v0.32.0

Added

• Layered settings cascade — host-shared defaults agents inherit and override
  (ADR 0047). Settings now resolve App → Host → Agent per field. A new Host
  defaults tab sets box-shared defaults — model/gateway, routing, prompt-cache,
  telemetry, org branding — that every agent on the machine inherits; each agent
  overrides any of them in its own settings (git-style: nearest layer wins), with
  "inherited from Host" / "overridden here" badges and one-click Reset to
  inherited. The shared layer lives in host-config.yaml (per-hub, scope_leaf'd);
  secrets stay agent-local (never written to the host file). No migration: with no
  host file the cascade is byte-identical to the old single-config behavior.
  (#833/#836/#838/#846/#847/#848/#849)
• Remote fleet members — the agent there, the UI here (ADR 0042 §I). Register any
  reachable protoAgent by URL (Discover → Add to this fleet, or
  POST /api/fleet/remotes) and it becomes a switchable member: a slug window like a
  local peer, console + A2A reverse-proxied through the hub, with the remote's bearer
  attached server-side. Run agents fully headless on other machines and operate them
  all from one console. (#839)
• Tenant guard — when a different backend reuses this console's address (a port
  handed between agents), the previous tenant's persisted chat view is dropped (one
  reload + a toast) instead of rendering another agent's transcripts. Same-agent
  restarts/upgrades never trip it. (#831)
• Tailnet discovery — fleet discovery gains a third channel: online Tailscale
  peers (via the local tailscale CLI) are probed for agent-cards over the fleet port
  range, since mDNS multicast never crosses a WireGuard overlay. All three channels
  (local scan, mDNS, tailnet) now scan concurrently. (#816)
• Co-located-instance warning — every server drops a heartbeat in its data root;
  when a LIVE sibling shares the same root (two unscoped instances, or two with the
  same PROTOAGENT_INSTANCE), both consoles banner it and the boot log warns — they
  can clobber each other's chat history, knowledge and stores. (#818)
• Cross-agent "turn finished" toasts — leave a turn running on one agent, switch
  windows, and get a toast (+ a native notification when the window is hidden) the
  moment it completes. The shell watches the other agents' in-flight turns and polls
  their durable tasks through the hub proxy. (#827)
• Opaque agent ids + rename — fleet agents get a stable, opaque id at create
  (ava-4e8e) that keys the workspace, the window URL and the data scope; the name
  is now an editable display label (pencil-rename in the fleet manager,
  PATCH /api/fleet/{agent}). Renames never move storage or break open windows. (#823)
• Enable delegates without a restart — plugin routes now hot-mount on a config
  reload, so enabling a route-bearing plugin (e.g. delegates on the host) takes
  effect immediately; the fleet manager turns the old "needs a restart" dead-end into
  a one-click Enable delegates on this agent that retries the add. (#822)
• Cold agents resume on navigation — opening a stopped agent's window now
  activates it (resume from checkpoint + keep-N-warm touch) instead of hitting a dead
  proxy. (#819)

Fixed

• Discover no longer lists a co-located agent twice — its mDNS advert (LAN IP) now
  collapses with the local-scan hit (loopback), and a fleet peer's own advert no longer
  reappears as "discovered". (#837)
• mDNS advertise actually works — Zeroconf.register_service was called on the
  event loop and deadlocked it: a ~10s stall at every boot, then a swallowed failure,
  so no agent had ever advertised since the feature shipped. Now runs off-loop,
  with a guard that refuses (loudly) instead of stalling. (#815)
• A2A task reconcile had rotted against a2a-sdk 1.1 — the chat self-heal and
  cancel used the 0.3 method names (tasks/get/tasks/cancel → Method not found),
  which made an interrupted turn finalize instantly even while still running on the
  server. Fixed to the 1.0 wire (GetTask/CancelTask + A2A-Version header); the
  e2e mock now mirrors the real wire and rejects the legacy names so this class of
  rot can't pass CI again. (#827)
• Each fleet hub owns its own registry — ~/.protoagent/workspaces (and
  fleet.json) is now instance-scoped like every other store, so two co-located
  instances no longer manage/evict each other's agents, and a peer can no longer see
  or stop its parent hub's fleet. (#813)

Changed

• pyproject.toml is the dependency source of truth — runtime deps moved into
  [project.dependencies] / [project.optional-dependencies], so uv sync and
  pip install -e .[ui,google] both just work; requirements-*.txt are kept as
  readable, tier-scoped references that mirror it. (#811)
• Config is a single source of truth — config_to_dict is now driven by the
  settings-schema FIELDS registry (it had silently drifted, dropping 27 fields),
  with a from_dict parse seam and a drift guard; adding a setting is now one
  Field declaration that flows to parse, serialize, and the UI. (#833/#836/#838)
• Shell + settings banners are the design system's Alert — both hand-rolled
  banner implementations replaced by @protolabsai/ui Alert; the genuinely missing
  inline-rename control is filed upstream instead (protoContent#195), per the
  contribute-back loop now recorded in docs/design/ui-component-audit.md. (#825, #827)

Removed

• Retired the deprecated peer_consult / peer_list tools from the core
  toolset. delegate_to over the unified delegate registry (ADR 0025,
  plugins/delegates) has been the federation path since v0.16.0 — it does A2A
  consult alongside openai/acp delegates behind one tool with a console panel.
  The env-var PEER_<HANDLE>_URL tools are gone; the a2a adapter retains the
  shared A2A response parse helpers (tools/peer_tools.py).