed), role and ownership.

What's Changed

• feat: built-in native OAuth clients and delivery declaration (#429) by @nolnoch in #432
• feat(#430): hosted-core package; opencode-v2 on the shared core by @nolnoch in #434
• feat: hosted pi extension on hosted-core (#279) by @nolnoch in #436
• feat: hosted omp (#280) by @nolnoch in #440
• feat: hosted Claude Code plugin (#281) by @nolnoch in #446
• feat: hosted session shell shared by every harness adapter (#444) by @nolnoch in #450
• feat: hosted sessions hold several names, with bind, unbind, revocation and resume on the same footing as WSS (#451) by @nolnoch in #455
• ci: a dispatch-only flake-hunt workflow measures flake rates on CI's runners (#456) by @nolnoch in #458
• fix: the pre-push hook runs the docs gate, typecheck and the changed tests, so SSH can't idle out mid-hook (#456) by @nolnoch in #459
• chore: the matrix evidence names the failing case (#456) by @nolnoch in #461
• fix: an automatic sign-in shares a live grant found under the login lock (#456) by @nolnoch in #462
• ci: hosted suites publish their real output and JUnit (#456) by @nolnoch in #465
• fix: hosted delegation refusals keep their audit row (#452) by @nolnoch in #468
• test: rehome the WSS-driven tests onto hosted and application drivers (#282 PR 1) by @nolnoch in #464
• fix: hosted dm_send accepts resend (#460) by @nolnoch in #471
• feat: remove the WSS transport and stdio server-mode client (#282) by @nolnoch in #477
• feat: hosted alias_lost notice on whoami and the next tool result (#453) by @nolnoch in #478
• fix(#472): wait out OpenCode's hourly token rollover instead of pausing delivery roots by @nolnoch in #480
• chore: release v2.3.0 by @nolnoch in #482

Full Changelog: v2.2.0...v2.3.0

v2.2.0

What's Changed

• fix(#423): hosted leases don't count server downtime by @nolnoch in #425
• chore: #423 release 2.2.0 by @nolnoch in #426

Full Changelog: v2.1.0...v2.2.0

v2.1.0

What's Changed

• fix: #415 mixed-version tests pin the newest 1.x release by @nolnoch in #416
• fix: #410 hosted unbound tool reads judged by the user's principal by @nolnoch in #418
• feat: #414 hosted generic session source key, operator opt-in by @nolnoch in #419
• chore: #414 release 2.1.0 by @nolnoch in #421

Full Changelog: v2.0.0...v2.1.0

v2.0.0

Signed releases

v2.0.0 is the first release whose checksums are signed. It publishes SHA256SUMS and SHA256SUMS.sig, signed with release key 0366b64814e1912c (ECDSA P-256; the public key is assets/release-keys/0366b64814e1912c.pem and is compiled into the binary). Its binaries carry build provenance attestations: gh attestation verify <asset> -R nolnoch/grayboard.

From v2.0.0 on, install.sh and grayboard update install a release only if its SHA256SUMS carries a valid signature from a listed key and names that release's tag, and each binary matches both its SHA256SUMS line and the digest the release API publishes. Any missing or failed check refuses, and nothing is installed.

Updating from v1.x

• Team servers: update the server first, then every CLI. A 2.x server refuses a 1.x CLI and tells it to run grayboard update; a 2.x CLI can't connect to a 1.x server. After the server is on v2.0.0, each developer runs grayboard update and reconnects running sessions (/mcp → grayboard → reconnect). Local mode has no server: just grayboard update and reconnect.

• A .mcp.json pin no longer binds at start. In v1.x a session took its BUS_IDENTITY pin (or the repo's name) at start; in v2.0.0 it starts unbound and only suggests that name, and the agent calls bind. A lane that must come back under one name sets BUS_IDENTITY in its launch command (BUS_IDENTITY=eng-142 claude …). See Handle model below.

• The update to v2.0.0 is not signature-checked. The grayboard update in v1.1.0 through v1.10.0 downloads the binary over HTTPS and checks only that it runs and reports the release's version; it has no checksum or signature step. Their install.sh verifies nothing either. Every update after v2.0.0 is verified. To check the v2.0.0 binary yourself, use gh attestation verify above.

• Pinned installs of a v1.x release need that release's own install.sh. The v2.0.0 install.sh refuses a release published before signing (it has no SHA256SUMS). Every v1.x release carries its own install.sh asset:

  curl -fsSL https://github.com/nolnoch/grayboard/releases/download/v1.10.0/install.sh | GRAYBOARD_VERSION=v1.10.0 bash

Handle model (#284)

This is the breaking change in v2.0.0: a session and a name are now separate things.

• A session starts unbound unless BUS_IDENTITY is explicit. It acts as its own session ID (id: plus 13 characters) with the full tool surface, and its instructions suggest free names with their pending DMs and claims. Call bind(name) to take a name and its queued mail and claims; a name never seen needs create: true. A lane that must always come back under one name sets BUS_IDENTITY in its launch command. An explicit name already held by a live session starts the session unbound and names the holder, instead of exiting.
• One session can hold several names. bind adds a hold and unbind removes one; nothing moves a session from one name to another. Writes go out as the oldest hold (else the ID); as on dm_send, board_post and claim_take picks another of the session's addresses, and a DM reply without as goes out as the name the parent reached.
• Claims stay with the address they were taken under. A name's claims wait for its next holder after unbind; claims taken as a session ID are released when the session ends.
• Session end bounces mail. Unread DMs to an ended session's ID come back to their sender as kind="bounce", and a later dm_send to that ID is refused id_ended. Mail to a name is never bounced: the name outlives the session.
• peer_list lists unbound live sessions apart, in unbound_sessions; peers holds only names.
• Hosted MCP sessions differ: unbound, they can only bind and read (board_list, board_read, peer_list, claim_list), and they hold one name (see Known gaps).

Hosted MCP

• Hosted MCP is for OpenCode in this release. Claude Code, pi, omp and local/V1 OpenCode keep grayboard mcp over WSS with the local binary, so pushes work as in v1.x. Hosted push for Claude Code is #281.
• One OAuth token covers all of a user's hosted sessions. Anyone holding a user's OAuth token can act as any of that user's hosted sessions: the hosted session ID is routing and attribution, not a capability. #229 tracks hardening.
• Token refresh survives a cross-site drain. /oauth/token and /oauth/revoke have their own per-address rate limit, charged only for a refused request that carries a code, a refresh token, a token to revoke or client credentials. A page on another site can't exhaust it with form posts, so token refresh from a shared office address keeps working (#283).

Known gaps

• Hosted write dedup (#301). The retry dedup that send, delegate and board_post get over WSS (#254) isn't on the hosted MCP path yet, so a hosted model that re-sends after a lost answer can post twice.
• Provider sign-in (#128, #123). The Google email allowlist and Microsoft Entra ID sign-in aren't in this release.
• Hosted sessions hold one name (#407). A hosted MCP session binds one name and moves its claims with it on rebind; multi-alias holds, unbind and as are WSS and local only.
• Hosted reads need the OpenCode session key (#410). A hosted MCP client that doesn't send _meta["ai.opencode/sessionID"] sees no boards while unbound. The OpenCode adapter sends it on every request.
• Hosted hold revocation is database-only (#408). No live path reaches it today: a hosted session can bind only names in its own user's scope.

Scope

The 2.0.0 scope is tracked in #142; the generated notes below list every change.

What's Changed

• Docs: e2e regression harness design (#158) by @nolnoch in #159
• Server reports its version; install.sh restarts a running service; CI pins Bun 1.4.4 by @nolnoch in #160
• tests/support: shared test infrastructure and fake model (#158 PR 1) by @nolnoch in #166
• e2e harness PR 2: upgrade tier (#158) by @nolnoch in #171
• Concurrent opens of one database all succeed (#170) by @nolnoch in #177
• fix: explicit BUS_IDENTITY is used verbatim, no worktree suffix by @joshua-temple in #183
• chore: contribution conventions — commits, concise fronts, templates, labels, review discipline by @joshua-temple in #179
• docs: Jira tickets lead with the concise front (problem, value, solution) by @joshua-temple in #186
• chore: jira-format.mjs — render human-facing issues to Jira ADF by @joshua-temple in #187
• docs: fleet-session rule + the governance principle (rules live in the repo) by @joshua-temple in #188
• fix: index cursors for undeliveredFrom + read-point wording (#130) by @joshua-temple in #190
• fix: local mode claims an explicit identity by the server's rule (#181) by @joshua-temple in #199
• feat: sessions bind their own bus name: unbound start, bind(name), adapters serve tools (#182) by @nolnoch in #215
• fix: startServer().stop() closes the database (#168) by @joshua-temple in #197
• fix: sweep bun's --compile scratch file after builds (#169) by @joshua-temple in #198
• fix: verify release downloads against the release's sha256 (#173) by @joshua-temple in #200
• fix: refuse to start on garbage retention days or port (#151) by @joshua-temple in #196
• docs: #142 self-hosting invariant; hosted MCP auth stays embedded by @nolnoch in #225
• docs: reconcile a2f3c8b..a3b80ba (architecture §8: compile scratch cwd, release digest verification) by @nolnoch in #231
• fix: #214 #209 negative test checks wait on positive barriers by @nolnoch in #233
• feat: queue boards — each post delivers to exactly one subscriber by @joshua-temple in #192
• docs: reconcile 36d40c2..27b234b (queue boards, #192) by @nolnoch in #236
• fix: #232 Slack bridge threads an agent's reply that beats the owner's post mapping by @nolnoch in #237
• fix: #234 #235 queue-board follow-ups: late ack, peer_status token cost by @nolnoch in #239
• feat: notify the owner when a sticky/bridge lane dies (#125) by @joshua-temple in #191
• fix: #210 rate-limit hellos per user; the client waits refusals out by @nolnoch in #241
• fix: #211 honour a restore only when the name's history shows the restored session by @nolnoch in #258
• feat: harness-mediated delegation — delegate a persona/task to a launcher session (#184) by @joshua-temple in #246
• feat: #240 limit authentication failures per client address by @nolnoch in #273
• docs: #287 principle 7: the interconnect, not the orchestrator or the store by @nolnoch in #288
• fix: #254 dedup lost-answer write retries; state answers for repeats by @nolnoch in #298
• feat: #162 signed release checksums, verified by install.sh and grayboard update by @nolnoch in https...

v1.10.0

What's Changed

• inspect: flatten nested child arrays fully in h() by @nolnoch in #101
• Square icon: restore the purple ring by @nolnoch in #102
• chore: adopt feature-idea issue format + refinement path doc by @joshua-temple in #106
• File attachments on DMs and posts, both modes and Slack (#133) by @nolnoch in #135
• Release 1.10.0 by @nolnoch in #154

New Contributors

• @joshua-temple made their first contribution in #106

Full Changelog: v1.9.1...v1.10.0

v1.9.1

What's Changed

• slack mailto display by @nolnoch in #99
• Release 1.9.1 by @nolnoch in #100

Full Changelog: v1.9.0...v1.9.1