v0.56.0

Changed

• Release staging is dispatched on the tag, reserves each version once, and refuses stale release machinery. (#1671)

• The release pack set must name every package, the environment check sees both GitHub forms, and every workflow declares explicit permissions. (#1671)

• The release packs every publishable package once and stages the exact tarballs, not the source tree. (#1671)

• GET /Presence now requires a verified reader by default; the public roster is an explicit opt-in. (#1880)

  Heads-up: an instance that relied on the public roster (for example a
  status page) must set PRESENCE_PUBLIC_ROSTER=true on the Flair process.

Fixed

• Excerpts of long source memories end on a complete character, not a mangled one. (#1772)

• flair doctor --fix adoption no longer accepts a foreign listener when the launchd job reports no pid. (#1841)

  Heads-up: if a flair doctor --fix adopt now reports "the launchd job
  reports no pid after load", the adopted service did not come up as expected;
  confirm the label is loaded, then re-run flair doctor --fix.

• flair-client.mjs now requires an explicit identity for reads too — list, get and search refuse instead of signing as the shipped flint default. (#1816, #1851)

  Heads-up: scripted reads that relied on the default identity now fail
  closed — set FLAIR_AGENT_ID or pass --agent <id> at those call sites.

• The post-publish canary no longer needs repo dependencies — its tarball hasher validates versions with a built-in SemVer 2.0.0 regex. (#1856)

• flair init --data-dir <long> now refuses with a clear message instead of Harper's bare listen EINVAL. (#916)

• flair-client refuses every action without an explicit identity, and the hardcoded flint signer is gone from scripts/repro-resource-busy.mjs. (#1855)

• Docs now match the admin grant, the config file Flair actually reads, the HTTP bind, and the MCP tool list. (#1715, #1766, #1760)

• Spoke bring-up, presence, attention help, MCP paths, and federation sync now match the code. (#840, #932, #995)

• federation pair checks the spoke admin credential before it contacts the hub, so a missing credential no longer burns the pairing token. (#1875)

• The unit-test lane's home-isolation guard now ends a stuck helper probe on its 10-second bound instead of waiting on it. (#1865)

• Home resolution follows the platform rule: Windows uses USERPROFILE, everywhere else HOME.

  Heads-up: on Windows, when HOME and USERPROFILE point to different directories (common under Git Bash, MSYS or Cygwin), Flair now reads and writes MCP client configs under USERPROFILE, which is what Node's os.homedir() returns, instead of HOME. Keys do not move — the keystore now resolves its home through the shared resolveHome() (src/keystore.ts), which on Windows is USERPROFILE || homedir() — so existing keys keep working. If an earlier flair init wired clients under HOME, run flair doctor --fix to wire them under USERPROFILE.

• The OAuth consent page escapes every value it renders and validates state and scope.

• Every home lookup in src/ now goes through one resolver, so doctor and the writers agree on where ~ is. (#1858)

• The OpenClaw memory plugin now makes every agent act only as itself, and refuses rather than guess.

• openclaw-flair no longer mistakes an explicit keyPath for a shared OS user on a multi-agent gateway. (#1751)

• Signed per-agent GET /Presence/<id> reads no longer 401, and the read gate reuses the verdict the auth middleware already established. (#1880)

---

Full record: CHANGELOG.md