v0.12.0 — retry policy, stale-while-revalidate, scoped find, safe writes

• One retry policy for every adapter's HTTP path. A 429, a gateway 5xx, a 500 whose body names a query or rate limit (TickTick's exceed_query_limit), a 403 carrying Retry-After or an exhausted rate-limit window (GitHub), and dropped connections are retried with jittered exponential backoff that honors Retry-After and x-ratelimit-reset. TickTick, Notion, GitHub, Airtable and Google ride the same @reneza/ats-core/retry; a plain 4xx returns on the first attempt. Knobs: ATS_HTTP_RETRIES (3; 0 disables), ATS_HTTP_RETRY_BASE_MS, ATS_HTTP_RETRY_MAX_MS.
• Stale-while-revalidate corpus cache. Past the 5-minute TTL, find answers immediately from the stale copy — the result says corpus.stale: true, revalidating: true — while a detached ats cache sync refreshes the cache for the next call. One refresh lease at a time; concurrent calls share it. ATS_CORPUS_STALE_MAX_MS (24h) is the ceiling past which a read refreshes first; ats find … --fresh always refreshes first. ats cache status and ats doctor show stale / servable / revalidating. The TickTick adapter gains bulkFetch() in retrieval shape, so ats cache sync, find, dedup and garden all read the same cache.
• Scoped retrieval: ats find … --project <id|name> / --projects a,b. The corpus is filtered before any branch runs and branches that reach past it (hybrid, native search) are filtered on the way back. A project may be its full id, short id, composite backend:id, or name (leading decorations ignored); a partial name resolves when it names exactly one project, and several matches come back as scope.candidates. The result carries scope: { projects, matched, of }.
• A confidence verdict on every find. confidence: { verdict, reason, branchesRun, topAgreement } reads branch agreement on the top hit: strong (two or more branches agree, or the title is the query), weak (several ran, one found it), moderate (one branch ran), none. --min-sources N is the matching precision gate. The verdict lands in the usage log and the ats agent-setup policy block tells agents to read it before acting.
• Additive updates and compare-and-swap. ats update … --append "…" / --prepend "…" add to the body that is there; --if-match <hash> lands the write only while the body still carries that contentHash (exit 3 otherwise, with the current hash in the message). ats get and ats update return contentHash; a staged compare-and-swap write is re-verified at apply time. The argument parser binds values that begin with a dash when they are not flag-shaped (--append "- 2026-09-05: shipped") and accepts --key=value.
• Idempotent creates. ats create … --if-absent returns the active task that already carries the title in the project instead of creating another; --idempotency-key <k> records what the first call produced — a task, or a staged review item — and a repeat with the same key replays it. Keys age out after ATS_IDEMPOTENCY_TTL_MS (7 days).
• One review gate for every write surface. guardWrite in @reneza/ats-core is the enforcement of intent.approvalRequired, security.approvalRequiredFor and ATS_REVIEW_ALL; the CLI and the MCP server's create_task / update_task both stage through it, so a gated target holds whichever surface an agent uses.
• Zero-result recovery. An empty ats notes find answers { query, count: 0, notes: [], suggestions, hint } with the nearest items from the fused find; an empty ats tasks search carries the same suggestions; a missed ats get names the nearest items in its error. A hit keeps its shape.
• Full provenance in ats kg export --cypher. Every FACT relationship carries status, tValid / tInvalid, confidence, source, proposer, proposal id, ratifier and ratification time, task reference, and — for retracted facts — who retracted it and why. --include-retracted adds the closed facts, so the script is a complete record of what the store believed and when.

v0.11.0 — knowledge graph, reviewed writes, delta sync

• A facts layer: ats kg. Durable subject–predicate–object knowledge beside the tasks, in an embedded append-only log (no graph server). Agents propose facts and retractions; a human ratifies — the only write path — and every fact carries proposer, ratifier, source, and temporal validity. ats kg ask answers with deterministic lexical scoring plus provenance (zero LLM); retraction closes a fact's validity interval instead of deleting it, so "what did we believe then" stays answerable. ats kg export --cypher emits a load script for embedded graph engines (LadybugDB/Kùzu dialect); the store travels with ats state export. Recommended pairing for dedicated graph engines, stated in the README: Graphiti as the graph database server, LadybugDB as the embedded graph database.
• Reviewed writes: approvalRequired is now enforced. A write whose target task declares intent.approvalRequired — or lists the action (or generic write) in security.approvalRequiredFor — stages into a review queue instead of reaching the backend; ATS_REVIEW_ALL=1 gates every write, including creates. ats review list/show/approve/reject/apply runs the queue; applied writes go through the normal adapter path with the approver recorded in the action ledger, so they stay undoable. A failed apply keeps the item approved with its error — never silently lost.
• No silently dropped sources. The remaining paths where a failed source could vanish without reaching warnings now surface: per-project failures inside the composite fallback fetch, a composite child whose native search errors, and TickTick project fetches in the adapter's own corpus loader, search, hybrid keyword pool, and vector sync. The TickTick loader also stops caching a known-partial corpus — previously it cached whatever survived and served the subset as complete for the whole TTL.
• Composite fusion identity is namespaced. Task ids from composite children are prefixed <backend>:<taskId> like project ids, so two backends emitting the same raw id can no longer merge into one fused result. Routing accepts both namespaced and raw ids; ids copied from find output resolve unchanged.
• ats cache sync works for every adapter. Previously it errored unless the adapter shipped its own cache extension, while doctor could report the corpus cache stale with no way to refresh it. The cache subcommands now fall back to Core's corpus cache (status/sync/clear, cron-friendly), and Core gains an optional bulkFetchDelta({cursor, since}) adapter hook: changed tasks apply as whole-item replacements over the prior corpus — never a field merge — with the adapter's cursor persisted for the next round. Backends without a changes API keep the full-refresh path.
• Completed-task history in retrieval. The adapter contract gains optional listCompletedTasks(); ats find --include-completed appends completed items per query (never into the shared cache), each carrying status: 'completed'. TickTick maps its existing completed-tasks support onto the contract; the composite unions children and names the ones that cannot answer; an adapter without the method degrades the result with an explicit warning instead of silently answering from active tasks only.
• Safe under concurrent agents. A shared lock/atomic-write module now guards every state file: the corpus cache is replaced atomically under a lock (a torn cache was previously possible), the action ledger appends under a lock (before-image lines can exceed the size the OS appends atomically), and the whole undo critical section holds the ledger lock so two concurrent undos of the same action can never double-apply against the backend.
• Trust boundaries between backends. Composite children can be marked "trust": "public"; a write routed to a public child is screened against configured redaction patterns and blocked with the matching rule named — never silently stripped — so content picked up from a private backend cannot flow into a public one through ATS unnoticed. Invalid patterns fail loudly at config load.
• Portable state: ats state export|import. The ledger, undo before-images, review queue, event checkpoint and spool, usage log, caches, and index metadata bundle into one JSON document and restore elsewhere. Credentials are never bundled (whitelist), and import writes only to the local known state paths — a crafted bundle cannot redirect a write. Also the persistence answer for ephemeral hosted deployments.
• Hygiene that acts, carefully. ats dedup apply turns a detected duplicate cluster into typed links (supersedes/conflicts-with) and optionally closes the duplicates — through the normal write path, so everything is ledgered, undoable, and review-gated. ats garden sweeps for active tasks untouched past a threshold and prints a per-task archive command; detection only, by design.
• One-command agent onboarding. ats agent-setup emits the CLAUDE.md/AGENTS.md policy block for the current install — active adapter, retrieval-first discipline with degraded-result honesty, the review-gate stop rule, and the facts-layer propose-not-write rule — generated from live configuration so it always matches the machine it runs on.
• Vector backfill drains itself. ats sync vector --all loops rounds of the per-run embedding cap until the backfill is exhausted, stopping on any round without forward progress; a sync that had to skip unreadable projects now says so in its report.

v0.10.1 — Qdrant API-key authentication

• Key-protected Qdrant. The TickTick adapter sends an api-key header when QDRANT_API_KEY is set, so a Qdrant started with QDRANT__SERVICE__API_KEY — which answers 401 on every path except / — is usable rather than apparently absent. The header is scoped to the Qdrant base URL on purpose: the same HTTP helper also calls Ollama, which must never receive the key. With the variable unset, behaviour is unchanged.
• Health checks name the real fault. checkHealth now separates a 401/403 refusal from an unreachable service and points at QDRANT_API_KEY instead of reporting Qdrant not reachable for a service that is up and simply refusing. The old message sent you hunting ports, containers and firewall rules while retrieval quietly degraded to keyword-only — every query still answering, just worse, with no error to notice.

v0.10.0 — reliable memory

Reliable memory — five improvements that make ATS's memory more trustworthy and observable, each an extension of existing infrastructure rather than a rewrite.

• Degraded-retrieval transparency — find returns degraded + warnings + corpus.sourcesFailed when a corpus source or retrieval branch drops out, instead of silently serving a subset. The composite adapter records which child it dropped; a known-partial corpus is no longer cached as complete.
• Optional reranking — ats find --rerank adds a second-stage reranker over the RRF-fused pool (a built-in dependency-free lexical scorer, or pass your own cross-encoder/LLM function). Widens a rerankDepth pool then trims to limit; degrades to the fused order on failure.
• Usage observability — retrieval calls now log durationMs, and ats usage reports per-tool volume, empty/error/degraded rates, latency (avg + p95), re-query pairs, and top queries (--json for machine output, markdown otherwise).
• Duplicate / contradiction detection — ats dedup clusters near-duplicate tasks (dependency-free Jaccard over title + content + tags) and flags status/priority/due disagreements within a cluster as potential contradictions. Detection only; it never edits.
• Reactive token refresh — the TickTick adapter refreshes its OAuth token and retries once on a 401 (revoked / invalidated-early / wrong-expiry cases the proactive check misses), then surfaces an actionable "run ats auth login".

Lockstep release — all public @reneza/ats-* packages published at 0.10.0. Full history in CHANGELOG.md.

v0.9.0 — undo, forward links, path-traversal fix

0.9.0 - Undo, forward links, path-traversal hardening, broader MCP clients

Released 2026-07-03.

• Reversible writes. ats undo [ACTION_ID] and the undo_write MCP tool reverse a recorded write from a before-image the ledger now captures on every update: an updated task is restored to its prior title/body/tags/due, and a created task is deleted. Omit the id to undo the most recent undoable write. Each undo appends a compensating action.reverted entry, so it is itself audited and cannot be applied twice. Before-images are only stored for writes that need them, keeping the ledger lean for reads and creates.
• Forward (dangling) links. add_task_link and ats link add gain --allow-missing, which records a typed link to a task that does not exist yet. Because ATS resolves a link's target from corpus presence at read time, the link auto-resolves the moment the target is created (the graph node flips from missing: true to the real title). resolve_task_links / ats link resolve persists that heal by refreshing the placeholder title to the real one. Default add_task_link stays strict (unknown target still errors).
• Path-traversal hardening (Obsidian adapter). Task ids and project ids flowed into filesystem paths unconstrained, so a crafted ../, leading /, or decoded ..%2f could read or overwrite files outside the vault. Every fs access derived from user input is now constrained to the vault root via a single guard; a title alone was already safe (separators are stripped).
• Broader MCP client coverage. Verified stdio configuration for Cursor, Windsurf, and OpenCode alongside Claude Code and Claude Desktop, with a compatibility table and copy-paste config blocks.
• Added a live end-to-end retrieval smoke test that locks in the add→find round-trip and graceful degradation to keyword/RRF retrieval when no embedder is present (or the embedder throws).

ATS v0.6.0 - Intent hierarchy and repo-local execution adapters

Highlights

• Promote exploratory material into committed goals, projects, or tasks without copying the source body.
• Model explicit goal/project/task parent chains and evaluate alignment, lifecycle validity, cycles, and active conflicts.
• Use Beads repositories through the official bd --json CLI while preserving native Dolt state and dependency context.
• Publish the previously unreleased portable intent, security, event, progress-benchmark, and Taskmaster work as a coherent release.

Verification

• 167 automated tests pass.
• Intent, Taskmaster, Beads, and workflow-progress proofs pass.
• GitHub CI and npm publication-content checks pass.

See CHANGELOG.md for the complete release notes.

ATS v0.5.0 - TickTick parity and secure trunk sync

ATS v0.5.0 makes the ATS interface the complete task-management path for the TickTick-backed workflow while keeping public release data sanitized.

Highlights:

• Adds the local-first TickTick cache adapter for reads from the centralized JSON cache with API-backed writes.
• Completes ATS routing for project, task, note, cache, vector, benchmark, completion, and help workflows.
• Corrects task create/update round trips, explicit field clearing, retrieval deduplication, and adapter embedding fallbacks.
• Reworks agent trunk synchronization to use ATS only, validate schema, update atomically, and emit sync health state.
• Adds deterministic public-claim and personal-data gates for repository and npm publish surfaces.
• Expands regression coverage to 123 passing tests across Node.js 20 and 22.

Validation:

• GitHub CI passed on the tagged commit.
• 95 repository files and 41 npm payload files passed the disclosure gate.
• No npm packages are published by this GitHub release.