v0.32.0

Added

• Self-hosted SearXNG web research (the new default provider). The research capability (Board + PM web_search / web_fetch) no longer requires a paid API: a keyless searxng provider talks to a bundled roboco-searxng container (all three compose files, internal-only, no host port, no nginx route; deploy/searxng/settings.yml enables format=json and disables the public-instance limiter; ~150-300 MB RAM). web_fetch on SearXNG downloads the page server-side and extracts readable text locally via trafilatura, guarded against SSRF: agent-supplied URLs must resolve to public addresses, so the orchestrator's internal network (DB, Redis, metadata) is unreachable through it. Tavily/Brave/Exa remain opt-in paid fallbacks via .env.
• The Decisions service: typed System One decisions from a self-hosted roboco-decisions sidecar, with clef as the default tier. roboco/services/decisions/ adds typed-question schemas, one httpx client for both tiers (client-side token caps, a 3-failure/5-minute circuit breaker, fail-open), a per-call tier resolver (clef, then laya, then an OpenRouter opt-in fallback, with a once-per-boot CEO notification on a missing key) and off|shadow|on pilot settings under decisions.pilot.{slug}, all behind ROBOCO_DECISIONS_ENABLED. The sidecar runs two llama.cpp backends (clef 27B Q4_K_M, laya 421M Q8_0) built from llama.cpp b11371, the first tag with the clef architecture, and reports per-backend health; CLEF_ENABLED / LAYA_ENABLED pass through compose as ROBOCO_SIDECAR_* so a host that cannot hold the 19 GB clef GGUF runs laya only. The sidecar uses an async lifespan, /models is created before the weight fetch, the container no longer carries a RAM cap that made it useless, and scripts/deploy-nas.sh now builds it, starts it on both colors and waits for its health before the flip.
• A floating DevOps agent (devops-1) and the infra review gate, both default-off behind ROBOCO_DEVOPS_ENABLED. The seat is Role.DEVOPS on the board team (migration 103 adds the agentrole value, headcount 25 to 26), claims infra tasks on any project through the full authoring verb set, and runs from a dedicated docker/agent-devops.Dockerfile image (pinned docker CLI for compose validation only with no daemon or socket, compose plugin, kubectl, helm, terraform, hadolint, yamllint, shellcheck). Projects declare infra paths in an optional infra: glob section of .roboco/conventions.yml (shipped DEFAULT_INFRA_GLOBS, [] opts out, a declared list replaces the defaults; editable in the panel Conventions tab). When a PR touches those globs, pr_pass additionally requires a devops verdict for the current head SHA via the new record_devops_review intent and /api/v1/flow/devops router; the verdict re-arms on every head advance and a self-review is excluded. Flag off, everything stays inert.
• The Nebius agent image is built locally by the build compose. No build-compose service referenced roboco-agent-nebius, so a source deploy never built it and Nebius-routed spawns had no image. Every compose file now also carries the Nebius and Token Factory settings (including the Sandboxes flag and project id), all off by default, so building the image routes nothing to Nebius.

Changed

• RustFS replaces MinIO as the S3-compatible object store. The compose files, deploy script and storage docs now run rustfs and rustfs-init; the deploy script names them explicitly in its pull, build and up lists.
• Deploy image builds are content-gated instead of always-rebuild. scripts/deploy-nas.sh keeps per-family content hashes in .deploy-cache/, so roboco/ or lockfile changes rebuild the orchestrator and agent images, a panel-only change does not, and a zero-change redeploy rebuilds nothing. The live-chat images join the gated pass, which runs after the pass that defines HASH_LABEL and finds the Dockerfiles it checks, and a hash-pipeline failure can no longer abort the deploy.
• The two lane barriers share one pure predicate. roboco.foundation.policy.lane.transitive_dependents replaces two byte-identical closure loops (dispatch and the claim gate), and the six rank-C blocks xenon flagged now shed decisions into named helpers. Behavior is unchanged.

Fixed

• make quickstart boots nginx again. deploy/nginx.conf includes front/active-upstreams.conf inside its server {} block, where only set directives are valid, but the committed file still held upstream {} blocks, so nginx -t failed ("upstream" directive is not allowed here) and roboco-nginx crash-looped on every fresh registry install. Its targets were also the NAS's -blue containers, which the registry stack never starts. The seed file now holds the three set directives scripts/deploy-nas.sh writes, and docker-compose.registry.yml mounts a new front/registry/ include that points at the registry's own roboco-panel/roboco-orchestrator/roboco-dispatcher containers. A regression test resolves every compose file's include against the containers that compose runs.
• The registry stack enables sandboxed test databases by default. docker-compose.registry.yml defaults ROBOCO_SANDBOX_DB_ENABLED to on, so make quickstart agents can request a disposable Postgres or Redis.
• scripts/deploy-nas.sh no longer deploys the wrong stack or flips on a failed migration. An alembic failure now gates the traffic flip (the script used to warn "traffic NOT flipped" and flip anyway), and STACK_DIR defaults to the checkout the script lives in instead of /volume1/roboco.
• opencode agents on Nebius and OpenRouter reach the gateway, finish their turn and resolve the right endpoint and models. The rendered config sets MCP server environment, a per-server timeout equal to experimental.mcp_timeout (above the slow-verb budget), options.baseURL (the field opencode actually routes by, so ROBOCO_NEBIUS_BASE_URL takes effect) and a provider block declaring the agent's own model (Nemotron 3 Nano is served but absent from opencode's catalog), and a run that exits 0 without a verdict is re-prompted with opencode run --continue. The config home is created before the write, and agent images ship compiled bytecode so the four MCP gateway servers answer initialize in time.
• hummin agents reach the gateway and the panel shows the right mode. hummin's native MCP client is now wired (rendered MCP config, pinned timeouts, --no-json-deltas), the agent UUID rather than the slug goes into the container env so direct verb calls stop failing with a signature mismatch, and derive_mode reports hummin instead of mix. A give-every-role-bash attempt was added and reverted.
• Live intake and secretary chats on CLI providers work. The live MCP config is written to the container's /app/mcp-configs mount, points at the real roboco.mcp.intake_server / secretary_server modules, runs in the right cwd and passes the routed model (pins on intake-1 / secretary-1 were ignored). The first-message window is widened to about 150 s with a closing error frame, and hummin JSONL lines over 64 KB no longer kill the turn.
• Agent-facing verbs accept the 8-character task ids the cards display. evidence, task_time, progress, preflight_diff, triage_failure, pr_update, curate_vault and nothing_to_propose resolve short refs through ContentActions._resolve_task_ref instead of 422ing before any handler ran (be-qa burned a full run in that retry loop).
• Several silent lane and dispatch wedges are closed. A dependency-successor sibling no longer holds the lane barrier (dispatch and claim gate), give_me_work fallback offers learn the lane barrier, i_am_idle no longer demands claims the agent cannot make, an explicit assignment authorizes the assignee, the claim POST waits the slow-verb budget, delegate dedup catches rephrased titles, claim-less roles may journal to their assigned task, PENDING counts as a journal context (the auditor's notes now attach and note() closes note-complete audits), and the decisions-audit prompt passes task_id.
• Review claims can no longer strand a queue. The reaper backstops claims left by a dead reviewer (review_claim_reap_seconds, default 3600) and decides by work signal rather than container state, the breaker reads the tool stream instead of the heartbeat and spares live reviews, i_am_idle releases an unsubmitted review claim, QA steering names the real verbs with a re-claim loop guard, and QA and PR-reviewer roles get real agent workspaces. run_sandbox_tests archives the developer's branch on a Python 3.13 image.
• The project access guard no longer wedges coordinators and handles six edge cases. Org-wide roles are exempt, the task assignee passes, add_allowed_agent validates the grant, and denial remediate text names the real fix per reason (roboco/services/project.py). A re-published upstream tag no longer freezes the read-clone refresh.
• Runtime and sandbox robustness. Respawn paths re-resolve git context from the current task, chown failure warnings name the failing paths, sandbox Redis starts with module loading enabled, grok and codex auth refresh loops back off exponentially and park on dead credentials, and sweep-tick usage reads no longer fire the finalize zero warning.
• Release and quality tooling. rich is capped below 15.0.0 (its wheel breaks bandit's import), the release-readiness canonical-bump derivation requires the chore(release): X.Y.Z subject shape, and the lint, typing and CI gates were repaired (PLC0415 waivers restored, sidecar workflow name, reaper test harness and sweep test typing, lockfile refresh).