v1.2.9

Changelog

All notable changes to armada are documented in this file. The format follows
Keep a Changelog, and this project
adheres to Semantic Versioning.

Features

• add armada models --discounts flag to inspect live OpenRouter provider pricing and discounts (#167)
• add openrouter provider routing preference and real-time endpoint pricing API helper (v1.2.8) (#166)
• bump version to 1.2.7 - execution-only subagent architecture & task spec template (#165)

Bug Fixes

• voyage-handoff uses correct tmux session names; reject voyage- prefixed feature names (#169)
• doc/about links use master (default branch); harden smokes against branch drift (#158)

Chores

• bump to v1.2.9 (#171)

Docs

• log voyage-handoff fix (#169) (#170)
• add OpenRouter discounted models and provider ordering guide (#168)
• update logo file path to docs/logo-v2.png to guarantee fresh rendering on GitHub (#164)
• add cache buster to logo image URL for GitHub proxy (#163)
• overhaul README with loop engineering positioning, clean docs, update logo, and expand topics (#162)
• restore brand voice, workflow.png, setup steps, contract co-writing (#161)
• gateway rewrite — lead with the loop, point to website for depth (#160)
• lean rewrite, fix broken site image, clarify site is informational (#159)
• log web polish voyage #155 (#156)

Features

• add armada models --discounts flag to inspect live OpenRouter provider pricing and discounts (#167)
• add openrouter provider routing preference and real-time endpoint pricing API helper (v1.2.8) (#166)
• bump version to 1.2.7 - execution-only subagent architecture & task spec template (#165)

Bug Fixes

• voyage-handoff uses correct tmux session names; reject voyage- prefixed feature names (#169)
• doc/about links use master (default branch); harden smokes against branch drift (#158)

Docs

• log voyage-handoff fix (#169) (#170)
• add OpenRouter discounted models and provider ordering guide (#168)
• update logo file path to docs/logo-v2.png to guarantee fresh rendering on GitHub (#164)
• add cache buster to logo image URL for GitHub proxy (#163)
• overhaul README with loop engineering positioning, clean docs, update logo, and expand topics (#162)
• restore brand voice, workflow.png, setup steps, contract co-writing (#161)
• gateway rewrite — lead with the loop, point to website for depth (#160)
• lean rewrite, fix broken site image, clarify site is informational (#159)
• log web polish voyage #155 (#156)

[1.2.6] - 2026-08-09

Fixed

• Voyage sandbox lanes now automatically initialize in autopilot mode (yolo: true) since the contract has already been created/approved for that sandbox, avoiding interactive bash permission prompts while keeping strict subagent edit role boundaries.
• Main Commodore orchestrator base permissions now auto-allow read-only inspection commands (ls*, cat*, find*, pwd, read*, echo*, git branch*, git rev-parse*) by default.

[1.2.5] - 2026-08-09

Fixed

• Existing live contracts (armada/REQUIREMENTS.md or configured requirementsFile) are now preserved and copied from main checkout into sandbox worktrees during voyage creation instead of being overwritten by empty stub templates.
• Added fallback contract synchronization for voyages launched without an active contract-approval.json gate.

[1.2.4] - 2026-08-09

Fixed

• Voyage lanes now re-scaffold Armada-owned files from the main manifest, ensuring .opencode/agent/commodore.md and related skills exist even when initial armada new files were not committed.

[1.2.3] - 2026-08-09

Fixed

• Voyages now create and use canonical sandbox/<name>/armada/REQUIREMENTS.md contracts instead of leaving only an unused armada/contracts/<name>.md placeholder.
• Voyage registry, active state, close flow, and fleet discovery now reference the same canonical contract.

[1.2.2] - 2026-08-09

Fixed

• Custom project.requirementsFile contracts now flow through approval, hashing, gating, and voyage snapshots without falling back to a generated stub.
• Voyage launch rejects approval state targeting a different configured contract instead of allowing a stale hash path.
• Non-trivial repository changes now explicitly remain voyage work, including source, tests, configuration, and generated artifacts.

[1.2.1] - 2026-08-09

Fixed

• Autonomous net-new multi-file implementation now defaults to voyage flow regardless of project size or low-risk classification.
• "Do it on your own" now removes routine questions without bypassing contract approval, safety gates, or automatic voyage launch.
• Main Commodore no longer treats unavailable background dispatch as permission to implement voyage work in the main checkout.

Features

• Deprecated feature new/list/close/status; use voyage , voyage list, voyage close (removed in 2.0)
• live contract snapshot, approval gate, hardened permissions (#134)

Chores

• log contract-snapshot-permissions voyage #134 (#135)
• compact completed entries + log v1.0.5 + queue DEF-003 fix (#133)

Features

• single triage authority + consistency audit + regression suite (#131)
• single triage authority + consistency audit + regression suite
• armada-voyage-finish skill + armada release command (#130)
• add armada-voyage-finish
• add release-command module

Bug Fixes

• remove armada/armada.yaml from git add list
• survive CI without committed armada.yaml or opencode.json
• survive CI without .opencode/ on disk
• re-render AGENTS.md from armada.yaml after rebase onto master

Chores

• sync master with origin
• PR-number fix for F1/F5 + voyage summary (#130)
• AGENTS.md voyage header re-title

Docs

• Path C — armada release
• F5 release-command entry

Tests

• release-command unit tests with mocked injection
• voyage-finish registry + scaffold e2e

[Unreleased]

Removed

• Removed armada reconcile (alias for resume) and armada feature status (was deprecated in v1.0; use armada status --feature <name>).

Changed

• CI: drop armada-evidence workflow; require Node >= 22 (was >= 20).

Added

• feat(triage): canonical voyage-vs-in-window + voyage-splitting doctrine (docs/process/triage.md, new). In-window first, voyage by exception; risk-classified single-file fixes (no blanket in-window over trust boundaries); three-part independence test for splitting a broad request into separate voyages; loop-free decision tree. Every triage statement in AGENTS.md, the orchestrator prompt, .opencode/commands/, and docs now cites the canon — no restated policy.
• feat(audit): holistic six-surface consistency audit (docs/process/consistency-audit.md, new). Source instructions, generated artifacts vs manifest, docs, command docs, permissions, tests — 21 findings (F01-F21), zero "not checked" rows, all dispositioned. Restored 5 formerly-missing docs + docs/stability/ (14+ dead refs re-pointed).
• feat(regression): tests/regression-triage.test.js — automated guards for triage canon, doc-link integrity, artifact consistency (yaml ↔ rendered opencode.json ↔ agent frontmatter ↔ BASE_PERMISSIONS ↔ DEFAULT_PLAYBOOK), PR-first/no-clobber/round-trip invariants, stale-term and phantom slash-command greps.
• feat(permissions): hardened ledger + state boundaries in buildTeam() — ledger edit globs derived from DEFAULT_PLAYBOOK (custom ledger paths stay writable by their owners); dev roles explicitly deny every ledger kind + the ledgers dir; orchestrator's armada/state/active.json reads reconciled (no phantom fleet-status.md); default_agent semantic equality (commodore → orchestrator); phantom /armada-status//armada-fleet refs removed.

Changed

• Orchestrator prompt hard rule 5 + "Voyage launch" defer to docs/process/triage.md as the sole triage authority and carry the split-broad-task rule.
• AGENTS.md, CONTRIBUTING.md, docs/contributor-guide.md link the triage canon instead of restating policy.
• CLI entry one-liner in AGENTS.md drops removed ping; README command table aligned to the 14 active commands + --version.

Fixed

• Four contract-named docs missing (restored), docs/stability/ directory missing (restored), docs/self-improvement.md missing (restored) — repo-wide dead-link grep now returns zero.
• Stale src/cli.js file:line refs in operator-guide/contributor-guide; undocumented resume/reconcile exit 2; stale README/operator-guide command counts; TODO /armada-status claim.

Security

• Docs-align safe-bash overlay: the SAFE_BASH read tier excludes content-emitters/write dumps (cat, echo, head, tail, env, printenv had been listed as safe-read in prose) so shell-redirect/pipe exfiltration (cat .env > leak / cat .env | curl) prompts rather than executing.
• Permission docs corrected to the real resolution model: bash/rule lookup is order / last-match, not most-specific-first — SAFE_BASH merges first in buildTeam() so the agent's appended rules override on top.
• --yolo grants bash: "*" allow to orchestrator + qa only; read-only roles (security, adversary, architect, docs) stay bash-restricted under yolo. --headless is scoped: it narrows only the orchestrator's bash to git + read-only inspection, never a blanket allow. external_directory: "deny" remains in both modes.

[1.0.4] - 2026-08-07

Added

• feat(orchestrator): tighten no-trivial exception + 4-path permission matrix (#126). Hard rule + permission-boundary check guard the orchestrator against trivial delegation.
• feat(voyage): prefix tmux session names with voyage- (#127). Default armada voyage tmux sessions are now easy to spot in tmux ls. Explicit --name <text> bypasses the prefix.
• feat: safe-bash defaults for harmless commands (#128). Tiered SAFE_BASH allowlist merged first in buildTeam(): re...

v1.2.6

What's Changed

• fix: auto-configure yolo autopilot mode on sandbox lane manifests by @rafmacalaba in #154

Full Changelog: v1.2.5...v1.2.6

v1.2.5

What's Changed

• feat(voyage): separate main and lane orchestration by @rafmacalaba in #146
• fix: make autonomous multi-file work launch voyages by @rafmacalaba in #147
• feat(landing-page): Vite+React+TS site, Landing + About, GH Pages deploy by @rafmacalaba in #148
• docs(todo): log landing-page voyage #148 by @rafmacalaba in #149
• fix: honor custom voyage contract paths by @rafmacalaba in #150
• fix: create canonical voyage contract by @rafmacalaba in #151
• fix: scaffold voyage lane agents by @rafmacalaba in #152
• fix: propagate live contract to sandbox worktree by @rafmacalaba in #153

Full Changelog: v1.1.1...v1.2.5

v1.1.1

What's Changed

• revert: v1.0.3 permissions baseline (v1.0.7) by @rafmacalaba in #137
• fix(perms): restore 6 orchestrator state-flow allows (v1.0.8) by @rafmacalaba in #138
• feat: auto git init on armada new + clear non-git errors by @rafmacalaba in #139
• chore(ci): drop armada-evidence, bump to Node 24, engines >=22 by @rafmacalaba in #140
• test(lean): drop drive tests, kill invasive terminals, parallelize CI by @rafmacalaba in #141
• feat: consolidate voyage as the single entry point by @rafmacalaba in #142
• chore: drop reconcile, drop feature status, consolidate models help by @rafmacalaba in #143
• chore(release): v1.1.0 publish prep by @rafmacalaba in #144
• fix(status): null-feature crash in armada status (v1.1.1) by @rafmacalaba in #145

Full Changelog: v1.0.6...v1.1.1

Armada v1.0.6

Changelog

All notable changes to armada are documented in this file. The format follows
Keep a Changelog, and this project
adheres to Semantic Versioning.

Features

• live contract snapshot, approval gate, hardened permissions (#134)

Chores

• log contract-snapshot-permissions voyage #134 (#135)
• compact completed entries + log v1.0.5 + queue DEF-003 fix (#133)

Features

• single triage authority + consistency audit + regression suite (#131)
• single triage authority + consistency audit + regression suite
• armada-voyage-finish skill + armada release command (#130)
• add armada-voyage-finish
• add release-command module

Bug Fixes

• remove armada/armada.yaml from git add list
• survive CI without committed armada.yaml or opencode.json
• survive CI without .opencode/ on disk
• re-render AGENTS.md from armada.yaml after rebase onto master

Chores

• sync master with origin
• PR-number fix for F1/F5 + voyage summary (#130)
• AGENTS.md voyage header re-title

Docs

• Path C — armada release
• F5 release-command entry

Tests

• release-command unit tests with mocked injection
• voyage-finish registry + scaffold e2e

[Unreleased]

Added

• feat(triage): canonical voyage-vs-in-window + voyage-splitting doctrine (docs/process/triage.md, new). In-window first, voyage by exception; risk-classified single-file fixes (no blanket in-window over trust boundaries); three-part independence test for splitting a broad request into separate voyages; loop-free decision tree. Every triage statement in AGENTS.md, the orchestrator prompt, .opencode/commands/, and docs now cites the canon — no restated policy.
• feat(audit): holistic six-surface consistency audit (docs/process/consistency-audit.md, new). Source instructions, generated artifacts vs manifest, docs, command docs, permissions, tests — 21 findings (F01-F21), zero "not checked" rows, all dispositioned. Restored 5 formerly-missing docs + docs/stability/ (14+ dead refs re-pointed).
• feat(regression): tests/regression-triage.test.js — automated guards for triage canon, doc-link integrity, artifact consistency (yaml ↔ rendered opencode.json ↔ agent frontmatter ↔ BASE_PERMISSIONS ↔ DEFAULT_PLAYBOOK), PR-first/no-clobber/round-trip invariants, stale-term and phantom slash-command greps.
• feat(permissions): hardened ledger + state boundaries in buildTeam() — ledger edit globs derived from DEFAULT_PLAYBOOK (custom ledger paths stay writable by their owners); dev roles explicitly deny every ledger kind + the ledgers dir; orchestrator's armada/state/active.json reads reconciled (no phantom fleet-status.md); default_agent semantic equality (commodore → orchestrator); phantom /armada-status//armada-fleet refs removed.

Changed

• Orchestrator prompt hard rule 5 + "Voyage launch" defer to docs/process/triage.md as the sole triage authority and carry the split-broad-task rule.
• AGENTS.md, CONTRIBUTING.md, docs/contributor-guide.md link the triage canon instead of restating policy.
• CLI entry one-liner in AGENTS.md drops removed ping; README command table aligned to the 14 active commands + --version.

Fixed

• Four contract-named docs missing (restored), docs/stability/ directory missing (restored), docs/self-improvement.md missing (restored) — repo-wide dead-link grep now returns zero.
• Stale src/cli.js file:line refs in operator-guide/contributor-guide; undocumented resume/reconcile exit 2; stale README/operator-guide command counts; TODO /armada-status claim.

Security

• Docs-align safe-bash overlay: the SAFE_BASH read tier excludes content-emitters/write dumps (cat, echo, head, tail, env, printenv had been listed as safe-read in prose) so shell-redirect/pipe exfiltration (cat .env > leak / cat .env | curl) prompts rather than executing.
• Permission docs corrected to the real resolution model: bash/rule lookup is order / last-match, not most-specific-first — SAFE_BASH merges first in buildTeam() so the agent's appended rules override on top.
• --yolo grants bash: "*" allow to orchestrator + qa only; read-only roles (security, adversary, architect, docs) stay bash-restricted under yolo. --headless is scoped: it narrows only the orchestrator's bash to git + read-only inspection, never a blanket allow. external_directory: "deny" remains in both modes.

1.0.4 - 2026-08-07

Added

• feat(orchestrator): tighten no-trivial exception + 4-path permission matrix (#126). Hard rule + permission-boundary check guard the orchestrator against trivial delegation.
• feat(voyage): prefix tmux session names with voyage- (#127). Default armada voyage tmux sessions are now easy to spot in tmux ls. Explicit --name <text> bypasses the prefix.
• feat: safe-bash defaults for harmless commands (#128). Tiered SAFE_BASH allowlist merged first in buildTeam(): read-only commands (ls, cat, grep, git status, ...) allowed for every role; write commands only for dev roles. Yolo still flattens to *.
• feat(attach-auto-spawn): tryAttachOrPrint helper + auto-attach tmux fallback (#129). armada voyage attach <name> reattaches to a running tmux session; auto-attach falls back when an active session exists.
• fix(voyage-cwd): absolute path in default prompt + lane cwd (#125). armada/REQUIREMENTS.md paths in the default drive prompt are absolute; tmux new-session -c <absLane> puts the team in the worktree.
• fix(questionnaire): strict custom model id format validation (#123, follow-up #124). pickModel whitelists opencode-go/zen/<m> and openrouter/<owner>/<m>; everything else re-prompts. Closes the parseInt-greediness gap and rejects bare catalog prefixes.
• fix(cli): complete 1.0.4 version bump in src/cli.js:62 (#124). tests/cli.test.js:713 now reads expected version from package.json (mirrors tests/version-flag.test.js:8), so future bumps don't require a test edit.
• infra: .devcontainer/ (this release). typescript-node:24 + Chromium + agent-browser + opencode skill — reproducible workspace for QA/adversary e2e work.

Changed

• src/cli.js:62 reads version from package.json (was hardcoded to 1.0.3).
• Default voyage tmux session name format changed: <laneBasename> -> voyage-<laneBasename>.
• tests/version-flag.test.js and tests/cli.test.js now source the expected version from package.json.

Fixed

• --requirements orchestrator trivial-delegation exception path tightened.
• pickModel no longer silently accepts arbitrary input via parseInt greediness.
• armada voyage now boots into the worktree cwd (was relative path).

Security

• SAFE_BASH allowlist (read-only everywhere, write only for dev roles) closes the all-roles-write-bash exposure that yolo previously flattened.

Test Evidence

• 491/491 unit + CLI e2e tests pass.
• macos + ubuntu × node 20 + 22 CI green (per #124/#126/#128 merge logs).
• Manual node:sqlite session archaeology on the 100 most recent sessions confirmed the 7 voyage features landed without new defects introduced.

v1.0.5

Changelog

All notable changes to armada are documented in this file. The format follows
Keep a Changelog, and this project
adheres to Semantic Versioning.

Features

• single triage authority + consistency audit + regression suite (#131)
• single triage authority + consistency audit + regression suite
• armada-voyage-finish skill + armada release command (#130)
• add armada-voyage-finish
• add release-command module

Bug Fixes

• survive CI without committed armada.yaml or opencode.json
• survive CI without .opencode/ on disk
• re-render AGENTS.md from armada.yaml after rebase onto master

Chores

• sync master with origin
• PR-number fix for F1/F5 + voyage summary (#130)
• AGENTS.md voyage header re-title

Docs

• Path C — armada release
• F5 release-command entry

Tests

• release-command unit tests with mocked injection
• voyage-finish registry + scaffold e2e

Features

• single triage authority + consistency audit + regression suite (#131)
• single triage authority + consistency audit + regression suite
• armada-voyage-finish skill + armada release command (#130)
• add armada-voyage-finish
• add release-command module

Bug Fixes

• remove armada/armada.yaml from git add list
• survive CI without committed armada.yaml or opencode.json
• survive CI without .opencode/ on disk
• re-render AGENTS.md from armada.yaml after rebase onto master

Chores

• sync master with origin
• PR-number fix for F1/F5 + voyage summary (#130)
• AGENTS.md voyage header re-title

Docs

• Path C — armada release
• F5 release-command entry

Tests

• release-command unit tests with mocked injection
• voyage-finish registry + scaffold e2e

[Unreleased]

Added

• feat(triage): canonical voyage-vs-in-window + voyage-splitting doctrine (docs/process/triage.md, new). In-window first, voyage by exception; risk-classified single-file fixes (no blanket in-window over trust boundaries); three-part independence test for splitting a broad request into separate voyages; loop-free decision tree. Every triage statement in AGENTS.md, the orchestrator prompt, .opencode/commands/, and docs now cites the canon — no restated policy.
• feat(audit): holistic six-surface consistency audit (docs/process/consistency-audit.md, new). Source instructions, generated artifacts vs manifest, docs, command docs, permissions, tests — 21 findings (F01-F21), zero "not checked" rows, all dispositioned. Restored 5 formerly-missing docs + docs/stability/ (14+ dead refs re-pointed).
• feat(regression): tests/regression-triage.test.js — automated guards for triage canon, doc-link integrity, artifact consistency (yaml ↔ rendered opencode.json ↔ agent frontmatter ↔ BASE_PERMISSIONS ↔ DEFAULT_PLAYBOOK), PR-first/no-clobber/round-trip invariants, stale-term and phantom slash-command greps.
• feat(permissions): hardened ledger + state boundaries in buildTeam() — ledger edit globs derived from DEFAULT_PLAYBOOK (custom ledger paths stay writable by their owners); dev roles explicitly deny every ledger kind + the ledgers dir; orchestrator's armada/state/active.json reads reconciled (no phantom fleet-status.md); default_agent semantic equality (commodore → orchestrator); phantom /armada-status//armada-fleet refs removed.

Changed

• Orchestrator prompt hard rule 5 + "Voyage launch" defer to docs/process/triage.md as the sole triage authority and carry the split-broad-task rule.
• AGENTS.md, CONTRIBUTING.md, docs/contributor-guide.md link the triage canon instead of restating policy.
• CLI entry one-liner in AGENTS.md drops removed ping; README command table aligned to the 14 active commands + --version.

Fixed

• Four contract-named docs missing (restored), docs/stability/ directory missing (restored), docs/self-improvement.md missing (restored) — repo-wide dead-link grep now returns zero.
• Stale src/cli.js file:line refs in operator-guide/contributor-guide; undocumented resume/reconcile exit 2; stale README/operator-guide command counts; TODO /armada-status claim.

Security

• Docs-align safe-bash overlay: the SAFE_BASH read tier excludes content-emitters/write dumps (cat, echo, head, tail, env, printenv had been listed as safe-read in prose) so shell-redirect/pipe exfiltration (cat .env > leak / cat .env | curl) prompts rather than executing.
• Permission docs corrected to the real resolution model: bash/rule lookup is order / last-match, not most-specific-first — SAFE_BASH merges first in buildTeam() so the agent's appended rules override on top.
• --yolo grants bash: "*" allow to orchestrator + qa only; read-only roles (security, adversary, architect, docs) stay bash-restricted under yolo. --headless is scoped: it narrows only the orchestrator's bash to git + read-only inspection, never a blanket allow. external_directory: "deny" remains in both modes.

1.0.4 - 2026-08-07

Added

• feat(orchestrator): tighten no-trivial exception + 4-path permission matrix (#126). Hard rule + permission-boundary check guard the orchestrator against trivial delegation.
• feat(voyage): prefix tmux session names with voyage- (#127). Default armada voyage tmux sessions are now easy to spot in tmux ls. Explicit --name <text> bypasses the prefix.
• feat: safe-bash defaults for harmless commands (#128). Tiered SAFE_BASH allowlist merged first in buildTeam(): read-only commands (ls, cat, grep, git status, ...) allowed for every role; write commands only for dev roles. Yolo still flattens to *.
• feat(attach-auto-spawn): tryAttachOrPrint helper + auto-attach tmux fallback (#129). armada voyage attach <name> reattaches to a running tmux session; auto-attach falls back when an active session exists.
• fix(voyage-cwd): absolute path in default prompt + lane cwd (#125). armada/REQUIREMENTS.md paths in the default drive prompt are absolute; tmux new-session -c <absLane> puts the team in the worktree.
• fix(questionnaire): strict custom model id format validation (#123, follow-up #124). pickModel whitelists opencode-go/zen/<m> and openrouter/<owner>/<m>; everything else re-prompts. Closes the parseInt-greediness gap and rejects bare catalog prefixes.
• fix(cli): complete 1.0.4 version bump in src/cli.js:62 (#124). tests/cli.test.js:713 now reads expected version from package.json (mirrors tests/version-flag.test.js:8), so future bumps don't require a test edit.
• infra: .devcontainer/ (this release). typescript-node:24 + Chromium + agent-browser + opencode skill — reproducible workspace for QA/adversary e2e work.

Changed

• src/cli.js:62 reads version from package.json (was hardcoded to 1.0.3).
• Default voyage tmux session name format changed: <laneBasename> -> voyage-<laneBasename>.
• tests/version-flag.test.js and tests/cli.test.js now source the expected version from package.json.

Fixed

• --requirements orchestrator trivial-delegation exception path tightened.
• pickModel no longer silently accepts arbitrary input via parseInt greediness.
• armada voyage now boots into the worktree cwd (was relative path).

Security

• SAFE_BASH allowlist (read-only everywhere, write only for dev roles) closes the all-roles-write-bash exposure that yolo previously flattened.

Test Evidence

• 491/491 unit + CLI e2e tests pass.
• macos + ubuntu × node 20 + 22 CI green (per #124/#126/#128 merge logs).
• Manual node:sqlite session archaeology on the 100 most recent sessions confirmed the 7 voyage features landed without new defects introduced.

What's Changed

• docs(readme): clarify package install and updates by @rafmacalaba in #119
• docs: restore README product narrative by @rafmacalaba in #120
• chore: untrack generated armada ledgers by @rafmacalaba in #121
• fix(questionnaire): accept custom model IDs in pickModel by @rafmacalaba in #123
• chore(release): bump to 1.0.4 by @rafmacalaba in #124
• fix(voyage-cwd): absolute path in default prompt + lane cwd by @rafmacalaba in #125
• feat(orchestrator): tighten no-trivial exception + 4-path permission matrix by @rafmacalaba in #126
• feat: prefix tmux session names with voyage- by @rafmacalaba in #127
• feat: safe-bash defaults for harmless commands by @rafmacalaba in #128
• feat(attach-auto-spawn): tryAttachOrPrint helper — voyage attach and auto-attach tmux fallback by @rafmacalaba in #129
• feat: armada-voyage-finish skill + armada release command by @rafmacalaba in #130
• feat(triage): single triage authority + consistency audit + regression suite by @rafmacalaba in #131
• release 1.0.5 by @rafmacalaba in #132

Full Changelog: v1.0.3...v1.0.5

v1.0.4

Highlights

• Safe-bash defaults (#128) — tiered allowlist closes the all-roles-write-bash exposure
• attach-auto-spawn (#129) — armada voyage attach <name> + auto-attach tmux fallback
• Permission matrix (#126) — orchestrator no-trivial + 4-path permission enforcement
• voyage- tmux prefix (#127) — sessions easy to spot in tmux ls
• Absolute voyage-cwd (#125) — drive prompt + tmux new-session -c now absolute
• Strict pickModel (#123) — custom model format whitelisted, no parseInt-greedy fallback
• .devcontainer/ — typescript-node:24 + Chromium + agent-browser, reproducible workspace

Test evidence

• 491/491 unit + CLI e2e pass
• macos + ubuntu × node 20 + 22 CI green
• Manual node:sqlite session archaeology on 100 most recent sessions — no regressions introduced

Install

npm install -g @rafamacalaba/armada

See CHANGELOG.md for the full per-PR breakdown.

What's Changed

• docs(readme): clarify package install and updates by @rafmacalaba in #119
• docs: restore README product narrative by @rafmacalaba in #120
• chore: untrack generated armada ledgers by @rafmacalaba in #121
• fix(questionnaire): accept custom model IDs in pickModel by @rafmacalaba in #123
• chore(release): bump to 1.0.4 by @rafmacalaba in #124
• fix(voyage-cwd): absolute path in default prompt + lane cwd by @rafmacalaba in #125
• feat(orchestrator): tighten no-trivial exception + 4-path permission matrix by @rafmacalaba in #126
• feat: prefix tmux session names with voyage- by @rafmacalaba in #127
• feat: safe-bash defaults for harmless commands by @rafmacalaba in #128
• feat(attach-auto-spawn): tryAttachOrPrint helper — voyage attach and auto-attach tmux fallback by @rafmacalaba in #129

Full Changelog: v1.0.3...v1.0.4

armada v1.0.3

Release 1.0.3 — bump from 1.0.2.

Since 1.0.2

• #114 docs(operator-guide): model/provider reload semantics
• #115 feat(shipnames): TUI task-description prefix plugin (default-on, opt-out)
• #116 feat(fleet): discover subcommand for orphan worktrees
• #117 chore(tests): prune dead/stale/duplicate tests (510→382)

What's Changed

• docs(todo): log v1.0.1 patch release by @rafmacalaba in #110
• feat(new): own templates, questionnaire, blank option by @rafmacalaba in #111
• feat(workflow): add adaptive voyage gates by @rafmacalaba in #112
• chore(release): bump to 1.0.2 by @rafmacalaba in #113
• docs(operator-guide): model/provider reload semantics by @rafmacalaba in #114
• feat(shipnames): TUI task-description prefix plugin (default-on, opt-out) by @rafmacalaba in #115
• feat(fleet): add discover subcommand for orphan worktrees by @rafmacalaba in #116
• chore(tests): prune dead/stale/duplicate tests (510→382) by @rafmacalaba in #117
• chore(release): bump to 1.0.3 by @rafmacalaba in #118

Full Changelog: v1.0.1...v1.0.3

armada v1.0.1

Summary

Patch release. Re-publishes the corrected files from the GitHub repo rename so the published npm tarball matches origin HEAD.

What changed

• All opencode-armada references updated to armada across package.json, docs/, AGENTS.md, LICENSE, SPEC.md, template/, scaffold test, TODO release log
• npm package is @rafmacalaba/armada (already renamed in v1.0.0)
• Version bump: 1.0.0 → 1.0.1

Why a patch

v1.0.0's published tarball still had the old GitHub repo URLs. GitHub auto-redirects the repo link, but the issues link 404s. v1.0.1 ships the corrected files.

Install

```bash
npm install -g @rafmacalaba/armada
```

Verify

```bash
armada --version # armada v1.0.1
```

Full diff: v1.0.0...v1.0.1

What's Changed

• chore: post-merge remediation — wire state layer + consolidate tests + fix .gitignore by @rafmacalaba in #104
• chore(lean): public release — strip voyage artifacts, drop starter, slim tests, add cookiecutter by @rafmacalaba in #105
• chore(npm): enumerate files explicitly — drop docs/superpowers/ from tarball by @rafmacalaba in #106
• chore(github): rename repo to armada by @rafmacalaba in #107
• docs(todo): log github-rename #107 by @rafmacalaba in #108
• chore(release): bump to 1.0.1 by @rafmacalaba in #109

Full Changelog: v1.0.0...v1.0.1

v1.0.0 — public-stability

armada v1.0.0 — public-stable

First public release of opencode-armada, renamed to armada (PR #100) and stabilized for daily use by external users (PR #101).

Install

npm install -g armada
# or
npx armada

What's in this release

• Renamed to armada (was opencode-armada)
• Node >= 20 required; explicit early-exit on older versions
• Opencode >= 1.18.0 supported; explicit version check
• CI matrix on macOS + Linux × Node 20 + 22 (see .github/workflows/armada-evidence.yml)
• 8 specialist agents with SDK-enforced role boundaries
• Evidence-gated phase delivery with restart-proof state
• Isolated git worktree docks (sandbox/<feature>/) — main checkout untouched
• 22 e2e acceptance tests under armada/e2e/public-stability/
• 646 unit/integration tests, all green

Phases shipped (7 total, ~42 commits on the lane)

Phase	Summary
P0	Current-truth + setup/lifecycle baseline (evidence only)
P1	Setup safety + deduplication (6 backend fixes + hotfix)
P2	Runtime/provider compatibility (Node, Opencode, doctor, catalog, CI)
P3	Voyage/worktree/state reliability (atomic + versioned state, isolation, exactly-once resume)
P4	Generated-repo acceptance (packed artifact + 22 e2e tests)
P5	Public docs + release packaging (README 60-second, user/operator/contributor guides, troubleshooting)
P6	Final patrol (5 SEC + 9 ADV triaged, 6 DEFs filed + fixed + closed)

Defects addressed

• DEF-001 (HIGH): armada uninstall -v was destructive (intercepted -h/-v/--version in 6 subcommands)
• DEF-002 (MEDIUM): invalid budget silently fell back to balanced
• DEF-003 (MEDIUM): feature new overwrote existing features without warning
• DEF-004 (MEDIUM): CI actions unpinned (pinned to SHAs + permissions blocks)
• DEF-005 (MEDIUM): dirty-cleanup refusal guard was dead code (wired into uninstall --all)
• DEF-006 (LOW): armada new allowed .. traversal (rejected with clear error)

Known limits

• Linux evidence: collected via CI on ubuntu-latest; no armada new smoke run yet on bare-metal Linux
• armada/state/ modules ship as building blocks; production resume still uses the read-only src/reconcile.js + src/resume-cli.js path
• armada new --help typed as positional is treated as a project name (now rejected with a clear error)

What's Changed

• feat(voyage-handoff-indicator): HANDOFF block after voyage dispatch by @rafmacalaba in #92
• feat(commands): add subtask: true to all /armada* commands by @rafmacalaba in #93
• feat: ux-revamp voyage — CLI prune, docs slim, role keys by @rafmacalaba in #94
• feat(prompts): orchestrator dispatch narration uses shipName [role] by @rafmacalaba in #95
• docs: overhaul README, add fleet logo & workflow artwork, add Meet the Fleet roster by @rafmacalaba in #96
• docs: audit and update TODO.md roadmap status by @rafmacalaba in #97
• docs: clarify global install and npx options in README quickstart by @rafmacalaba in #98
• chore: support both armada and opencode-armada in package.json bin map by @rafmacalaba in #99
• chore: rename package.json name to armada and update repository URLs by @rafmacalaba in #100
• feat: public-stability — opencode-armada v1.0.0 public release by @rafmacalaba in #101
• docs(todo): flip public-stability to shipped (#101) by @rafmacalaba in #102
• chore(release): bump version to 1.0.0 for public release by @rafmacalaba in #103

Full Changelog: v0.9.2...v1.0.0