v1.10.0

Changelog

• 4e841a0 0047 residual wording: the / project loses project-tree coverage, not the whole check
• d6689db ADR 0047 residual: rest the rationale on the owner's ground, not an overclaim
• 0391cd4 ADR 0047: record the filesystem-root residual
• 4fa841e CHANGES: v1.10.0 -- v1.9.0 was already released
• b1852f2 CHANGES: v1.9.0; the configuration reference stops calling the favourites cascade values
• 99249f6 Drop go-isatty: x/term already provides the same IsTerminal ioctl
• 1fd1ff3 QA playbook: the v1.9.0 pass's recipes and lessons
• c4b7f1b RealUnder judges the pathname it returns, from one lookup
• 5ab343a TODO: exclusive-volume refusal vs a sibling launched before the declaration
• 0f2c0ba TODO: rulings on the security-gap report; the report is absorbed and deleted
• 60b8dc4 bounded probes: close the stdout pipe for a descendant that left the group
• 64c11c9 builtins: the seven cold-start probe subtests run in parallel
• 25f6ede bundled mirror lays its header below the body's bare keys too
• 92e7789 claude skill dir: a top-level symlink gets the walk's own refusal
• 3ea65f8 codex login hook: reap grace becomes BYRE_CODEX_REAP_GRACE
• 24dd2ad config.CoreLayer: the editor folds the same base resolution stacks
• b53bb04 configui: scalar pickers follow the extends/template flip; default favourites stripped
• 52c841e configui: the deliberate-sentinel bit follows the last move and is part of sig
• 27c79ab configui: the global DEFAULTS label stops calling template/agent real config
• 04bbc66 configui: the inherit row names a lower layer's explicit off-switch
• ae86362 develop: say which env_from_host rows resolved empty
• f130c99 doctrine index: 0047 entry carries the filesystem-root residual
• 57016f3 env screen: keep skill rows last so the skills heading tells the truth
• 56a9492 fork and init lay [package] below the body's bare keys, like pack
• 8838cc9 gitProbe kills the whole process group, sharing clipread's setup
• 25b65cd hostexec comments: the Dock-drop rode Resolve's success path, not the fallback
• a25736d hostexec: never treat the filesystem root as a box-writable root
• 738e0dc hostopen Reasons: four sites claim UserNamed, not more
• d6cad0b hostopen: filepath.EvalSymlinks and Walk join the conformance watch
• 9bb851d package scoping: files must be an array of TABLES; git remedy claims commits only for identity rows
• 5344cf3 packages: a body key scoped under [package] makes a local package INVALID
• 65f56c0 release prep: baked reference regenerated; the git warning skips keys a skill provides
• 0c5c888 security model: disclose the filesystem-root residual

v1.9.0

Changelog

• 92d13e1 Release prep v1.9.0: CHANGES section, docs sweep for remote/named installs
• 6d22169 deliver --install-app: remote (ssh://) and named coexisting drag targets
• 3ffcf7e install-app fresh-review fixes: anchored marker, per-install icons, Name= escaping, blank --remote-byre
• 7d36438 install-app review fixes: round-trip URLs, identity-gated collisions, no user text in XML comments
• 8b6f93d install-app round-3 fixes: zoned IPv6, private staging, prologue marker, label/quoting/token tightening
• b433389 install-app: anchor identity extraction; reject non-UTF-8 and unsafe byre paths
• 1544370 install-app: bound the marker match; icon gate judges presence by Lstat
• bb554d9 install-app: no-follow text gates, hash icon identity, IPv6-literal hosts, XML noncharacters, strict id lines
• 83b1dc1 inttest wrapper: force IPv4 to the runner

v1.8.0

Changelog

• f799484 ADR 0049 amendment: no-external-users collapses the retirement calendar
• c520552 ADR 0049 warning channel: legacy spellings warn on every surface
• 18aada0 ADR 0058: record the sentinel encoding and blank-flag rejection
• 339c243 CHANGES: date v1.8.0 — 2026-08-24
• 6b72a71 Canonical yes beats a legacy pick in the shared_auth union (codex verify round)
• b889d15 CatalogLoader: uninstalled is a loud error, never a silent fallback
• 09e982a Close the agentless-record ambiguity and reject a blank --agent
• 9256ddf Full Layer/Resolved split ruled out; assessment absorbed into ADR 0049
• a6b3cee Lifecycle split, staged: merge bookkeeping leaves the Config struct
• d6f4ec6 One owner for the re-record remedy (grok closure residual)
• 6b7436c Pin the configured-handoff sibling; caveat the user docs
• c5534d4 Reject an explicitly blank --agent at the CLI; announce via dataf
• 9891568 Reset hostexec pins around the configured-handoff test
• fdfa2d8 Retire the archive-legacy machinery (ADR 0049 #4)
• 31ad664 Retire the repo-root byre.config preset name (ADR 0049 #3)
• 05731e7 Review fixes: editor top-level warning, dataf funnel + P4 arms, honest remedy, doc sweep
• 16ca6be TODO: sweep the ADR 0049 closeout; two follow-ups replace five items
• cdf65e3 byre worktree forwards --agent to its handoff develop
• 654a912 develop --agent: run-scoped agent override on a configured project (ADR 0058)
• 4f13b90 shared_auth: yes-without-pick is no longer a saveable state
• 007bf0b wip: sketch the tmux seam (pinned socket, no verbs)
• 0b432f1 worktree -a refuses a never-developed repo instead of configuring it
• 8b2ff4b zai review fixes: every save cleans, empty picks are the same half-answer, comment sweep

v1.7.0

Changelog

• 7ce2bc0 CONTRIBUTING: the too-many-ADRs entry states the position, not the debate
• 13ebae2 Close worktree and clipboard review gaps
• da3c259 Confirm inferred host-file pastes and bound control replies
• 023d72a Escape clipboard fallback diagnostics
• eb265ce Make destructive lifecycle operations fail fast
• 54a9047 Merge remote-tracking branch 'origin/main'
• 707d878 Normalize forget-winner setup cancellation
• e65829b Prepare v1.7.0 release notes
• 4f066fe TODO: configui inherit rows go stale on a mid-session template flip
• 6b3fa30 Tighten credential diagnostics and documentation
• f1852a0 accept egress closures in the item editor, per the layer grammar
• 690b003 add scripts/byre-ccusage.sh: machine-wide agent usage reports
• 19c0913 adr 0057: consent is an upper bound, and the sentence says so
• 445b754 adr 0057: the identity outlives its last row, by ruling
• 04b85e9 byre config hands the editor the credential write path
• 5decce3 byre-ccusage: drop non-regular entries from the extracted copies
• caef103 carry the shadowed mount's mode through a disabled override
• e04eedb cli: the byre credentials noun — vault verbs + declaration shortcuts
• e397170 codex review fix: the attach command pins its detach keys
• 5f7c882 config: [[credentials]] declarations ride the named-declaration rails
• d9c4f47 config: an unknown [credentials] key is refused before it can be echoed raw
• 56a35ba config: credential rows move to env_from_host
• 51c972e config: encrypted env rows and the file-local [credentials] block
• ec84566 config: one eliding renderer for env_from_host sources
• 7e57e3b config: the file attribution helper sits with the walk that owns it
• 7d53b9f configui: the Credentials screen — masked staged entry, value-state, inline vault creation
• fadde5c configui: the global editor stops naming a command that cannot reach its file
• 122eb42 credentials list: a row the cascade beats is set, not unset
• 00b38a7 credentials list: one broken row no longer slanders the healthy ones
• 2132298 credentials list: the unresolved fallback attributes a key to its nearest row
• f7382dd credentials set: enroll the store before taking the setup lock
• 4d16785 credentials set: the encrypt-and-CAS half becomes one named seam
• 1040c96 credentials surfaces: the set/unset cell dies with the vault join
• 345b131 credentials: 'manifest' is the receiver's name, not a credential's
• 789cd02 credentials: a layer write locks the layer, not the caller's project
• 3ee32b4 credentials: a session ending mid-poll no longer abandons a running box
• a0e8edc credentials: an encrypted row is env_from_host's fifth outcome
• ae7cde3 credentials: name the identity that vanished under the form
• 1371578 credentials: one accept, one write — the removals ride the row
• 7a431b7 credentials: pin the seam the CLI tests and the launch tests never met at
• feffb00 credentials: quote the echoes that carry mintable strings
• 011d967 credentials: refuse both directions of the identity race, disclose the read
• 8392ed1 credentials: say what the lock guarantees and what the compare does
• 7c4fa58 credentials: tell the truth about rows whose identity is missing
• 458c0ea credentials: the host-side vault (age at rest, unlock, cold writes)
• fff254e credentials: the inline crypto core — identity blobs, key/kind-bound values
• 1deacc1 credentials: the launch delivers exactly what was consented to, bounded
• 11274b8 credentials: the lost-passphrase remedy must be one you can run
• 3d7e688 credentials: the shipped-over prose and the two tallies that disagreed
• ea55aa7 credentials: the vault directory dies; set/unset/rekey/list write rows
• ed3237b credentials: two comments state what the checks accept
• b178dc3 credentials: vocabulary sweep and one owner for the bounded echo
• e304ac4 cross-engine refusal offers the removal remedy that always clears it
• 613ff30 cross-engine refusal stops asserting a liveness it cannot know
• 424f4af delivery honesty: capture the epoch synchronously before the goroutine
• 632a9b7 develop's already-running refusal offers the re-attach command
• 5db8eee develop: credentials are blocking, and the launch flow runs on the rows
• ad0bcb7 develop: refuse a launch whose two cascade views disagree on a credential
• a393e6c develop: the credential launch flow — pre-lock unlock, locked decrypt, concurrent inject
• e162f2f diffStagedTrees: surface read errors instead of calling them divergence
• 4c4263c dockerrun refuses a credential config it cannot read
• 27c4b94 dockerrun: the ejected command carries the credential gate
• 6168514 doctrine: ADR 0057 records the inline design, and the banners follow
• d411e2e doctrine: ADR 0057 — project credentials — and its sibling amendments
• 44fd05f editor: a refused credential write drops the pending plaintext
• b8e9aa7 editor: an inherited credential's kind travels into the override
• 2f8e73b editor: the Env screen rekeys a file's credentials passphrase
• 7e7cfaa editor: the Env screen writes credentials, masked, through the CLI's path
• 5328c5f editor: the credential edges say what they do
• d1d3d02 editor: the credential kind is its own picker, so the form fits 80 columns
• dbae36d editor: the credential tally excludes [env]-shadowed rows, like every other surface
• f841442 exclude disabled rows from the field-summary tally
• 762110f exploratory findings: podman tmpfs rendering + the credentials form explains itself
• 6672b04 fable closure: the survivors the verifier caught, and the lesson
• 95c3ffc fable pass: honest words, dead export, brief citations swept, grammar pin
• 543c894 fail closed on a non-directory at the snapshot digest path
• fd9b549 fix builtins test: blank OPENCODE_CONFIG_CONTENT for a hermetic empty-set check
• 64b9c71 gate flock-specific auth tests to Linux
• e291b1f gen: the box fails closed without its credentials, and items travel as keys
• 7e45128 gen: the credential receiver and the launcher's fail-open export step
• 9871bde handoff: gates lifted — screen and doctrine shipped; final state for the read-through
• 7f41559 harden shared-auth reconcile: bounded lock, retained displaced credential
• cabb926 launcher: a blank manifest line fails closed like every other bad line
• 7da2780 launcher: a manifest cut mid-line is a truncated delivery, not a short one
• af77c27 launcher: a manifest line it cannot honor stops the launch
• 4932214 legibility: credentials on status, the exposure tally, and preset review
• 2d5ccc5 make Codex auth hook tests portable to macOS
• 2ee5558 make SharedAuthPref.Equal true set equality on Pick keys
• 5b736e7 one predicate for "is this row a credential row"
• 8065658 polish Codex auth probe cleanup
• ef24624 preset review: name the credential values and the identity that moved
• 433ae19 quality closure: status speaks ValueState; the partial flush earns a real test
• 22fb602 quality pass: one owner per rule, honest outcomes,...

v1.6.0

Changelog

• 0ab3a48 adopt's cross-kind refusal names a remedy that works
• 8b076e5 build: cross-skill same-dest claims must be byte-identical
• cac2162 catalog: local shadows installed for the same id, announced in the label
• e31d58e catalog: store walk follows symlinked package dirs
• 1e64ab2 codex review fix: journey step 1 names version, which pack requires
• 8a6b6b9 codex review fixes: pack -o payload guard, adopt rollback honesty
• 22c0593 codex review fixes: the round-trip journey is followable as written
• 98bec89 coreBlock writes the dev shadow record; scrub covers /etc/shadow
• ca24744 grok review fix: pre-existing-dev scrub covers /etc/gshadow too
• 4052dd7 grok review fixes: ADR stops overclaiming dir-mode constancy; refusal remedy names the exec bit
• c29f5c8 grok review fixes: relative -o fails closed, adopt refuses cross-kind installed ids early, positive takeover arm
• df98344 pack -o guard resolves the leaf symlink too; 0055 index arm recorded
• 8e66ba8 pack -o: write the manifest after every read
• ccc9a67 release: date v1.6.0; playbook gains the authoring round-trip journey
• e2f6dc4 skill/template adopt: a directory becomes the local source for its declared id
• 5c4b156 staging normalizes file modes git-style; dest-collision refusal names the difference

v1.5.0

Changelog

• c51380d --data carries a volume's sharing, so the two tiers still describe one box
• 273c390 ADR 0006: the run_args exception is byre's LABEL SET, not a fixed pair
• 055e9b1 ADR 0052: lead the file-root rule with the fact, not the engine's error
• a2ee1ba ADR 0052: name the preset-apply review as an open sibling, not an oversight
• bfe9b1e ADR 0053 and the docs follow the review findings
• 44f1677 ADR 0053 and the docs sweep for the launch record
• a196e0f ADR 0053: state the DefaultBase-drift story
• 69af73b ADR 0054 records the sharing decision and scopes 0009's rationale
• b528ad5 CHANGES: date v1.5.0
• d971e71 CHANGES: rewrap the unreleased entry
• 1110964 CHANGES: the deliver clause names the surface that was funneled
• 320a4ae CHANGES: the four config surfaces this batch added
• e363eb4 CHANGES: the reporting clause covers the surfaces that now funnel
• 78a86e2 CHANGES: the runtime-shadow disclosure, in the register users read
• 4eda0f1 CHANGES: today's user-facing entries (firstrun disclosure, manifest spellings, fork refusal)
• 623898e CLAUDE.md: P0's restatement catches up with the amended principle
• ac6ff5f Merge branch 'status-containment': one blanket disclosure for runtime mount shadowing (ADR 0052)
• e268ccd QA pass for v1.5.0: one finding filed, two journeys graduate into the playbook
• 7591521 QA playbook: the guard journey now walks the runtime half it cannot cover
• afa4d32 Reposition conversion copy: convenience leads, containment enables
• c9b088e TOML structural judgment belongs to the parser, not line scanners
• bf30c65 a bind below a regular file is not a shadow
• 253f096 a declined engine is not an absent one
• f49f002 arm the three error paths the last round left unpinned
• 5a022f1 bound the engine and clipboard calls whose failure mode is a hang
• 2c12e63 close two forward-compat gaps in the test-tier guards
• 7f8df3d codex round: an invalid combination has no skill mounts to disclose
• a58eb3a command-level arms for the dispositions the docs now claim
• 0b78b3b commands: contend the two-lock helper the ordering exists for
• 6d529d4 commands: install, layer and preset print through one funnel
• d361479 commands: reporting surfaces print external strings as data
• 17034b8 config: a headless editor refuses with the route a script can take
• 7ad38ff config: a parse error says where, and the remedies point somewhere that works
• 8f3ef07 config: a port binding replaces the inherited one, like every other identity
• 933199c config: the position reaches the commonest refusal, and the claims match
• 9ccbb94 config: the removed-key refusal says where too, and the exit page names the collision
• 31bfe49 configui: [[volumes]] is grammar the editor can write, not just clear
• ddd6410 configui: [sources] is shown, read-only, and names who writes it
• a9728f3 configui: a broken skill your config already names says why
• 0660149 configui: a config key without a row now fails a test, not a review
• 7398eea configui: cover the global editor's own sections, and document the new rows
• 93cf194 configui: overriding a volume must not silently rescope it
• bb84848 configui: seed_prefs gets the tri-state widget its key already needed
• b621228 configui: the P0 arm descends into nested tables, not just top-level keys
• 053bccd configui: the fieldInfos guard bounds on a sentinel, not on today's last field
• 106d212 configui: the skip_questions checkbox signs into the dirty signature
• f6218e0 configui: the stored shared-credentials answer is visible, and checked
• c7e06f8 copyExactly's comment names the tests that actually pin it
• e4866a3 deliver: every report line in the package goes through the funnel
• 4c2aa66 deliver: frame the box-reported landed path onto the porcelain stream
• a90cd01 deliver: one funnel for the transport's reporting lines
• 796e4ca deliver: the remote leg holds the landed-path stream to a local rule
• 44d9d7b develop refuses to start a second box holding an exclusive volume
• 6427249 develop's lock boundary is a typed return, not captured variables
• d9b6f7c develop: 125-127 is the agent's exit status, not a reserved band
• 4633207 doctrine index: judge a gated arm by the file's name, not its text
• b7b5bcf doctrine index: mark the arms that only CI runs
• 3da0392 doctrine: P6's scope note claims the position it now has
• d8695a0 doctrine: the claim surfaces, the editor's reach, and one boundary stated by its test
• 475ad8d every refusal that isn't absence is a declined engine
• 1875af5 every setup writer refuses the engine renamed under the lock
• a0bd1d7 firewall: diagnose the wall by port, and never expand a glob into a rule
• 35b1d40 firewall: the resolv.conf the helper scopes is established, not assumed
• 44f78a3 firstrun hook failures are disclosed; env.d purity is stated as it ships
• 672f6e8 follow through on the three fixes that stopped one step short
• a73503b gen: pin writeFiles's sort the way writeEnv's is pinned
• 797d22a grok round: the disclosure claimed more than it knows, and went quiet too easily
• ae720f7 host git runs from a pinned path, and the exit report degrades on a shadow
• ac3388c hostexec: a test that narrows PATH can drop the pins
• 71437de hostexec: pin host binaries, decline the ones the box can write
• 3bc21a4 hostexec: unbreak a hyphenated term across the doc line wrap
• 25a0340 hostopen owns the in-tree identity judgment
• 648ddfd inspect: the pasted install line shell-quotes its source
• d0abcf6 lifecycleEngines: the comment covers every non-absence refusal, as the code does
• 818be13 lock: write down why the requeue loop stays unbounded
• e805320 main: the usage-error exit escapes what fatal() already escapes
• 8671819 netns: say why the session ends, and record the change in CHANGES
• 807f2df notify/clipboard: say honestly what a declined helper costs
• b0f1873 onboard: a stored shared-auth pick is a name, so check it names a skill
• 2998f3f onboard: first-run shows a broken package instead of hiding it
• fd702d6 onboard: the legacy shared_auth spelling migrates on presence, not on change
• ac24c3e onboard: the picker's rows are data, and a name is listed once
• 8720442 pack keeps top-level bare keys before the [package] header
• 0d7657d packages: the bundled mirror's swap belongs under the store lock
• 3378c6b packages: the mirror's CREATION belongs under the lock too, not just its swap
• 028b4d0 probes and writes stop discarding the error that says they failed
• b8a6c2f release: a skipped cask push stops being silent; index.toml says why it is lenient
• cf33886 reporting: pin the one-line framing, and hold argv to it
• 48ffe2a runner: an unrecognised rootless answer is inconclusive, and status says so
• 6904c38 runner: verify the two engine premises reset/forget rest on
• 4ece4c9 selfedit: the bound alone cannot prove the config was read whole
• f6194e8 skill.go prints through the dataf funnel, like its siblings
• 2b95817...

v1.4.0

Changelog

• 49f533b A: the setup lock refuses to follow a symlink, and re-checks by inode
• ce729d3 ADR 0011's guard covers files clobbers, not raw lines: measured, and the docs now say so
• 551c712 ADR 0016: the symbol moved after v1.3.1, not in it
• c394185 ADR 0025 gains its second suppression, and both of them disclose at the switch
• a356bbc ADR 0050 absorbs the claim-surface work; the review's doctrine wip retires
• b13d661 ADR 0051: the release proves integrity, not authenticity, and says so on the record
• d8fe804 B: byre's own records publish through one directory descriptor
• 4249754 Baked files moves to ADVANCED, beside the raw lines it exists to feed
• 9dd724a Bump actions/checkout from 4.3.1 to 7.0.1
• c461366 Bump actions/configure-pages from 5.0.0 to 6.0.0
• ce75f90 Bump actions/deploy-pages from 4.0.5 to 5.0.0
• 96a3f03 Bump actions/setup-go from 6.5.0 to 7.0.0
• 9714a11 Bump actions/upload-pages-artifact from 3.0.1 to 5.0.0
• 596d2c1 Bump the go-modules group with 2 updates
• 093b3e4 C10: loadFile rides hostopen, with follow decided by who owns the path
• 89030e1 C10b: the hostopen rule gets its enforcement arm
• 7b0a273 C11: rejection tests name the rule that fired, to closure
• da5dbb2 C1: one owner per rule -- quoting, tilde, and the sibling-drift batch
• 28b795f C2: docs tell the present tense -- stale samples, glossary drift, nit batch
• 9a3c436 C3-C5: one home per claim; the commands note argues less; settled positions get an address
• 78df0a8 C6: one registrar for the skill/template surface
• 42c8054 C7: the placement principles move to docs/PLACEMENT.md
• 8a5e62b C8: the config-complexity WIP file dies by absorption
• 658de9c C9: host-side reads of agent-shapeable paths ride hostopen
• 80c4ecf C: existence probes on byre's own records stop following the leaf
• bccca27 CHANGES + devlog: record the behaviour changes and the pass itself
• 3dec6cf CHANGES: all four inttest variables renamed, not one
• 8af0888 CHANGES: date v1.4.0 -- the claim surface, the two new widgets, and the reviews that held them to it
• a1ecb4e CHANGES: record the hostopen sweep, the vocabulary alignment, and the doc moves
• b37d5bd CHANGES: record the two user-visible renames
• ef9cc43 CHANGES: the gemini Node fix rides v1.4.0 -- the tag had not left the machine
• cf71ff6 CHANGES: the three unannounced changes, one of them the wave's hardest break
• a4f6961 CI gates both engines, not just docker
• f0d05c5 Claude Skills bound holds at the staging copy, not only in the validation walk
• 691f31f D: the last 13, and the backlog is empty
• 3abbe37 E: a path the user named may be in-tree, and that is their footgun
• 7657053 Merge remote-tracking branch 'origin/dependabot/github_actions/actions/configure-pages-6.0.0'
• b24a110 Merge remote-tracking branch 'origin/dependabot/github_actions/actions/deploy-pages-5.0.0'
• 9288493 Merge remote-tracking branch 'origin/dependabot/github_actions/actions/setup-go-7.0.0'
• fd3c6f1 Merge remote-tracking branch 'origin/dependabot/github_actions/actions/upload-pages-artifact-5.0.0'
• e78b8bb Merge remote-tracking branch 'origin/dependabot/go_modules/go-modules-be716a600b'
• d83e132 P0: [files] becomes a widget, called Baked files
• 7c9c175 P0: env_from_host becomes a scheme picker instead of a dead end
• 6ef71a5 P0: the TUI is the gold
• 92adc86 QA playbook: two journeys, a probe, and four harness lessons graduate in
• 84d68ae SKILLS.md documents [build].files and the root it resolves against
• a0baf39 TUI dependencies come up to date, verified by pane-text diff on the inttest runner
• a548867 [defaults]: picker state gets a real home, and an off switch for the questions
• ef91571 [env] refuses byre's reserved BYRE_ namespace; chassis knobs pinned to the prefix
• 4d4511b a cwd-derived preset path is not a named one, so byre stops following its symlink
• c421edc a shadowed passthrough says so, instead of being a second row for one name
• 4660e2d absences tier one: four claims byre already makes, now pinned
• cf5ab65 address grok's round: an over-claim of mine, a stale line, and the dual spelling
• 3984665 agent-writable is one shared predicate over every tree a box can shape
• 61ea825 batch reviews: both reviewers hunted my siblings, and one checked the engine
• 30be3a2 call the netns helper by its name, freeing "sidecar" for the planned feature
• 6ed41c2 claude-skill list owes the same shadow proof its sibling list commands make
• 9476d66 close the escaping class, and record the port-custody residual on the record
• 948c5f2 closure round: the strip moves to the paint funnels, and errLine learns proseBlock's lesson
• 268999f cmd: each usage test owns its own doc comment
• 9799b3f cmd: usage errors exit 2 on every command, with a usage line
• abc4ed4 codex round: a refused conversion no longer eats the row it was converting
• a58040c codex round: the disabled contract had two consumers I did not adjust
• 3c76590 codex round: the file probe owed the same proof the directory listing does
• 5ec7bf8 codex round: the temp cleanup is best-effort, and say so where it happens
• ee823d8 collapse duplicated helpers; one name grammar; one contract per helper name
• 5503f47 commands: three more marker classifications onto IsRemoval
• be348c3 comments and tests: delete what carried no information, correct what was false
• 02b98ae config UI: row effectiveness is its own property, not inferred from kind
• 909180e config values are data, and data does not drive the terminal
• 2475af3 config: finish the marker collapse -- CutRemoval, so classify-and-strip is one call
• 32ff968 config: one !name marker rule, and cascade-positioned mount/volume replacement
• 8d7aca0 configui: label it Agent, and let the glossary own "primary agent"
• b98f261 continue rounds: the sweep matched a spelling, not the claim
• 34e676f deferred items: a crash stops claiming to be a usage error
• 97887d8 delete dead exports and test-only forwarders; close the unencodable Yes path
• 8ce05e2 delete dead exports, test-only accessors, and one shim that claimed a caller
• 4babc23 deliver: drop the doc clause that respelled its own one-line body
• 2eeb15c deliver: the local leg's comment claimed a check it does not make
• 649f096 doc drift: eight places where the docs described a byre that no longer exists
• baf9b36 doctrine index: every ADR and principle gets a one-liner with its enforcement marker
• 06a106f drop dead parameters and one unreachable branch; correct two comments
• 1fd32df every non-obvious list screen says what it is, in one line above its rows
• 177727e exit-report enumerations get their sibling bounds, and the probe fan-out gets a budget
• 7d34d9a exploratory pass on both widgets: four defects a pty found and unit tests did not
• 9f0aa82 five one-line drift repairs: messages that lost their sibling's fix
• 53d140e four silent-corruption fixes: duplicate files sources, port blocks, alias write-through, box-derived output
• a4a74a1 gemini brings its Node from nodejs.org, because NodeSource pulled the floor up
• 6333f44 grok round: a...

v1.3.1

Changelog

• 3e12d46 CHANGES: date v1.3.1 -- the exit report, and the security contract's corrected bound
• 6a9efd1 develop: the exit report -- say what changed where the diff can't show you
• e1ba4df exitreport: a partial walk is not a complete one; mark listing files explicitly
• 7647668 exitreport: actually wire the unreadable/deleted distinction for git config
• 7b70c9f exitreport: hooks get the unknown state too; enumeration guards both directions
• e467a8d exitreport: only ENOENT means absent; enumerate-or-admit-you-couldn't
• 181cd68 exitreport: review round -- no secret-shaped values, no LFS wallpaper, no vacuous pin
• 2fcb1bc exitreport: round two -- redact key userinfo, whole verbs, unreadable != deleted
• 9f1f6c1 qa: the exit-report journey, driven on the runner for v1.3.1

v1.3.0

Changelog

• 4b0f9b6 CHANGES: date v1.3.0 — standing instructions, preservation engine, seed_prefs tri-state, field-QA fixes
• 6a200ff CLAUDE.md: tech stack names pelletier + tomldoc, not BurntSushi (review round 5)
• 5b980f6 Merge origin/main: the v1.2.0 QA field pass meets the injection cutover
• 6470dc6 build, status: aggregate argv-truncation warning; the verdict claims the channel, not the delivery
• 7668a8f build: bake [[context]] declarations into the agent context
• 38abe50 build: the size tiers disclose the argv transport truncation (post-merge coherence)
• 6681787 builtins: codex twin fixture for the byte cap (grok round 3 nit)
• 6b7b398 config, docs: review round 1 — cascade-positioned replacement; qualify the self-edit exception
• 53bb295 config, skills, packages: decode migrates to pelletier — BurntSushi is gone
• 31ae3bb config: SharedAuthPref.MarshalTOML — a structured save no longer bricks the file
• df6e42d config: add the [[context]] standing-instructions vocabulary
• 004a9b2 config: context prose refuses control characters (the mcpPrintable stance)
• fd92de7 config: control-character check covers Unicode C1 (unicode.IsControl)
• c0b3dbe config: seed_prefs is an ordinary tri-state scalar (ADR 0045)
• deb7793 configui, commands: the Instructions screen and byre context verbs — the feature lands editor-first
• 495395c configui, onboard: every write rides the preservation engine; apology apparatus deleted
• aa62fdb configui: incomparable save-report endpoints always report written
• a5c8e84 configui: live name validation; inherited instructions readable in full
• f0bf6f8 configui: only fs.ErrNotExist means absent in the save-report edges
• 92050ba configui: prose soft-wraps to the terminal width
• 6600103 configui: prose wrap is cell-accurate, faithful, and narrow-safe
• 0cb0880 configui: quit report never assumes 'unchanged' from a missing mutation flag
• 525970e configui: review round 4 — map vocabularies emit in sorted order
• c9254a2 configui: tabs expand to 8-column stops for prose display
• efacaa8 configui: the Instructions item editor shows the stored prose
• b59f659 configui: the narrow-CJK test claims termination, not visibility
• d632274 configui: wrapLine can't hang on wide glyphs in a one-cell window
• 42882dd context delivery is injection: context_target dies, byre never writes agent state
• 726a249 context list: a duplicate same-layer closure keeps the first marker's victim
• eda0506 context list: replay the cascade for attribution; worktree + stat-error review fixes
• c3b4744 context list: same-layer closures win whatever the TOML order
• 1c38435 context: the five QA findings land -- attributed list, honest editor reports, size tiers over caps
• c6e26f6 fix the two QA-pass findings: --box row duplication, ^e wrote-with-nothing-to-write
• a1a99d4 grok review round 1 — argv caps, type coercion, verdict tests, stale comments
• db6f6d4 grok review round 2 — the wrapper is executable, the cap counts bytes, sessions survive truncation
• f851cdd opencode wrapper: order-preserving instructions dedupe (jq unique sorts)
• 9cf5c30 qa: v1.2.0 field pass -- grab journey added, findings + lessons updated
• a8d4d3a sweep: no-accretion pass — stale marshaler reference, ARCHITECTURE names the editing surface
• 65187ba tomldoc, configui, editorcmd: review round 1 — three correctness fixes
• 02715a5 tomldoc, configui: grok review — inline-table spans, sources spellings, prose temp leak
• 7f53171 tomldoc, configui: grok round 2 — sibling subtables can't swallow inserts
• bbfcf8e tomldoc: review round 2 — descendant subtables are block content
• b00b49a tomldoc: review round 3 — integer identities normalize to canonical decimal
• 027cd67 tomldoc: style-preserving TOML editor — byre owns the write seam
• 0b65f06 tuitest: WaitFor re-captures after observing death, closing the fast-exit race
• 8de4bb7 tuitest: config walker counts the Instructions row
• d5fae76 wip: fold both reviewers' audit findings in; verify the SharedAuth save corruption
• 9ec98b4 wrappers: whole-argument byte budget; UTF-8-clean truncation (codex round 2)

v1.2.0

Changelog

• 97802fa CHANGES: date v1.2.0 -- grab, engine-switch single-session, shared-daemon shell, mount/seed containment
• 0e76881 Merge branch 'byre-grab'
• 8752e4e Merge branch 'fix/grab-picker-wording'
• b5d341e TODO: warn on empty env_from_host resolution (git identity dead end, 2026-07-20)
• 32e6ecb adr 0041: block-shape rationale reads historically post-0042 (codereview)
• 8b58661 agent context announces the base image and the enforced egress allowlist
• a0d2167 build: agent context announces config-provisioned packages
• 895d292 build: resolve the security guard's staged sources from the posture skill only, not a global last-wins map
• 6979724 codereview: announce the effective base; firewall pointer degrades outside byre
• 3954d6a develop/rebuild: recheck enrollment under the setup lock so a concurrent forget can't be resurrected
• af6a648 develop: keep an inconclusively-checked engine unresolved in the record
• 66f5bff develop: neutral wording for a vanished implicated engine
• 29b563d develop: record the #8 unreachable-engine ruling (skip-and-disclose, not fail-closed)
• c864355 develop: refuse a competing session on another engine after an engine switch (ADR 0004)
• e04910a develop: scope the cross-engine check with a per-worktree engine record (#4 ruling)
• 5c40e70 diary + docs: grab session notes, DELIVER.md dash style
• d4d5319 gen: skill apt hoists above the skill blocks (ADR 0042)
• 6983b33 gen: skill blocks emit in provenance order for layer-cache locality (ADR 0041)
• caae04e grab: anchor the destination swap-safely via hostopen (codereview finding 1)
• 7e2809c grab: byre grab [] — deliver's mirror
• 64301bc grab: picker says 'grab from', and the engine-skip note stops crying wolf
• 229e589 grab: stream enumeration through a bounded sink so a hostile tree can't OOM host byre
• 0386dc5 grab: truncation message names both limits (entries and bytes), not just entries
• 6068af4 grok test: neutralize GROK_AUTH_PROVIDER_COMMAND leaking from the suite box
• 81ab418 inttest doc: the bridge-forward bind warning is harmless on newer Lima
• f8391fe inttest: DinD runner for hosts that can't nest VMs, and a stale-manifest pin
• 6aa1c6b inttest: bridge-reachable VM for native-Linux docker, v6-only-host runbook
• f87d0d8 inttest: re-pack skill manifest — payload digests were stale
• 241d677 inttest: the printed native-linux remedy names the bridge endpoint (codereview)
• 23828d0 inttest: wrapper header + box context align on the bridge endpoint (codereview)
• 352c3de mount/seed: classify containment canonically so an alias spelling of the root can't bypass the guard
• 770dbf4 mount/seed: clean the host source once in expandHostPath so check and engine share one spelling
• 204d975 mount/seed: compare identity along resolved ancestor chains, not against the root alone
• 7277382 mount/seed: judge tree containment by file identity, not spelling; shell: honest refusal when the rootless probe fails
• 99f8566 mount/seed: refuse an in-tree source that a symlink retargets outside the project
• 4de00b5 preset: pin codereview 1.0.1 (repo tag v1.0.2) -- codex reviewer unsandboxed
• 7b52d4e self-edit doc: define byre.preset and env_from_host
• 19964b6 selfedit: name which config side was unreadable in the cannot-diff notice
• 9d1f83e selfedit: read the store through hostopen so a planted FIFO/device can't hang or OOM the exit report
• b4414e1 shell: count only enterable boxes in the multi-match disclosure
• 54bffb8 shell: hide a session owned by another Unix user on a shared rootful daemon (mirror deliver/grab)
• 2e3f3d7 status/develop: warn + degrade the network claim when a mount/volume covers a chassis security path
• 1c66317 test: gated grab integration leg against a live box
• 1ef8963 worktree: derive the toplevel structurally so core.worktree can't retarget onto an unrelated host repo