OverClick 0.4.0

OverClick is multi-user: an admin invites an employee into one organization, and the employee works with their own token while seeing only what they created.

• Roles admin and member. The existing user becomes admin; every invited person is born a member of one organization, chosen in the invite.
• An MCP token belongs to a user and acts with that user's role and scope. Every existing token becomes the admin's, so agents keep working as before.
• Cards and missions record their author, whether created on the web or through the MCP.
• A member reaches only the cards and missions they created and the projects of their organization, on the web, the API and every MCP tool. Anything out of scope answers "not found". Aggregates (counters, progress, insights, costs) count only their cards.
• Workspace settings (harness, executors, prices, other people's tokens, invites, team) are admin-only.
• Invites: in Settings the admin creates a single-use link (email + organization, valid for 7 days). The employee signs up through /invite, then lands on /onboarding to run install.sh and pair their own token. There is no open sign-up.
• Team panel: each member shows registered → installed, with the date of their token's first use, and the admin's home shows a notice when a member finishes installing.
• OCL-226: the GitHub release webhook (/api/github/release) now requires a valid X-Hub-Signature-256 made with GITHUB_WEBHOOK_SECRET, and refuses every call when the secret is not set. Self-hosters who use the webhook must set the secret on the server and on the GitHub hook.
• Migrations 0041 (roles, token owner, authorship) and 0042 (invitation) run on boot in a single transaction.

OverClick 0.3.22

OCL-207: release notes are data again, not code run with the repository token.

• The release workflow used to paste this very text into its bash script through a ${{ }} expression. Every backtick ran as command substitution on a runner holding GH_TOKEN, and every double quote ended the argument. v0.3.19 got a Release with each backticked word erased, and v0.3.20 got no Release at all; both were repaired by hand.
• The notes now go from git to a file and from the file to --notes-file. Nothing in a changelog is executed, whatever it contains.
• This Release is the test: if you can read task_update {status: "descartado"} here, backticks and "double quotes" included, the fix works.

Nota do corte: o commit anterior bumpou só os quatro package.json, e o guarda
scripts/verify-release-version.sh recusou a tag — o mesmo esquecimento dos sete
manifestos de plugin que o comentário dele registra do OCL-158. Refeito com
scripts/release-manifests.mjs, que é a lista canônica.

OverClick 0.3.21

The diet batch: every board tool answers with what the next decision needs, and the agent stops retyping what the board already knows.

• OCL-208: the board finds the project from the repository. task_create takes repo (the git remote, owner/repo or the path you work in) instead of a project_id, so filing a card needs no project_list first. project_list answers prefix, name and repo_url only: 24,202 down to 6,214 characters.
• OCL-210: writes stop echoing the text they received and confirm the changed fields instead. task_update ack 2,102 down to 104 characters, mission_update 4,142 down to 146.
• OCL-211: usage by reference. The machine that measured the transcript sends the usage; the agent stops retyping token counts.
• OCL-212: task_deliver keeps evidence in the shapes agents actually write instead of refusing it. 91% of redo calls came from that refusal.
• OCL-213: filing a card without the ceremony. origem is optional and como_confirmo accepts plain text.
• OCL-214: the lost tools/list. The server is cleared; the fix went to the Overclock app (OVKA-754). GET /mcp now answers 405 instead of hanging.
• OCL-215: one Claude Code response is counted once. Transcript lines are deduplicated by message.id.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

OverClick 0.3.20

OCL-203: discard a card over MCP, with its reason, under the same rule as the board.

• task_update {status: "descartado", comment: } now discards an open or a delivered card, and a card in execution under the caller's own claim, an expired claim, or with superseded_by naming its continuation. It stays a manage-token action.
• A live claim held by another executor is refused with INVALID_TRANSITION, naming who holds it and when it expires, and pointing to task_release first. A validated or an already discarded card is refused with why.
• The reason is required unless superseded_by names the continuation. It lands on the card's timeline as "Discarded: …" and, for a card in execution, as the abandoned attempt's note.
• The board's card detail gets a Discard control with the reason. It goes through the same task_update path, so what the board can discard, MCP can too, and a refusal reads the same in both.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

OverClick 0.3.19

OCL-202: the board records the harness that ran; it no longer decides one.

Removed

• The harness policy: harness_list, harness_recommend and harness_set are no longer published, the Harness policy tab leaves Settings, and no policy is seeded on a new workspace. Which CLI, model and effort run a piece of work is decided where it is launched (in Overclock, its per-task Harness table).
• Cards no longer carry a planned harness: task_create stops filling one, a reopened card is no longer escalated along a policy chain, and task_claim no longer answers harness_divergence or writes an executor-swap entry.
• The plugin's opt-in pre-create guard (enforce_harness), which called harness_recommend. Reinstall the plugin to drop it.

Recorded

• task_claim records what actually runs the card (cli, exact model, effort) and every card read returns it as executor. The effort was already stored; it now shows on the card and the briefing asks for it when a claim leaves it out.
• task_deliver keeps recording the measured usage per model.

Transition (this release only)

• task_create, task_update and subtasks[].harness still accept harness: it is ignored and the answer carries a warnings entry instead of an error. task_list and task_search accept include: ["harness"] the same way.

Data

• The planned harness stored on existing cards and the policy rows stay in the database untouched and unread. No migration in this release.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

OverClick 0.3.18

OCL-199: task_update agora registra status validado quando o agente cita a validação explícita do humano no chat. A timeline preserva a citação do ato humano, e a validação ao vivo continua sob responsabilidade do dono.

OCL-200: publicação do fix revisado na release v0.3.18.

OverClick 0.3.17

[OCL-192] Release the six individually delivered OverClick fixes.

• OCL-185: verify private repository deliveries with the workspace GitHub credential and the delivered branch; distinguish missing commits from inaccessible repositories. OCL-181 is the duplicate.
• OCL-187: add task_reopen with a required reason, retained delivery history and rejection context on the next claim. Human validation remains separate.
• OCL-188: expose complete delivery summaries, evidence and artifacts through task_get, with explicit history pagination.
• OCL-189: paginate task_list, support newest-first and creation-date filtering, and isolate claims by executor session. claimed_by: me now requires session_id; claimed_by: token explicitly spans the token's sessions. Plugin hooks and commands send the session identity.
• OCL-191: price GPT-6 Astra using the published standard rates and provide an idempotent recovery command for historical unpriced cards.
• OCL-190: preserve Daybreak identity in claims, transcripts, usage and Insights while keeping billing-rate aliases confined to price lookup.

Includes the task rejection report migration. Historical Astra cost recovery runs after deployment without modifying measured token counters.

OverClick 0.3.16

Corrige as superfícies públicas para exibirem a versão real da release e atualiza o servidor MCP.

OverClick 0.3.15

gpt-reserve agora é um modelo independente no catálogo Codex, com esforços próprios e linha de preço própria.

OverClick 0.3.14

gpt-reserve entra no catálogo Codex e usa o custo publicado do GPT-5.6 Sol.

Consolidação do progresso pendente do board e dos artefatos de design; worktrees antigos removidos após preservar suas mudanças.