v0.1.0 — first tagged release

What's Changed

• chore: release hygiene & discoverability (portfolio audit fixes) by @tafreeman in #51
• chore(types): ratchet engine/ + contracts/ to mypy strict by @tafreeman in #52
• feat(models): wire Azure OpenAI, Azure Foundry, and ONNX backends by @tafreeman in #53
• Fix OnnxBackend AttributeError: missing _lock field by @tafreeman with @Copilot in #55
• chore(deps): update aiofiles requirement from <25,>=23.0 to >=23.0,<26 in /agentic-workflows-v2 by @dependabot[bot] in #40
• chore(deps-dev): update redis requirement from <6,>=5.0 to >=5.0,<9 in /agentic-workflows-v2 by @dependabot[bot] in #39
• chore(deps): update openai requirement from <3,>=2.26 to >=2.38.0,<3 by @dependabot[bot] in #37
• chore(deps): update anthropic requirement from <1,>=0.101.0 to >=0.105.2,<1 by @dependabot[bot] in #34
• fix(sonar): remediate findings — A across all ratings, 0 hotspots by @tafreeman in #57
• fix(sonar): remediate 492 SonarQube issues across 5 cost-tiered agent waves by @tafreeman in #58
• chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 by @dependabot[bot] in #60
• chore(deps): update aiohttp requirement from >=3.13.5 to >=3.14.1 by @dependabot[bot] in #63
• chore(deps): bump @tanstack/react-query from 5.100.14 to 5.101.0 in /agentic-workflows-v2/ui by @dependabot[bot] in #66
• chore(deps): bump react-router-dom from 7.16.0 to 7.17.0 in /agentic-workflows-v2/ui by @dependabot[bot] in #68
• chore(deps-dev): bump @types/react from 19.2.16 to 19.2.17 in /agentic-workflows-v2/ui by @dependabot[bot] in #69
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.2 in /agentic-workflows-v2/ui by @dependabot[bot] in #67
• fix(sonar): post-#58 remediation — Wave A + targeted fixes + WIP (32 files) by @tafreeman in #59
• fix: P0 pre-pin remediation — sanitization wiring, refinement convergence, README accuracy by @tafreeman in #70
• feat(security): shared SSRF URL guard, default-on private-IP blocking, unified agent tool dispatch by @tafreeman in #71
• ci(typecheck): strict mypy gate for engine + contracts by @tafreeman in #72
• fix: audit wave 1 — readiness probe, OTEL error status, CAS circuit-breaker, DAG timeout hardening by @tafreeman in #73
• Refactor agentic runtime client, settings, and helper modules by @tafreeman in #74
• fix: audit wave 3 — ruff correctness ratchet, single-probe half-open gate, bg-task drain, client.py decomposition, ADR-019 accuracy by @tafreeman in #75
• Audit remediation: eliminate eval(), wire Redis CAS, fix CI hang, ops hardening by @tafreeman in #76
• feat: Claude Architect (Foundations) improvements — ARP-1..9 + k6/Pages load proof by @tafreeman in #77
• fix(security): unify expression evaluators on AST sandbox; remove eval() from langchain path by @tafreeman in #78
• ci: install Python deps from uv.lock (reproducible builds) by @tafreeman in #79
• ci(eval): deterministic key-free scored-eval gate over a committed golden by @tafreeman in #96
• feat(ui): theme-token coherence, accessibility, and resilient states by @tafreeman in #98
• fix(audit): depth-audit remediation (SSRF tests, ruff, eval gate, scoring refactor) by @tafreeman in #99
• docs(adr): salvage ADR-031 (lab's ADR-013) from agentic-systems-lab by @tafreeman in #97
• fix(eval): word-boundary match in sandbox command blocklist by @tafreeman in #100
• refactor(server): extract scoring/judge domain into agentic_v2/scoring package by @tafreeman in #101
• Chore/repo hygiene by @tafreeman in #102
• chore(deps): batch 15 Dependabot updates (10 pip, 5 npm) by @tafreeman in #103
• Architectural assessment remediation: ADR hygiene, 800-line splits, load gate, sandbox tests by @tafreeman in #104
• ci(deps): group Dependabot updates + scope auto-merge (less brutal version CI) by @tafreeman in #105
• chore(deps): bump python from 3.11-slim to 3.14-slim in the docker group by @dependabot[bot] in #106
• chore(deps): bump the ui-npm group in /agentic-workflows-v2/ui with 4 updates by @dependabot[bot] in #107
• ci(deps): add just relock recipe + fix dependabot comments (follow-up to #105) by @tafreeman in #109
• fix: resolve 14 CRITICAL security/correctness issues from adversarial review by @tafreeman in #111
• chore: drop redundant isort pre-commit hook in favor of ruff by @tafreeman in #112
• docs: sync architecture docs with refactors + correct ADR count by @tafreeman in #114
• ExecutionKit provider default-on, token-delta streaming, server module split by @tafreeman in #115
• chore(deps): bump the ui-npm group in /agentic-workflows-v2/ui with 2 updates by @dependabot[bot] in #119
• feat(models): live Ollama discovery + official client + cloud catalog by @tafreeman in #116
• feat(models): live discovery for LM Studio + ONNX local models (ADR-038) by @tafreeman in #120
• feat(ui): visual redesign — dark theme, design tokens, model probe integration by @tafreeman in #121
• feat(models): full local + cloud model discovery in router probe by @tafreeman in #122
• perf(models): cache LM Studio host + concurrent cloud discovery by @tafreeman in #123
• fix(docs): repair 4 broken links causing mkdocs strict build failure by @tafreeman in #124
• feat(model-finder): hardware profile override via config file by @tafreeman in #125
• fix(models): replace retired Gemini 2.0 models, extend architect schema by @tafreeman in #126
• feat(models): curated single-source model registry (ADR-040) by @tafreeman in #127
• refactor(models): re-apply registry hardening lost in #127 squash by @tafreeman in #128
• feat(models): probe-time model-registry drift detection (ADR-040) by @tafreeman in #129
• Feat/hardware override config by @tafreeman in #130
• feat(models): probe-time drift detection for the model registry (ADR-040) by @tafreeman in #131
• docs: correct multidimensional scoring tier names by @tafreeman in #134
• docs(scoring): correct recency classification comment by @tafreeman in #135
• fix(security): ship secure-by-default AGENTIC_BLOCK_PRIVATE_IPS in .env.example by @tafreeman in #133
• Fix/probe discovery perf by @tafreeman in #132
• fix(security): ship secure-by-default AGENTIC_BLOCK_PRIVATE_IPS in .e… by @tafreeman in #136
• chore(deps): bump the ui-npm group in /agentic-workflows-v2/ui with 9 updates by @dependabot[bot] in #139
• fix(models): classify router errors by HTTP status, not substrings by @tafreeman in #138
• refactor(engine): atomic steps-namespace merge under the context lock by @tafreeman in #140
• fix(models): make HTTP status authoritative over message in error classification by @tafreeman in #142
• fix(governance): bound the approval-gate wait and fail closed on timeout by @tafreeman in #141
• fix(engine): preserve inherited step views when merging on a fork by @tafreeman in #143
• Phase 1: reproducible Docker image + enforcing CI job by @tafreeman in #144
• Phase 2: eval gates, token metric, engine fixes, lint ratchet by @tafreeman in #145
• fix(ci): handle string-typed mypy overrides and corrupted ratchet baseline by @tafreeman in #146
• docs: surface governance primitives above the fold, fix drifted counts by @tafreeman in #147
• docs: regenerate AI_EVIDENCE_STANDARD from live code (stale negatives closed) by @tafreeman in #148
• feat(scoring): additive agentic-evalkit bridge + ADR-042 adoption decision by @tafreeman in #149
• docs: fold refutation-verified re-run into evidence scorecard (P2 findings) by @tafreeman in #150
• docs(site): redesign public site on the Console design system by @tafreeman in #151
• docs(site): reconcile the public docs with the codebase after an audit by @tafreeman in #152
• feat(eval): optional agentic-evalkit extra + ARP-side boundary guard (per ADR-042) by @tafreeman in #153
• chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the github-actions group by @dependabot[bot] in #154
• chore(deps): bump the ui-npm group in /agentic-workflows-v2/ui with 6 updates by @dependabot[bot] in #157
• chore(deps): bump python from 3.13-slim to 3.14-slim in the docker group by @dependabot[bot] in #158
• feat(ui): match the ARP Console UI kit — re-skin + signature interactions by @tafreeman in #159
• Revert "feat(ui): match the ARP Console UI kit — re-skin + signature interactions (#159)" by @tafreeman in #160
• fix(langchain): parse step outputs with the engine's robust LLM parser by @tafreeman in #161
• feat(server): evaluate a previously-completed run from its captured log by @tafreeman in #162
• feat(ui): Console re-skin v2 — match the design reference, keep every feature by @tafreeman in #163
• ci(ui): enforce vitest coverage in CI; right-size branch floor with ratchet by @tafreeman in #164
• fix(engine): warn when declared step inputs resolve to null by @tafreeman in #165
• fix(ui): block replay when the run log lacks required captured inputs by @tafreeman in #166
• fix(langchain): fail over when a model response yields no declared outputs by @tafreeman in #167
• fix(server): retention policy for replay buffers + absolute sqlite path by @tafreeman in #168
• feat: configurable workflow UI — per-node config, providers & tiers settings, editable edges, run comparison by @tafreeman in #169
• ci(workflows): enforce smoke-gate exit codes; make unit suite hermetic by @tafreeman in #170
• test: pin legacy completion path in the backendless_baseline fixture by @tafreeman in #171
• fix(scoring): load goldens, surface judge skips, de-saturate efficiency by @tafreeman in #173
• fix(scoring): harden eval visibility per adversarial review; add ADR-044 by @tafreeman in #174
• fix(security): close artifact-extractor / build-app / sanitizer fail-open defects by @tafreeman in #175
• ci(eval): install [server] extra in live gate; make it dispatchable by @tafreeman in #176
• fix(security): mask high-entropy-only secrets on the response path by @tafreeman in #177
• fix(security): enforce tool approval structurally in BaseTool.execute (ADR-047) by @tafreeman in #178
• ci: run EK step-delegation approval-gate tests (install the ek extra) by @tafreeman in #179
• harden two latent ADR-047 tool-dispatch/composition hazards by @tafreeman in #180
• chore(deps): consume ExecutionKit 0.3.0 and agentic-evalkit 0.1.1 from PyPI by @tafreeman in #181
• ci(eval): run eval-golden-gate on every PR so it can gate merges by @tafreeman in #182
• docs(stats): derive homepage counts from source + enforce in CI by @tafreeman in #184
• feat(models): arm process-wide token budget on the client singleton (ADR-048) by @tafreeman in #186
• fix(ui): derive no-LLM badge from server health; drop dead build-time flag by @tafreeman in #185
• fix(server): effective-backend no-LLM badge + shared health hook + doc-stats resync by @tafreeman in #187
• feat: openrouter provider + in-console model chat playground (ADR-050) by @tafreeman in #188
• docs(models): sync MODEL_LAYER.md with live cloud discovery (ADR-039/050) by @tafreeman in #190
• fix(security): send Gemini discovery key via header, not URL query by @tafreeman in #189
• fix(ci): restore #189 review fixes dropped by early squash-merge by @tafreeman in #192
• docs(scripts): add MODEL_LAYER.md to check_docs_refs TARGET_FILES by @tafreeman in #193
• chore: make 'pre-commit run --all-files' honest — align hook revs with CI, land the reformat by @tafreeman in #191
• fix(server): harden system_tops hardware-override parsing by @tafreeman in #194
• perf(models): share one cloud discovery sweep per probe request by @tafreeman in #195
• chore(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.2 in the github-actions group by @dependabot[bot] in #197
• chore(deps): bump the ui-npm group in /agentic-workflows-v2/ui with 8 updates by @dependabot[bot] in #200
• feat(models): local-first ollama.com routing + registry drift cleanup (ADR-051) by @tafreeman in #196
• feat(ui): re-land #199 console controls on main (stranded by stacked base) by @tafreeman in #201
• test(server): make replay-store retention tests deterministic (fake clock) by @tafreeman in #202
• fix(server): harden console inputs left open by #199/#201 review by @tafreeman in #203
• fix(ui): render DAG nodes immediately via initial dimensions (e2e flake) by @tafreeman in #204
• ci: drop dependency-audit from PR runs; keep push, schedule, dispatch by @tafreeman in #206
• fix(workflows): 422 at submit + typed artifact contracts (ADR-052) by @tafreeman in #207
• test: fix stale react dataset count assertion by @tafreeman in #208
• fix(engine): keep normalized-away aliases out of the child context by @tafreeman in #209
• docs(adr): add ADR-055 file-size exception register by @tafreeman in #211

New Contributors

• @tafreeman with @Copilot made their first contribution in #55

Full Changelog: v0.3.0...v0.1.0