v0.2.0

What's Changed

• define goals behavior by @SamuelBrudner in #1
• Run/20260115 223127 85286445 by @SamuelBrudner in #2
• Run/20260129 200229 76129ac3 by @SamuelBrudner in #3
• [codex] stabilize backend persistence and modularize frontend shell by @SamuelBrudner in #4
• Run/20260422 175423 009dcf6f by @SamuelBrudner in #5
• Codex/cleanup sprint retire upload and residue by @SamuelBrudner in #6
• docs: rewrite README as a slim, enjoyable front door by @SamuelBrudner in #7
• Complete fz1e branch protection bead export by @SamuelBrudner in #18
• (feat): sync new planning beads (prescribed by bead lab-tracker-28dz) by @SamuelBrudner in #19
• Meeting-aware daily review: flesh-out drafting, external scheduling, one-command setup by @SamuelBrudner in #20
• Daily review: evening framing, rename, and an auto dark theme by @SamuelBrudner in #21
• Redesign the daily review as a prose report with sidebar actions by @SamuelBrudner in #23
• Update README daily-review screenshot to the prose report by @SamuelBrudner in #24
• Add curation provenance, time-windowed retrieval, and provenance export by @SamuelBrudner in #25
• (feat): polish README organization (prescribed by bead lab-tracker-53fv) by @SamuelBrudner in #26
• [codex] Add generic watch capture kit by @SamuelBrudner in #27
• Fix Dependabot dependency updates by @SamuelBrudner in #22
• Accept file uploads and mic input when revising a draft with AI by @SamuelBrudner in #30
• Add ARA exploration graph support by @SamuelBrudner in #29
• Add SQLite backup and restore CLI by @SamuelBrudner in #28
• Reopen lab-tracker-6nf: batch review briefs lost in batches refactor by @SamuelBrudner in #31
• fix: harden SQLite restore against live-server corruption + cross-platform URIs by @SamuelBrudner in #33
• chore(beads): sync tracker — deep-review follow-ups + web-UI write-gating bug by @SamuelBrudner in #34
• fix: harden AI-revise voice recorder against stream leaks and stranded mics by @SamuelBrudner in #37
• feat: add first-class Cursor MCP support by @SamuelBrudner in #32
• feat: daily batch report becomes a day-narrative that clarifies terse captures by @SamuelBrudner in #38
• Docs accuracy + capture/provenance epic (cap1.1–cap1.5) by @SamuelBrudner in #41
• Allow daily review service token trigger by @SamuelBrudner in #40
• feat: add MATLAB consumer figure capture (lab-tracker-eel8) by @SamuelBrudner in #39
• feat: add macOS launchd installer for the daily-review scheduler by @SamuelBrudner in #36
• Agent-prompt-text review + remediation (lab-tracker-apr) by @SamuelBrudner in #42
• On-demand external artifact resolution + opinionated data store registry by @SamuelBrudner in #43
• Codebase health: complexity reduction, 3x faster tests, bug fixes, drift guards by @SamuelBrudner in #44
• feat(cli): add 'lt update' to refresh consumer-repo integration by @SamuelBrudner in #47
• Document the review/commit trust model as an intentional decision by @SamuelBrudner in #49
• Guided setup Phase 2: outbox-backed lt git snapshot + cross-platform lt hooks install by @SamuelBrudner in #50
• Enforce structural human-commit gate on graph drafts (lab-tracker-09ok) by @SamuelBrudner in #48
• Guided setup Phase 1: consent-gated lt setup verbs (status, init, connect, bind, watch add) by @SamuelBrudner in #46
• Add reconstructed project vision document by @SamuelBrudner in #51
• Fix flaky batches cadence test (async settings-load race) by @SamuelBrudner in #53
• Fix: stamp user_revised origin only on human-edited graph-draft ops by @SamuelBrudner in #52
• Guided setup Phase 3: agent-awareness loop (setup skill, --install-skills, setup-guide resource, content-only drift, SessionStart hook) by @SamuelBrudner in #54
• docs: server-resident agentic drafting design + beads (lab-tracker-1325) by @SamuelBrudner in #56
• Content-hash recovery of lost artifacts + analysis-repo provenance capture (lt-2903, lt-81s6 MVPs) by @SamuelBrudner in #45
• Capture-path convergence, group-store authz fix, rclone allowlist + backlog hygiene by @SamuelBrudner in #57
• chore(deps-dev): Bump globals from 17.6.0 to 17.7.0 by @dependabot[bot] in #61
• Guided setup Phase 4 (epic close-out): lt setup schedule + applied-repos registry with doctor --all by @SamuelBrudner in #55
• feat: add server-resident agentic drafting by @SamuelBrudner in #63
• chore(deps): batch jsdom 29.1.1, esbuild 0.28.1, @xyflow/react 12.11.1 with bundle rebuild by @SamuelBrudner in #64
• feat: phone capture is capture-only; contributors manage their daily batch by @SamuelBrudner in #35
• De-clutter the project knowledge-graph view by @SamuelBrudner in #66
• Remove the MiniMap from the project graph by @SamuelBrudner in #67
• chore(deps-dev): Bump eslint from 9.39.4 to 10.6.0 by @dependabot[bot] in #58
• Add reproducible screenshot script; refresh README graph screenshots by @SamuelBrudner in #68
• Label dataset graph nodes by manifest name, not commit hash by @SamuelBrudner in #70
• docs: use general capture language instead of "at the rig" by @SamuelBrudner in #69
• Vendor-agnostic agent setup for the proposal workflow by @SamuelBrudner in #71
• Lead the README with the core goal and reframe the daily review by @SamuelBrudner in #72
• feat: web Agents page mints LPATs with copy-paste agent setup commands by @SamuelBrudner in #73
• test: make serve_app test hermetic against developer-local .env by @SamuelBrudner in #65
• skill(lab-tracker): recommend filing GitHub issues on end-user friction by @SamuelBrudner in #75
• MCP auth diagnosability + capture legibility (closes #8, #74, #76–81) by @SamuelBrudner in #83
• feat: add phone-first audio daily review by @SamuelBrudner in #87
• docs: add LOUD alignment plan for the provenance surface by @SamuelBrudner in #90
• Consumer automation & client-boundary reliability (epic lab-tracker-ggzs) by @SamuelBrudner in #91
• Operational safety and executable verification (lab-tracker-2rlw) by @SamuelBrudner in #93
• fix: make capture-key idempotency atomic and principal-scoped by @SamuelBrudner in #94
• Frontend workflow integrity and offline identity (lab-tracker-4w2x) by @SamuelBrudner in #92
• Make application commands atomic outside HTTP middleware (lab-tracker-tcj7.1) by @SamuelBrudner in #95
• fix: serialize question DAG mutations (prescribed by bead lab-tracker-tcj7.5) by @SamuelBrudner in #96
• feat: add atomic evidence bundle command by @SamuelBrudner in #97
• feat: enforce claim confidence bounds by @SamuelBrudner in #98
• fix: preserve dataset file sizes by @SamuelBrudner in #99
• fix: standardize PATCH tri-state semantics by @SamuelBrudner in #102
• test: cover operational browser safety races by @SamuelBrudner in #101
• test: relocate App feature journeys by @SamuelBrudner in #100
• refactor: establish typed application handlers by @SamuelBrudner in #103
• refactor: split graph draft lifecycle coordinators by @SamuelBrudner in #104
• refactor: narrow application ports and add static typing by @SamuelBrudner in #105
• feat: embed figure evidence in daily review proposals by @SamuelBrudner in #106
• fix: redact Google graph-drafting credentials by @SamuelBrudner in #107
• test: stabilize feature integration timeout budgets by @SamuelBrudner in #108
• fix: filter PostgreSQL claims without JSON distinct by @SamuelBrudner in #110
• fix: serialize dataset-file writes with cascade deletion by @SamuelBrudner in #111
• Fix PostgreSQL JSON-bearing filtered queries by @SamuelBrudner in #112
• Serialize dataset snapshots with file mutations by @SamuelBrudner in #113
• fix: authorize spanning goals before scoped search by @SamuelBrudner in #114
• fix: make goal reads opaque to unauthorized callers by @SamuelBrudner in #115
• Codex/readme root cleanup by @SamuelBrudner in #109
• test: eliminate shared-busy integration click races by @SamuelBrudner in #117
• fix: make core read boundaries opaque by @SamuelBrudner in #116
• fix: make direct group reads opaque by @SamuelBrudner in #118
• fix: suppress opaque Ara miss telemetry by @SamuelBrudner in #119
• fix: make evidence artifact reads opaque by @SamuelBrudner in #120
• test: complete evidence artifact opacity certification by @SamuelBrudner in #121
• fix: allow read-only LPAT artifact resolution by @SamuelBrudner in #122
• fix: make workflow and registry reads opaque by @SamuelBrudner in #123
• docs: foreground payoff and reflective review (prescribed by bead lab… by @SamuelBrudner in #124
• test: certify targeted read opacity matrix by @SamuelBrudner in #125
• fix: block SSRF in artifact HTTP resolution by @SamuelBrudner in #132
• fix: suppress unverified artifact content by @SamuelBrudner in #133
• fix: bound outbound HTTP artifact resolution by total deadline by @SamuelBrudner in #134
• fix: bound artifact resolver subprocesses by @SamuelBrudner in #135
• feat: contain resolver subprocesses on Windows by @SamuelBrudner in #139
• fix: authorize Git remotes structurally by @SamuelBrudner in #140
• fix: bound artifact resolution concurrency by @SamuelBrudner in #141
• fix: make local artifact paths native and contained by @SamuelBrudner in #142
• fix: bind local artifact reads to opened handles by @SamuelBrudner in #143
• fix: confine local store resolution to its root by @SamuelBrudner in #144
• fix: restore Python 3.10 compatibility by @SamuelBrudner in #145
• fix: confine registered HTTP stores to path prefixes by @SamuelBrudner in #146
• fix: confine registered rclone stores to registered roots by @SamuelBrudner in #147
• fix: restore Alembic downgrade symmetry by @SamuelBrudner in #148
• fix: make POSIX subprocess cleanup race-safe by @SamuelBrudner in #149
• fix: confine registered Git stores to immutable pins by @SamuelBrudner in #150
• fix: remove vulnerable frontend tooling dependencies by @SamuelBrudner in #151
• fix: allow read-only LPAT decision context by @SamuelBrudner in #152
• Bound the data-store health control plane by @SamuelBrudner in #153
• Pin HTTP store-health probes to the outbound policy by @SamuelBrudner in #154
• fix: contain rclone and Git store health by @SamuelBrudner in #155
• fix: contain local store health probes by @SamuelBrudner in #156
• Bind local store health to retained directory handles by @SamuelBrudner in #157
• docs: define local mount authority by @SamuelBrudner in #158
• fix: bound local health before filesystem traversal by @SamuelBrudner in #159
• fix: enforce bounded artifact resolution by @SamuelBrudner in #160
• ci: dedupe workflow runs and de-flake frontend tests by @SamuelBrudner in #161
• Project graph de-clutter, agentic-data tool landscape, and walkthrough coverage updates by @SamuelBrudner in #84
• feat: bound local artifact reads by @SamuelBrudner in #162
• Bound local artifact recovery enumeration by @SamuelBrudner in #163
• fix: contain contributor-authored direct artifact references by @SamuelBrudner in #164
• fix: validate and canonicalize data-store definitions by @SamuelBrudner in #165
• feat: define typed store authority registry by @SamuelBrudner in #166
• feat: bind data stores to authority grants by @SamuelBrudner in #167
• fix: defer commit-hook proposal generation by @SamuelBrudner in #169
• fix: return 404 for missing batch-settings projects by @SamuelBrudner in #170
• test: stabilize mobile capture context selection by @SamuelBrudner in #174
• feat: add design token foundation by @SamuelBrudner in #171
• feat: capture enrolled repository conventions by @SamuelBrudner in #173
• feat: preserve unsaved form drafts locally by @SamuelBrudner in #172
• feat: revalidate store grants and enforce capabilities before remote artifact I/O by @SamuelBrudner in #168
• docs: lead README with near-automatic capture by @SamuelBrudner in #176
• docs: simplify the README’s AI review promise by @SamuelBrudner in #177
• build(deps): Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #127
• chore(deps): Bump actions/setup-node from 6 to 7 by @dependabot[bot] in #89
• build(deps-dev): Update mypy requirement from <2,>=1.15 to >=1.15,<3 by @dependabot[bot] in #128
• build(deps): Bump actions/setup-python from 6 to 7 by @dependabot[bot] in #126
• chore(deps): combined frontend dependency bumps (react/react-dom/xyflow/eslint) by @SamuelBrudner in #191
• build(deps-dev): Bump typescript from 5.9.3 to 7.0.2 by @dependabot[bot] in #129
• feat: unify Lab Tracker instance URL configuration by @SamuelBrudner in #183
• feat: preserve and undo bulk draft acceptance by @SamuelBrudner in #178
• feat: add narrative graph-draft review by @SamuelBrudner in #185
• fix: repair invalid batch graph draft payloads by @SamuelBrudner in #180
• feat: add immutable deployment revision probes by @SamuelBrudner in #179
• feat: verify source-pinned client setup by @SamuelBrudner in #184
• feat: add a dedicated-instance release workflow by @SamuelBrudner in #188
• Codex/deployment revision probe by @SamuelBrudner in #192
• feat: add acquisition collection backend foundation by @SamuelBrudner in #190
• feat: add opt-in background audio transcription by @SamuelBrudner in #186
• fix: harden invitation acceptance by @SamuelBrudner in #182
• fix: gate review email on host capability by @SamuelBrudner in #181
• feat: scope Daily Review by reviewer by @SamuelBrudner in #189
• feat: guide source-pinned agent setup by @SamuelBrudner in #187
• chore(deps): refresh uv.lock mypy specifier to match pyproject by @SamuelBrudner in #193
• Fix pinned deployments and graph-draft payload validation by @SamuelBrudner in #201
• fix: authenticate hosted MCP clients by @SamuelBrudner in #202
• build(deps): Bump actions/setup-node from 6 to 7 by @dependabot[bot] in #200
• feat: add bounded graph-native serving for remote MCP agents by @SamuelBrudner in #203
• feat: onboard members into ongoing projects by @SamuelBrudner in #204
• build(deps-dev): Bump globals from 17.7.0 to 17.9.0 by @dependabot[bot] in #196
• build(deps-dev): Bump @testing-library/jest-dom from 6.9.1 to 7.0.1 by @dependabot[bot] in #194
• build(deps-dev): Bump jsdom from 29.1.1 to 30.0.1 by @dependabot[bot] in #198
• build(deps-dev): Bump @playwright/test from 1.61.1 to 1.62.1 by @dependabot[bot] in #197
• build(deps-dev): Bump playwright from 1.61.1 to 1.62.1 by @dependabot[bot] in #199
• build(deps): Update mcp requirement from <2,>=1.27 to >=1.27,<3 by @dependabot[bot] in #195
• fix: land setup, MCP compatibility, and research review updates by @SamuelBrudner in #215
• fix: explain TCP, TLS, and HTTP connection failures by @SamuelBrudner in #219
• fix: report CLI API failures without tracebacks by @SamuelBrudner in #221
• docs: add deep codebase review 2026-09-21 by @SamuelBrudner in #222
• fix: address the 2026-09-21 deep-review findings by @SamuelBrudner in #223
• Add keyboard review shortcuts and in-page audio recording by @SamuelBrudner in #233
• Fix stdin EOF race in MCP tool probe with background response draining by @SamuelBrudner in #235
• Fix MCP executable resolution to not follow symlinked interpreters by @SamuelBrudner in #240
• Claude/gracious shannon uq5ozk by @SamuelBrudner in #241
• test: add a scheduler-chaos mode to the frontend suite and CI by @SamuelBrudner in #242
• feat: eleven vision-compatible moves toward the self-organizing brain by @SamuelBrudner in #243
• feat: establish semantic versioning and releases by @SamuelBrudner in #245
• chore(deps): combined September dependency bumps by @SamuelBrudner in #244
• feat(setup): tell clients and reviewers when a capture machine is behind its server by @SamuelBrudner in #246
• feat(capture): offline figure queue, session-linked captures, exact-id provenance proposals, and capture health by @SamuelBrudner in #247
• Delegated curation: owner-granted exception to human-gated review by @SamuelBrudner in #248
• feat(capture): low-effort capture for wet and dry lab work, with docs for people and agents by @SamuelBrudner in #249
• fix(repo): give each repo event at a commit its own capture key by @SamuelBrudner in #250
• Setup onboarding, lt update --skills-only, and client-update hardening by @SamuelBrudner in #251
• feat(cli): automate client and repository maintenance by @SamuelBrudner in #263
• fix: satisfy static demo auth response contract by @SamuelBrudner in #262
• feat(graph-drafts): capture-setup tips when the daily drafter can't read the inbox by @SamuelBrudner in #264
• chore(release): prepare v0.2.0 by @SamuelBrudner in #265
• fix(deps): bump source-map-js to 1.2.2 for GHSA-68fv-2mgg-jv7q by @SamuelBrudner in #271
• fix(watch): stop watch roots and manifests from choosing what is uploaded by @SamuelBrudner in #270
• ci(release): tag and release automatically once main's CI passes by @SamuelBrudner in #272

New Contributors

• @dependabot[bot] made their first contribution in #61

Full Changelog: https://github.com/SamuelBrudner/lab-tracker/commits/v0.2.0