v0.3.0 — Reactive access

Access stops being a map you draw up front. In 0.3.0 the connections between
people and agents form at runtime: an unknown sender's first message is held,
the agent's owner approves it, and the edge exists. The org chart grows one
approved connection at a time instead of being wired ahead. The story behind it:
a living org chart for agents.

Access model

• Single ACL store. Pairing is gone; acl.json is the one grant map, with an
  allowed / rejected polarity pair and an origin-keyed, three-state gate
  (granted / rejected / askable). The separate paired-users.json store is retired.
• Reactive first contact. An unknown sender's first message is held and
  raised to the agent's owner as an approval, with the message body in the card.
  Approving writes a standing grant; the Access tab lists and revokes them. Held
  senders see a pending notice; duplicates dedup, hammering goes quiet.
• Cross-agent edges form the same way. An askable agent-to-agent denial raises
  an owner-directed approval, so the org map grows at need. Hand-authored grants
  still work when you already know two agents belong together.
• Owner claims. A human owner is bound through a verification loop; owner
  identity anchors approval routing, with the operator sentinel as fallback.
• Bit vocabulary. The h (host) bit is removed — a cross-agent push rides the
  carried user's own io grant. p returns as the framework-written
  push-containment edge. Agent peers stay restricted to q/r/a/p.

MCP transport reliability

• Per-conversation socket paths gain a per-spawn nonce, so a superseded runner's
  teardown can no longer unlink the live runner's socket.
• The in-container proxy recovers: transport reconnect with write-safe retry and a
  15s call timeout. Host-side SSE keepalive on every session.
• Cold-spawn inbound messages are recorded in message_log, closing the audit gap
  on the first message of every conversation.

Runtime & tools

• request__list defaults to open requests (outbox model) with a status filter for
  history.
• Denial durability: framework corrections (blocked outbound previews) land in
  message_log as system rows, auditable after the fact.

Breaking changes

• Pairing is removed and the acl.json schema changed (peers → allowed,
  now .strict()); the per-agent approvals table and outbound_requests gained
  columns. An un-migrated 0.2.0 install will not load. Run the migration before
  starting 0.3.0.
• The h permission bit is removed from the vocabulary.

Upgrading from 0.2.0

Stop the server, then run the idempotent scripts in
scripts/migrations/0.2-to-0.3/ — dry-run by
default, --apply to write. Its README also covers extension-stored reply targets
and the manual blueprint-cleanup pass.

Install

git clone https://github.com/yaodub/cast
pnpm start

Still developer alpha — rough in places. If something breaks, tell me:
yao@getcast.dev.