v0.82.0

Added

• Codex worker lane: the production execution and advice adapter, still dark (#1220, #1171, #1106).
  Behind the scenes and not user-visible yet: connects the Codex credential, harness-boundary and image-packaging groundwork from 0.79.0 and 0.80.0 into a complete Codex run and advice adapter. Worker-owned callbacks, not Codex-native tools or hooks, own shell, file and patch edits, skills, workflow signals and delegation; an immutable per-run registry and a matching-epoch safety permit guard every durability and publication sink; provider roots are OS-isolated so credentials are inaccessible rather than merely absent from the environment; and subscription refresh runs through the API-owned coordination flow. Public Codex routing stays disabled, so saving a Codex credential still cannot create a Codex run through any of today's paths, and the Claude worker path is preserved unchanged.

v0.81.0

Added

• On-demand MR rework past the automatic cap, with optional guidance (#1202).
  An owner can start one rework cycle on a completed run whose MR is open even after the automatic cap, from the run page's Rework now control, uzi run rework <run-id> [-m <guidance>], or POST /api/runs/{id}/rework. It bypasses the cap, debounce, staleness and green-pipeline gates while keeping the branch, one-active-rework, kill-switch, token and open-MR guards. The cycle never counts against the automatic cap and atomically advances the consumed high-water so the watcher does not repeat those comments. The cap halt comment and notification now point at this action.

• The Judge page's group expander now shows the newest occurrence's full rationale, and gains a select-all checkbox (#1183, #1211).
  Expanding a group fetches and renders the newest open occurrence's complete rationale above its occurrence list, in place of the clamped preview shown before you expand; a "Select all N shown" checkbox above the group list ticks every group currently on screen, for a bulk Mark done or Dismiss in one pass.

• uzi findings stats and uzi findings undo <id> join the findings CLI, and list/review backlog catch up on rendering (#1183, #1212).
  uzi findings stats prints your Findings triage totals across every repo you own (or one, narrowed with --repo), the same number the web nav badge and tabs show; uzi findings undo <id> reverses a dismissal, keyed on the coordinate's disposition_id, which only --json surfaces (the human list view still prints the finding_id that file/dismiss use); uzi findings list --bucket now also accepts done, and a dismissed row prints its reason while a done row prints "Done via #N"; uzi review backlog's group line now reads "N open of M runs" (or "M runs, all settled") in place of a flat seen-in-N-runs count.

Changed

• Judge and the run page's judge panel now share one triage row and one vocabulary (#1183, #1211).
  Every open recommendation, on /judge and on the run page, now shows File issue · Mark done · Dismiss ▾ at equal weight in one row, replacing the run page's lone File issue button on its own line and /judge's per-run File issue buried inside the occurrence expander; the open state reads "To triage" everywhere it appears, the tab, the chip, the strip, and the status line, and a filed recommendation reads "Filed #N" in the same slot. On /judge, File issue no longer needs the expander open, it drafts straight from the group's newest open occurrence, the most recently judged run still open, tracked by a new judged_at field on the judge backlog occurrence API, while the group's other open runs stay open until you mark the whole group done.
• The Findings backlog now matches Judge's triage page, including a filed finding turning Done when its issue closes on the forge (#1183, #1212).
  Findings gains five counted tabs (To triage, Filed, Done, Dismissed, and a returning All), each coordinate can show its evidence and the runs it was seen in behind a row expander, a Dismiss ▾ menu offers Won't do and Not an issue with multi-select bulk dismiss and Undo from a toast, and once the issue you filed from a finding is closed on the forge uzi marks it Done by itself (labelled "Done via #N"), reopening it if the same bug reappears in a later run.
• Appearance and Demo mode moved to their own Settings › Appearance tab (#1208).
  The theme / mode / typeface controls and the per-device Demo mode toggle now live on a dedicated Appearance tab, second after Account & tokens, instead of as cards buried inside the Account & tokens tab. The controls behave exactly as before (only their home changed), and Account & tokens no longer lists appearance in its description.
• The board search and toolbar are left-anchored on their own row (#1208).
  On a wide viewport the board's search and controls no longer fling to the far-right edge with a dead gap after the title: they render as their own full-width row beneath the board title, left-aligned at every width, so search stays top-left and a wide window matches the normal-width layout. Sticky positioning, the /-to-focus shortcut, and Esc-to-clear are unchanged.
• Boards open with empty columns hidden by default (#1208).
  The Hide empty toggle now defaults on, so a board you have never configured opens without its empty label lanes. The choice is still remembered per board, so a board you explicitly set to show empty columns keeps showing them.
• A worker follows a symlinked root instruction file in a cloned repo safely, and reads an untracked one (#1219).
  The agent now loads a repo's root instruction file (CLAUDE.md / AGENTS.md) when it is a symlink, but only when the link resolves to a regular file inside the repo and outside .git; unsafe, broken, looping, escaping, non-file, and .git-targeting symlinks are ignored. An untracked or generated root instruction file is now picked up too, so the file is read before dependency install as before.

Fixed

• Resumed and recovering runs keep their approved plan and survive an empty SDK turn instead of failing terminally (#1197, #1213).
  Autopilot now persists the approved plan before implementation, so a run resumed on another worker uses that plan rather than silently re-planning; it retries a positively empty SDK turn with bounded, budget-accounted backoff rather than failing the run, while still honoring real timeout, pause and cancellation outcomes; and it adds an automatic recovery_wait with server-owned capped backoff that requires a verified local checkpoint before a promotable park, so a failed capture retains and retries its source clone instead of reseeding destructively. Duplicate claims serialize through cleanup, and park/cancellation reports retry instead of abandoning a live claim.
• The sweeper logs a pass that only promotes a run out of limit_wait or recovery_wait (#1218).
  A tick whose only effect was releasing a rate-limit-held or recovery-held run left no log line, resuming the run invisibly; both promotions now count toward the "pass did something" total, so the sweeper pass line reports them.

v0.80.0

Added

• Pause a running run and resume it later, right where it left off (#1190).
  A run's owner can now park a running issue, task, prompt or self-improve run on demand, after the milestone in flight (the default) or immediately with --now, which drops the turn in flight and discards work since the last checkpoint, and resume it later with the remaining budget untouched, since the clock stops rather than resetting while it waits. The worker publishes a checkpoint before parking, so if that publish fails the run stays running and the owner is told in its activity feed instead of losing the park silently; resuming continues the same session on the original worker or recovers the branch and re-plans only the unfinished milestones on another. Reachable from the run page (a ‖ Pause ▾ menu, a pending-pause chip, a Resume button), the CLI (uzi run pause <id> [--now|--cancel], uzi run resume <id>), and the TUI (a ‖ paused word and detail line, read-only).
• Three light themes: Dawn, Hall, and Shadow (#1167).
  Each keeps the dark factory somewhere on screen: Dawn stays dark only on machine surfaces (the run activity feed, code/log/CLI blocks); Hall adds a dark sidebar and mobile top bar; Shadow additionally keeps a board card, run row, or run header dark while that run is actively working, staying light with a rust accent while it waits on a human. All three share one WCAG 2.2 AA-verified light palette and reuse ember's own dark values for every dark surface, so a machine pane looks identical across every theme.
• A System / Lights on / Lights off appearance mode, with one theme held per polarity and matching admin instance defaults (#1167).
  Settings → Appearance now holds a mode alongside a "Lights on theme" and a "Lights off theme"; System follows the OS's prefers-color-scheme live, with no reload. An admin can set the same four fields (mode, light theme, dark theme, typeface) as instance-wide defaults from Admin → Instance settings; the legacy single "Default theme" keeps feeding the dark slot, so nobody's screen changes on upgrade.
• A bundled IBM Plex typeface option (#1167).
  Settings → Appearance gains a Typeface choice: System (the platform default) or IBM Plex, shipped with the app so switching to it makes no external font request and the System choice downloads nothing.
• Further foundational work toward a Codex-based worker lane (#1171, #1106).
  Behind the scenes and not user-visible yet: completes the Codex production adapter and execution-safety milestone (M3b), building on the credential and packaging groundwork shipped in 0.79.0.

Changed

• The slow run-health flag is now a budget-relative "near timeout" warning instead of a bare wall-clock timer (#1170).
  It fires once a run's active running time (wall clock since start, gate waits excluded) has used a configurable share of its wall-clock budget (default 85%, health_near_timeout_pct replacing health_slow_seconds); the flag reads "near timeout" everywhere, and the badge, TUI, and CLI human views now count down the time left to the deadline (e.g. 1h 5m left) instead of the time since it was raised, while Slack relabels the flag and glyph without a countdown and the machine-readable health field keeps reporting slow.
• Workers enumerate a repo's skills from both .agents/skills and .claude/skills (#1205, #1206).
  A cloned repo that keeps one real .agents/skills tree with .claude/skills as a directory symlink (the cross-agent layout) is now read correctly: the worker reads both real roots, .claude/skills winning on a name collision, and rejects a symlinked skills-root parent so the containment boundary still holds.
• The Codex credential import flow and status badges now explain themselves (#1177).
  The Codex credential import screen and the per-worker Codex credential status badges carry clearer labels and help text, so importing a Codex credential and reading its state no longer needs outside context.

Fixed

• TUI in-progress milestone markers render correctly with several milestones running (#1176).
  The in-progress milestone glyph no longer falls back to a mismatched font, and the per-milestone micro-bars now blink for each in-progress milestone instead of only one cell when several are in progress at once.
• The admin per-user usage breakdown's SHARE% column sums to 100% (#1185).
  Independent per-row rounding could make the column total 101%; the shares are now apportioned so they add up to exactly 100%.

v0.79.0

Added

• The bundled uzi-cli skill now installs to Codex CLI as well as Claude Code (#1143).
  uzi skill install|install-hook|status|uninstall-hook take --target claude|codex|all; Codex gets the skill at ~/.agents/skills/uzi-cli/SKILL.md and a SessionStart hook in $CODEX_HOME/hooks.json (review it once with /hooks). Automatic install adds Codex only when its config home already exists.
• Slack DM when a usage-limit-paused run resumes (#1116).
  A run parked on an Anthropic usage limit already posts a ⏸️ Paused reply into its Slack DM thread; now the first time it is back to running it posts a single ▶️ Resumed reply into the same thread, carrying how long it waited and (from the second pause) the pause count (a resume straight into the plan gate, a question, or a terminal state is carried by that reply instead), deduped through the per-run Slack anchor so a redelivered running report never re-posts.
• CI-autofix is now on by default (#1109).
  A failed pipeline on an agent/issue-N branch now auto-opens a ci_fix run with no opt-in, mirroring mr_rework: an admin instance-wide kill-switch (ci_autofix_enabled, default on) plus a per-user tri-state (inherit / on / off), with the detector reading the setting fail-closed so a settings-read blip never fails open.
• Scheduled jobs support output modes (#929).
  A scheduled sweep can now be configured for how a fire delivers its result.
• The early rate-limit reset alert now fires on any early clear (#1114).
  The Slack heads-up for an Anthropic 7-day limit resetting early previously fired only while a token was actively constrained; it now fires on any early clear through two independent arms, so a reset that lands before you hit the wall still notifies.
• Worker disk-space observability and nix-store pressure handling (#1113).
  Workers now report disk-space stats and react to nix-store pressure, so a filling worker surfaces before it strands a run.
• Foundational work toward a Codex-based worker lane (#1106).
  Behind the scenes and not user-visible yet: concurrent-run Codex credential binding (#1154), extraction of the Claude harness boundary with no behavior change (#1153), and Codex image packaging with an isolated launcher (#1160).

Changed

• Default reasoning effort is now xhigh for users who have not chosen a level (#1157).
  Runs whose owner never picked a reasoning-effort level now dispatch at uzi's own default of xhigh instead of the Claude Agent SDK's built-in high; an explicit choice (including high) is honored unchanged, and the Settings picker now labels the inherit and xhigh options as the uzi default.

• The retrospective judge lane now inherits the run owner's reasoning-effort setting (#1162).
  A judge run over your finished runs now dispatches at your chosen reasoning-effort level (uzi default xhigh when you haven't chosen one), instead of falling through to the Claude Agent SDK's own built-in default of high; the judge_model setting is unchanged.

• The Findings surface in the web UI now uses a bug glyph instead of the warning triangle (#1139).
  The sidebar nav item, page header, empty state, and run-view finding card for Findings ("off-task bugs your workers flagged mid-run") switch from the AlertIcon warning triangle to a new BugIcon, keeping the sky/info tint; AlertIcon stays the genuine-warning glyph everywhere else (e.g. the missing-sweep-labels notice).

• Anthropic bind mode defaults to auto for every new worker and the judge lane (#1140).
  A newly created worker, and the judge lane, now bind their Anthropic credential in auto mode by default instead of needing an explicit choice.

• The TUI run-detail view loads progressively (#1137).
  uzi tui now renders the run first, then backfills history tail-first (?tail/?before), caps payloads (?payload_max), memoizes the transcript, and refetches incrementally, so a long run's detail opens fast on a slow link.

• A clearer in-progress milestone marker in the TUI (#1136).
  The in-progress milestone now shows a tungsten micro-bar cell and faint blinking half-circle rail rows.

• TUI board polling is hardened on slow or flaky connections (#1130).
  The board poll gains an in-flight guard, a per-poll timeout, and error backoff, ending the "context deadline exceeded" flood on slow links.

• Internal: the dead runs.lineage_epoch column was dropped (#1079).
  The deferred contract step from the per-leg usage fold; no user-visible effect.

Fixed

• mr_rework no longer fires on a review bot's summary-only comment (#1142).
  The rework trigger now counts only actionable review comments, so a CodeRabbit walkthrough/summary note (or a "no actionable comments" post) no longer queues a rework run or advances the high-water; a human top-level note and any inline finding still count.

• In-flight mr_rework runs are cancelled when an issue's MR is locked or closed (#1125).
  Closing or locking the issue's MR now stops a rework run still working it, instead of leaving it running against a settled MR.

• The board no longer stale-overwrites a just-applied move, close, or reopen (#1119).
  A mutation-generation guard keeps a slow board poll from clobbering a change you just made.

• Forgejo issue state and description edits use a field-only PATCH (#1058).
  Changing a Forgejo issue's state or description no longer round-trips the title.

• A worker preserves push_secret_blocked as the failure origin when the terminal report throws (#1077).
  A push blocked by secret-scanning is still attributed correctly even if the final report step then fails.

• Worker overlay checkpointing reconciles a lost publish ACK before chaining the next overlay (#1036).
  A checkpoint whose publish ACK was lost is reconciled first, so the next overlay does not chain onto an unconfirmed state.

• The controller detects a stranded Pending PVC after a disk recycle within a bounded timeout (#837).
  A worker PVC left Pending after a disk recycle is detected within a bounded timeout instead of hanging.

• report_md is scrubbed before it is capped (#1127).
  clampWireReportMd now redacts before truncating, so a secret near the length cap cannot survive into the wire report.

• Mock mode: three mockApi paths were realigned with the real backend (#1111).
  The mock/demo build's schedule paths now match the real API shape.

• model-pass HOME cleanup no longer races the aborted SDK CLI on the timeout path (#1110).
  On a timeout abort, HOME cleanup waits for the SDK CLI to exit instead of racing it.

• Schedule.next_fires handles the null the wire sends for once-schedules (#982).
  Two index sites are guarded and the type widened, fixing a crash on once-schedules.

• judge-runner JSON extraction scans later balanced candidates when the first object fails to parse (#911).
  A judge response whose first {…} block is not the verdict now falls through to later balanced candidates instead of failing.

v0.78.0

Added

• Pause every schedule at once, with an optional auto-resume (#1093).
  A new user-level kill switch pauses every schedule you own, catalog defaults and your own alike, on every repo, with an optional until that auto-resumes on its own with no background job; a recurring schedule due while paused records a benign schedules_paused skip and keeps advancing its cadence so nothing replays on resume, a one-time schedule instead waits and fires once the pause lifts, Run now still bypasses the switch, and runs already in flight are untouched. It's reachable from the Schedules page (a "Pause all" control, an inline picker, and a paused banner), the CLI (uzi schedule pause-all --until <when> / resume-all / pause-status), and a paused fire's Last fire record.

Changed

• Agent roles re-synced to skills ff87616: fact-checker v9, architect v8 (#1080, #1095).
  Both .claude/agents/ and the shipped builtins pick up vtmocanu/skills#41: the fact-checker's defect fold runs in a detached throwaway worktree and its description says so, the architect's write surface is the design-doc directory its tail names and never specs/; the vendored role manifest moves to ff87616. CLAUDE.md's run-economy rework rule now names every high-risk class (trust-boundary, data-integrity, auth, untrusted-input), matching the lead builtin.

• Builtin agent-team role templates re-synced to the upstream skills library (#1080).
  The eleven library-derived builtins under api/internal/agenttmpl/builtins/ were ported to the terser upstream bodies with new version stamps and the library's model choices (researcher moves to sonnet), keeping uzi's main-recipient wording and fact-checker's forge tools; lead gains the run-economy rules and the vendored role manifest is refreshed to b5288fd.

v0.77.0

Added

• The board, run view and crew rail now show what your crew is doing right now, not just which milestone is "done" (#1064).
  A milestone reported in progress gets a live "now" line naming the active lane's role, its task label, its last tool and an age, sourced from the run's newest tool-use frame (never a raw Bash command). The web run view, dashboard/runs-list cards, the TUI's crew rail and board second line, and uzi run get's new NOW row all read the same server-derived current_activity field on the run, so the four surfaces cannot disagree; the web milestone badge also gains a ◐ suffix when a milestone is in progress.
• The TUI's in-progress milestone cell blinks instead of sitting static (#1064).
  The board's micro-bar and the crew rail's milestone row alternate ▰/▱ in the wait colour on a half-second tick. A piped or offline render, or UZI_TUI_NO_BLINK=1 (a reduced-motion opt-out), pins the static ▱ frame instead of blinking.
• A milestone shows as in progress the moment the worker reports it, instead of only at the next turn boundary (#1064).
  The worker now pushes a running state report the instant it observes a report_progress signal, rather than waiting for the next iteration or checkpoint report to carry it, and emits a feed line per transition ("milestone m2 started — <title>" / "milestone m1 reported complete — <title>"). Wording always says "reported complete", never "done" or "verified" — uzi shows what the worker reported and has not itself checked the work.
• The Workers page is split into "Your workers" and "Add a worker" tabs, hosted-first (#1063).
  The page leads with your running fleet and moves the join/enrol flow onto its own tab, so managing existing workers and adding a new one are no longer crammed into one screen.
• Scheduled runs can now fix their own MRs and CI (#1069).
  Autofix (MR rework and CI autofix) now covers the scheduled prompt and self_improve run kinds, not just interactive issue runs, so a scheduled run that opens an MR can rework it on review feedback and repair its own red pipeline.
• A throwaway TUI sketch harness for previewing a new TUI feature before building it (#1061).
  uzi tui --sketch renders a preview surface on the uxlab harness so a TUI change can be seen and iterated on before it is implemented; it is a development aid and never lands on main as product behaviour.

Changed

• Forge checkpoints now cover the non-issue run kinds (#1037).
  self_improve, chat, prompt, mr_rework and ci_fix runs now publish forge checkpoints like issue runs do, so a parked or interrupted run of any kind can resume from its last checkpoint instead of losing work.
• The worker runs a pre-push secret scan at finalize and reports a typed failure origin for GitHub push protection (#1076).
  Before pushing a finished branch the worker scans the whole push range for secret-shaped strings, and a GitHub push-protection rejection (GH013) now surfaces as a typed fail_origin with the finished work preserved, instead of an opaque push failure.
• Dependency: bump gitlab.com/gitlab-org/api/client-go to v2 (#1067).

Fixed

• Hosted worker: agent-browser starts out of the box on the musl image (#1082).
  The shim now picks the native binary by the dynamic loader on disk instead of letting the npm launcher sniff ldd --version off the PATH, where a provisioned nix glibc (uzi's own ruby@4.0.6) shadowed musl's ldd and made it spawn the glibc build; the image build guard repeats the check behind a fake glibc ldd and opens about:blank through the shim, so a regression reddens the build rather than costing a subagent ~15 tool calls mid-run.
• Run cost was under-counted on every multi-iteration run, by as much as 3.8x (#1079).
  run_usage assumed each SDK result frame reported a cumulative session total and kept only the largest one (a 3-iteration run read $77.19 against a true $153.58, a 7-iteration run read $26.70 against a true $100.63); it now keys each row by the SDK query() leg that produced it and sums the legs, and every pre-existing run's totals were automatically re-folded from history on first boot after the fix.
• A branch behind main only on .github/workflows no longer loses work at checkpoint time (#1036).
  The broker PAT lacks the workflow scope, so a checkpoint of a branch that is behind on workflow files was skipped and a run that then died lost its work; the worker now synthesizes a wrapper commit whose workflow subtree matches the current default so the unchanged broker can push it, and adoption peels the wrapper back off.
• Checkpoint adoption unified on the owner anchor (#1059).
  A resumed run now adopts its checkpoint tip through a single owner-anchored path, closing the residual work-loss gaps from the earlier checkpoint machinery so a resumed run keeps its lineage instead of breaking it.
• self_improve owner-key reader missed pre-#774 flattened tracking-owner stamps (#887).
  Across the #774 rollout window the owner-key reader could miss the older flattened tracking-owner stamp form, so a self_improve run could fail to recognise its own prior work; it now reads both stamp shapes.

v0.76.0

Added

• Close or reopen an issue straight from the board (#1051).
  The Closed column is now a drop target on every forge (GitHub, GitLab, Forgejo): drag an open card into it to close the issue, drag a closed card back onto any open lane to reopen it and move it in the same drag. Closing leaves the card's column labels untouched, so it is the forge open/closed state that puts it there, not a label; a reopened card lands at the bottom of its destination lane. The write is forge-first, so a failed close or reopen snaps the card back. Closed issues also sync to a linked project board's Done status where one is available. No new lane is added: the board still reads Backlog, Planned, In Progress, Human Review, Later, Closed.
• Slack DM alert when your Anthropic 7-day rate limit resets early (#1020).
  A new opt-out setting (on by default) fires a loud Slack DM, plus a durable inbox notification, when uzi's usage poller sees your weekly window reopen more than 8 hours before its previously expected reset; it only notifies and does not resume parked runs early.

Changed

• Worker resume durability. A run now carries an owner-anchored checkpoint tip (runs.checkpoint_tip) with a CAS-delete and adoption guard (#1053), and holds worker affinity through a fleet roll with reliable forge checkpoints, so a resumed run keeps its lineage instead of breaking it (#1041).
• Dependency and security bumps. api golang.org/x/crypto CVE fix (#1050) and the Kubernetes client-go monorepo for the controller (#1039).
• Internal refactor sweep (epic #915): large source files split into per-seam files, with no behavior change. forge drivers (#1040), the slacksvc notifier (#1038), the handler route table (#1023) and the schedules and workers handlers (#1056), the settings domain (#1029), the uzicli client (#1027), the api/cmd/uzi CLI (#1028), the controller render.go DinD renderer (#1054), and web page component extraction from RunView and Board (#1018) plus Judge.tsx into pages/judge/ (#1055).

Fixed

• GitHub integer conversion in the forge driver (#1052).
• Default an empty label color on GitLab EnsureLabels (#1035).
• Bound the notification page offset so an out-of-range value returns 400 instead of a bad query (CodeQL alert 28, #1019).

v0.75.1

Fixed

• GitHub Actions pipeline now detected on agent branches; pipeline_ref no longer stays null (#1010).
  The ci_fix and mr_rework flows could not detect a GitHub Actions pipeline on an agent branch, so pipeline_ref stayed null and CI-fix and MR-rework never triggered; the GitHub forge driver now resolves the branch pipeline.

Changed

• run-kind registry: one Go source of truth for runs.kind (#997).
  The eight run kinds are now sourced from a single Go registry with parity-pinned agent and web mirrors, replacing the previously duplicated kind tables; no runtime behavior change.
• API contract fixtures pin the hot DTOs against the web types (#1000).
  Differential wire-shape tests compare the Go apitypes/handler DTOs to web's apiTypes.ts so the two cannot silently drift; internal test infrastructure, no product behavior change.
• mockApi split into per-domain modules (#1011).
  The web mock API under web/src/mocks/mockApi/ is now composed from per-domain modules into one typeof-realApi object; internal refactor of dev/test infrastructure, no UI behavior change.
• Web generation-counter copy deduped into useAsyncData (#1012).
  Judge.tsx and the deferred() test fixture now reuse useAsyncData's generation-counter instead of a duplicated copy; internal refactor, no behavior change.
• Routine dependency bumps: @anthropic-ai/claude-agent-sdk to 0.3.246 (#987), gitlab.com/gitlab-org/api/client-go/v2 to v2.59.1 (#988), and actions/upload-artifact to v7.0.1 (#989).
  Routine updates; the agent-SDK bump is additive (user_message_uuid, costBasis, modelPricing, perTaskStopAffordance) with no uzi code change required, and the upload-artifact major only raises the runner floor that GitHub-hosted runners already meet.

v0.75.0

Added

• Propose-only refactor-scout refactoring default added to the schedule catalog (#962).
  A new opt-in catalog default that periodically surveys a repository for refactoring opportunities and reports them, without opening code changes on its own; off by default and enabled per repository like the other catalog defaults.
• Configurable MR review quiet period, plus expanded end-to-end harness coverage (#976).
  Adds a MR_REVIEW_QUIET_PERIOD setting controlling how long the MR review watcher waits for a review to settle before reworking, and rebuilds the e2e test harness around a phase registry with fail-soft reporting and run-kind/schedule coverage.

Changed

• httpx.PathUUID helper for the repeated uuid.Parse(chi.URLParam) handler pattern (#952).
  Internal refactor consolidating the handler sites that parse a UUID path parameter onto one helper, with no change to request handling.
• workersvc/service.go split, with a shared boolSetting helper (#955).
  Internal refactor breaking up the worker service file and extracting a boolean-setting helper, with no runtime behaviour change.
• Agent run god-methods split into phase steps (#957).
  Internal refactor extracting phases out of the agent's RunRunner.execute() and SdkExecutor.run() methods, with no change to how a run executes.
• Web load/loading/error fetch cycle consolidated into a useAsyncData hook (#958).
  Internal refactor replacing the hand-rolled load/loading/error/reload pattern repeated across the web pages with one shared hook.
• forgesvc/projectsync.go split by concern (#975).
  Internal refactor separating provision/seed, forward and reverse sync, and visibility/share into their own files, with no change to sync behaviour.
• pgconv package consolidating the duplicated pgtype parameter helpers (#977).
  Internal refactor unifying the repeated pgtype conversion helpers with explicit Text vs TextOrNull semantics, with no change to stored values.
• Web file splits: api.ts DTO types, AdminSettings cards, and mocks/data.ts domains (#978).
  Internal refactor breaking large web modules into focused files, with no UI behaviour change.

Fixed

• Notifications page recovers after a failed Load more, and stale errors clear on refetch (#973).
  Post-migration follow-up to the useAsyncData hook: the Notifications list is no longer stuck hidden after one failed Load more, promote/save/schedule mutation errors clear when their view refetches, unguarded side-effect fetches are guarded against stale responses, and a disabled hook no longer reloads.
• Evicted zombie pod no longer permanently badges a healthy hosted worker "Upgrade failed" (#953).
  The controller stopped treating a leftover evicted pod as an upgrade failure, so a healthy hosted worker keeps its correct status.
• Secret scrubbing hardened, with fail-safe token handling and a request size limit (#968).
  Widened secret-prefix detection (including the Slack xoxe- family), a fail-safe default in TokenInfo, and a 413 on oversized JSON request bodies, pinned by characterization tests.
• Release publish jobs tolerate a transient cosign download failure (#946).
  The image and chart signing jobs now install a pinned, checksum-verified cosign through a local action that retries the download, so a one-off TLS hiccup on a runner no longer fails a publish job and stalls the GitHub Release (issue #945).

v0.74.0

Added

• Per-user setting to disable AI attribution in worker commits and MR descriptions (#942).
  A new per-user toggle in Settings lets each user opt out of the AI attribution that uzi's worker adds to its git commits and merge-request descriptions; the current attribution stays on by default, with a backfill migration for existing users.

Changed

• Forge driver internals consolidated: shared wrapErr, bounded rawGet, and a pagination helper (#937).
  Internal refactor across the GitLab, Forgejo, and GitHub drivers extracting shared error wrapping, a size-bounded raw GET, and a common pagination helper, with no change to forge behaviour.
• Shared forgetest.BaseFake behind the forge.Forge test fakes (#939).
  Internal refactor giving the forge test fakes one shared base implementation so a new interface method no longer has to be hand-stubbed in each, with no runtime behaviour change.
• Agent read-only model passes consolidated into runReadOnlyModelPass (#931).
  Internal refactor unifying the agent's read-only model passes (judge, review, chat) onto a single helper, with no change to what those passes do.
• Web mechanical dedup: shared errorMessage() and useNow() helpers (#935).
  Internal refactor extracting repeated error-message formatting and current-time logic into shared helpers across the web components, with no UI behaviour change.
• Dependency bumps: @anthropic-ai/claude-agent-sdk to 0.3.245 (#923), agent-browser to 0.35.0 (#924), and gitlab.com/gitlab-org/api/client-go/v2 to v2.59.0 (#925).
  Routine dependency updates; the agent-SDK bump is patch-level parity with Claude Code (0.3.242 through 0.3.245) with no uzi code change required.

Fixed

• Selected floor-row title stays legible on light terminals in the CLI TUI (#940).
  The selected floor row's title in the TUI board was drawn in a colour that vanished against light terminal backgrounds; it now keeps contrast in both light and dark themes.