Corvid v0.1.0

What's Changed

• CI: build, test (S6 required), Native AOT publish by @MarkWalls in #1
• C-001: establish agent core projects and dependency boundaries by @MarkWalls in #2
• C-002: session events, append-only SQLite event log and projections by @MarkWalls in #3
• C-005: tool source generator and registry by @MarkWalls in #4
• C-009: golden trajectories and replay harness by @MarkWalls in #5
• Model slots, profiles and switch semantics (C-006) by @MarkWalls in #6
• Plan v0.4: build without Kev; decide D-3; backlog C-004a to C-021 by @MarkWalls in #7
• Starling adapters: Qwen3.5 generator, GLiNER2 extractor, text embedders and acquisition (C-010) by @MarkWalls in #8
• Add the decision fabric without Kev (C-004a) by @MarkWalls in #9
• corvid-sandbox launcher and Corvid.Sandbox: bubblewrap, Landlock, seccomp (C-007a) by @MarkWalls in #10
• Add the memory store (C-008) by @MarkWalls in #11
• Add calibration tooling and decision export (C-021) by @MarkWalls in #13
• Structural approval pipeline (C-007b) by @MarkWalls in #12
• Session actor, turn loop and device scheduler (C-011) by @MarkWalls in #14
• Built-in tools and the durable scheduler (C-012) by @MarkWalls in #15
• Corvid.Host composition root, corvid CLI and OpenTelemetry spans (C-013) by @MarkWalls in #16
• CI: run on the self-hosted omarchy runner by @MarkWalls in #22
• Kev decider, two-tier gates and Starling 0.3.0 (C-004b) by @MarkWalls in #20
• Compaction with map-reduce summaries, goal re-injection and expansion (C-016) by @MarkWalls in #17
• Checkpoints with /undo and /rollback on log positions (C-014) by @MarkWalls in #19
• Skills: loader, git-versioned store with authorship, learning loop and replay tests (C-017) by @MarkWalls in #18
• Cloud slots through Vault and the privacy egress gate (C-015) by @MarkWalls in #21
• Add MCP client and server: sandboxed stdio, Vault-backed HTTP, tasks, corvid mcp serve (C-018) by @MarkWalls in #24
• ACP endpoint and OpenAI-compatible HTTP endpoint (C-019) by @MarkWalls in #25
• Gateway host, delivery ledger, pairing and Telegram, Discord and Slack adapters (C-020) by @MarkWalls in #26
• Fix the skills repository's exit-code check, the serve lock leak and long test socket paths by @MarkWalls in #28
• Slot pre-fill: extractor spans are hints, not vetoes by @MarkWalls in #27
• Unwrap launchers in the approval pipeline: tracers, namespaces, systemd-run, script -c, parallel by @MarkWalls in #29
• Gateway guests get an allowlist of tools, empty by default (C-020) by @MarkWalls in #30
• Follow-ups: non-regular files, probe call id, ShortTemp cleanup, guest memory by @MarkWalls in #31
• Spike S3: GLiNER2 on shell targets fails; the analyzer stays authoritative by @MarkWalls in #32
• Approvals: valgrind always asks; unwrap runuser, at/batch and gdb by @MarkWalls in #33
• Follow-ups: guest memory tools by flag, SearchFiles double check, permission-denied reads by @MarkWalls in #35
• ACP cancel answers "cancelled"; investigation of SIGKILLs in local test runs by @MarkWalls in #34
• Skill learning signals: task-success precondition, recovery trigger, head+tail drafting window (C-026) by @MarkWalls in #36
• Trace export in Beacon's JSONL schema and Hermes memory import (C-027) by @MarkWalls in #37
• MCP tool-definition pinning and poisoned-description detection (C-022) by @MarkWalls in #38
• Lessons memory tier with per-project scope (C-025) by @MarkWalls in #39
• Detection rules over the session event log, inline and via corvid scan (C-023) by @MarkWalls in #40
• Read-only project memory on corvid mcp serve (C-028) by @MarkWalls in #41
• Spike S1: Kev checkpoint latency on the 3090 and CPU by @MarkWalls in #42
• Spike S5: llguidance tool-call grammar on Starling's Qwen client by @MarkWalls in #43
• /compact, /cron with pausing, one Hermes home for both imports (C-035) by @MarkWalls in #46
• MCP pinning follow-ups: CLI review, withholding on a confident injection verdict, forget (C-033) by @MarkWalls in #47
• Credential-value detector shared by the egress gate, trace export and lessons (C-032) by @MarkWalls in #48
• Kev on CUDA with placement config and a state token budget (C-029) by @MarkWalls in #50
• Prompt-injection exfiltration canary (C-024) by @MarkWalls in #44
• C-024 deferred: scanner/verdict coverage and the encoded-leak path by @MarkWalls in #51
• C-024: the gist and echo S7 vectors by @MarkWalls in #52
• C-024: mark gist/echo/base64 vectors built in the plan by @MarkWalls in #54
• TUI design: terminal layer from raw bytes, inline by default, fullscreen and linear behind one component model by @MarkWalls in #49
• Fewer checkpoints on CPU-only Kev hosts (C-030) by @MarkWalls in #53
• S2 tool-calling golden set, harness and 3090 run (C-034) by @MarkWalls in #55
• Plan 0.5: revision after spikes S1, S3 and S5 (C-036) by @MarkWalls in #56
• Vault sandbox proxy with a per-sandbox CA (V-003a) by @MarkWalls in #58
• Fix the scheduler-notice and download-progress races (C-039) by @MarkWalls in #57
• Plan: link the upstream asks filed on Starling (U-2, U-4, U-8) by @MarkWalls in #60
• Credential scrub on event-log, memory and skill writes (C-040) by @MarkWalls in #59
• Sandbox egress through Vault's proxy, launcher and shell sides (V-003b) by @MarkWalls in #61
• Cron pause/resume tools, /cron runs, scheduler wake and /compact (C-041) by @MarkWalls in #62
• Description withholding before the tool pick, never on the generic injection verdict (C-037) by @MarkWalls in #63
• README: organise by what Corvid does, with TUI mockups by @MarkWalls in #64
• Vault: a sandbox close or sweep returns only once the sandbox is closed and audited by @MarkWalls in #65
• Spike S4: Kev tool/done accuracy at the 600-token state vs a transcript-sized one (C-038) by @MarkWalls in #67
• Command-line installer (install.sh) and release workflow by @MarkWalls in #66

New Contributors

• @MarkWalls made their first contribution in #1

Full Changelog: https://github.com/starlinghq/corvid/commits/v0.1.0