AgentOS Core v4.90.0

Features

• reports: v2 report relay receiver with a durable inbox on its own loopback listener (#1869) (c1c0817)
• surfaces: surface adapter contract, Telegram caps and session-key codec (T1) (#1861) (78ad2e8)
• telemetry: core trace export loop for a granted telemetry-sink (#1796) (266e238)

Bug Fixes

• api: name the background slot in the watch-wake binding log line (#1865) (465121d)
• mcp: non-empty tool errors at the MCP boundary and spawn receipts for promises (#1702) (964c408)
• routines: refuse a manual run of an item-fed routine before it starts (#1864) (8c858bb)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:aa3fcdb93f134e415cc7f0dbf861ace025de79dd1ab1e22075c05e776b2451e0

AgentOS Core v4.89.0

Features

• docs: gate G4 — docs surface snapshot, prose freshness and visible doors (#1605) (6430d56)
• monitor: github fact source for on.monitor (pr_merged, pr_closed, issue_closed) (#1857) (9b68c65)

Bug Fixes

• agent-sessions: label a session's completion notice by its final state and verdict (#1858) (1d736ed)
• agent-sessions: let the judge read the tracker and node state its criteria name (#1860) (b50db85)
• agent-sessions: restart a judge torn down by a tool-policy refusal (#1859) (8161337)
• peers: hold the wake lease until the woken slot is live; canonical chat target counts as live (#1847) (0cd079d)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:57959c9877a4e062022d12deaed927567fafd72fb1db9307ccd4fa28fb36223f

AgentOS Core v4.88.0

Features

• friends: add the allowlisted blind relay and the bounded node relay client (#1821) (81e90d8)
• harness: certify the Claude SDK and ACP turn ports (#1826) (1925bf4)
• peers: lease/ack custody for the broker bridge, ack only after the durable commit (#1835) (2c81620)

Bug Fixes

• deps: update Claude Agent SDK to 0.3.299 (#1834) (3f93e80)
• installer: update Claude Code CLI to 2.1.299 (#1833) (c5613b6)
• monitor: tolerate tick jitter in the interval gate (#1844) (d9bac2a)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:c1a809cbbbd7e1e49015d9f903e0cad473225c8377c05b86945a23beab65ecc8

AgentOS Core v4.87.0

Features

• friends: owner-only reply handles under permits and a retained-state obligation budget (#1819) (cac8924)
• harness: /harness codex selects codex-app-server, codex-acp only as its fallback (#1791) (571ecd9)
• harness: only Claude and Codex in the picker, ACP runtimes in Advanced settings (#1795) (93135f5)
• harness: show nativeExecutors=allow on /harness and ctl status (#1818) (1a86684)
• miniapp: nine basic keys in one Agent card on the settings root (#1827) (5154ae4)

Bug Fixes

• codex-app-server: stop the executor floor from killing the native chat (#1822) (7899f43)
• harness: stop false turnEnded listener warnings on ACP chat sessions (#1829) (2c4f8a2)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:847bb8fae3570befcd6c6c587f522ee053d78a7ae9481c0352bceb583624a814

AgentOS Core v4.86.0

Features

• github: move members' kept GitHub tokens into the token broker vault (#1809) (f961772)
• harness: certify the Codex adapter through the shared turn-port conformance suite (#1679) (9109ac2)
• outbound-gate: owner-only gate evaluator keys with a dedicated Mini App door (#1752) (85cd006)
• skills: lease registry packages and snapshot local roots per session (#1755) (747327b)

Bug Fixes

• access: start the sandboxed shell in the context checkout and close its network (#1808) (0508701)
• access: stop env admins from getting the owner scope on a handed-over node (#1802) (28d62eb)
• codex-app-server: node reactions no longer fork the owner's live thread (#1817) (7967ef0)
• exec: send a detached outcome before claiming it published (#1807) (dd90eac)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:16b1f37d24fa47fb95ffb2d2a65bbf3dcf3db3ced65fd676c3343c01cf8eed7f

AgentOS Core v4.85.0

Features

• docs: serve node notes via agentos_docs topic notes (#1672) (13b2b8f)
• friends: external owner inbox, isolated reader, owner reply form and pre-revoke audit (#1705) (37681e1)
• harness: closed executor floor and fail-closed MCP config for the native Codex operator chat (#1665) (a22e59d)
• routines: ephemeral routines kept in node state for live checks (#1691) (ffc798a)

Bug Fixes

• access: give approved participants without an identity the member role at boot (#1700) (5db7a14)
• agent-sessions: settle a generation's open commands at its terminal (#1727) (bdcecc6)
• cli: skip stopping crash-loop restart units that are not loaded (#1739) (47e26fb)
• codex-app-server: turn latency and toolCalls see Codex turns (#1690) (644d646)
• docs: context_doctor unknown_setting stops warning on dotted names that are not settings (#1682) (6fdab25)
• harness: restrict Codex app-server child environment to SEC-1 allowlist (#1712) (b7924b7)
• harness: switch Codex native sub-agents off by default and patch codex-acp completed title (#1703) (8e0f45b)
• install: quick tunnel ignores host cloudflared config, marked view only (no SSE) (#1671) (af1b26d)
• judge: name the Bash file sources in the judge's tool policy (#1707) (d598faf)
• live-status: do not draw asleep background slots in the live tree (#1718) (9931e08)
• notify: report pre-step routine failures with their error and cause (#1678) (3a9e30a)
• peers: rate-limit legacy-inbox warnings by a stable key (#1699) (8a5b830)
• sync: keep the driver of a deferred turn-boundary save (#1680) (2526161)
• telegram: let core cards through the port, guard reserved callbacks at send_rich_message (#1714) (#1716) (e930941)
• telegram: stop retrying oversized media and add a Bot API root setting (#1681) (54b9f75)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:22d2db4ae89006bed06a3f51f83e4380087a21071ff558cbd40b45ee22c0b782

AgentOS Core v4.84.0

Features

• access: shell for member and group chats as a node setting (#1745) (1d57815)
• exec: wire the node-owned exec executor into the composition root (#1666) (cbdcc6c)
• isolation: per-node model isolation gate with launch-path canary (#1734) (7c7d89f)
• outbound-gate: enable the owner's cancellation window by default (#1664) (5c094c2)
• owner-channel: identity-first private addressing and durable delivery (#1660) (db4b55b)
• reports: central report relay for report_limitation from client nodes (#1797) (5a05650)
• routines: harness: codex alias with implicit codex-acp fallback (#1794) (a977db7)
• skills: management API and owner consent for node skill packages (#1754) (d9b25c1)
• usage: free Codex reset credits with a confirmed owner offer (#1354) (c5cd439)

Bug Fixes

• agent-sessions: a judge pass completes the session and settles the durable step (#1652) (4901603)
• harness: open native Codex chats to members, keep the read-only operator floor (#1640) (5588ee2)
• harness: treat an unsupported codex binary as not installed and name the refusal (#1646) (dc9339e)
• usage: one stale-reading alarm per shared account (#1661) (532ad68)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:b943511e9254fbdbfa6c399366d51acdfd6ee41da0af7459fbb07c8637af0cd6

AgentOS Core v4.83.0

Features

• api: one atomic background admission for routines and durable sessions (#1627) (d661e18)
• harness: codex-app-server is a regular /harness option by default (#1728) (6ce8c98)
• release: write the dist repo's main only through PRs and publish routine-fields.json (#1630) (7a791a8)
• routines: several cron rules and except exceptions in one schedule (#1655) (59d179f)
• telemetry: telemetry-sink slot and owner-only export grants (#1709) (0cdbf3b)

Bug Fixes

• ci: bound Verify's API suites and each runner unit by memory (#1651) (b48eda3)
• github: report_limitation says 'no access to tracker' instead of a raw 404 (#1656) (f051c94)
• harness: retry an ACP adapter start that runs past its deadline (#1657) (ae31c7f)
• harness: steer node messages into a native Codex turn and survive a slow steer ACK (#1649) (7fff5fa)
• notify: settle filtered durable events and expose queue controls (#1771) (d768f63)
• retraction: removing the author's 👎 takes the withdrawal back (#1658) (55a3ddc)
• sessions: deliver durable session outcomes to the operator chat (#1772) (d43c4d3)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:1dd0be81bc5a6a852f161846d3e7665d2605f48fda1f264a158565d73a4402a5

AgentOS Core v4.82.0

Features

• access: apply mcp.externalProfile and access.requireGithub without a restart (#1635) (a8978b5)
• api: taking back an owner approval reaction cancels it (#1659) (da846e1)
• peers: reconnect the peer bridge in generations on peers.* changes (#1633) (f404b7f)
• routines: cross-file lint of reaction map targets and a composed reaction test (#1756) (6e84ef4)
• sessions: list subagents and external workers in node_sessions (#1737) (8700d9e)
• settings: session knobs apply from the next turn without /new (#1629) (c95e1d1)

Bug Fixes

• monitor: retry claim writes rejected by throttling (#1455) (c352ffc)
• routines: run handlers for directly cancelled runs (#1768) (0518f03)
• routines: warn about ineffective exit-code continuation (#1456) (2887d4e)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:c2b6b4430ef5c48f19a80c86d527638e76b9d07bce0feb8fff9f10d943de529b

AgentOS Core v4.81.0

Features

• notify: bind routine bus messages, fold in-place edits, count untracked sends (#1668) (aab89dd)
• routines: reaction actions cancel_run and turn, available_reactions check, input grammar (#1753) (46593ac)

Bug Fixes

• ci: scope the merge-train secret scan to the train's commits (#1744) (6d3961b)

Core image: ghcr.io/try-agent-os/agentos-core@sha256:2493784f2a63f5846abc1a5b85a0215d844aaad497aa7146301823f9583e3ce3