v2.46.0

2.46.0 (2026-10-27)

Features

• portal: authorize by Authentik group membership, not a pinned subject (#559) (b98247c)
• portal: drop the recovery witness and admission fence (#560) (4139a72)
• portal: projects, working filters, task results and usage monitoring (#568) (0134c30)
• portal: show session activity and usage in the approved Agents design (#557) (af402e5)

Bug Fixes

• portal: land the bare origin on sign-in and drop the green status color (#561) (0effa8b)
• portal: load real OpenProject tasks, drop stub chrome, trust the CNPG CA key (#564) (684d530)

Coordination CLI (also included)

• agent-run inbox send|list|read|ack exposes the existing durable inbox API (#569). Sending requires an existing authorized Session, explicit project and recipient UID, a stable key, and bounded UTF-8 stdin. Reads do not acknowledge automatically; an API read ACK is not proof of TUI or human consumption.
• The CLI is published in the v2.46.0 agent image. Publication does not install it into existing sessions, activate permissions, or roll out images.