v0.16.3

v0.16.3 — Statusline refresh now survives the one-shot command, while the merge gate becomes deterministic and cache-aware

Released 2026-07-30.

What changed

A stale statusline launches one durable refresh for the next render

fix · normal impact

The prompt-facing statusline still reads local cache only and keeps its existing text, JSON, and exit-code contract. When that cache is stale, it now atomically claims a short-lived local lease and starts the canonical a2a sync command as a detached process. The refresh can finish after the one-shot statusline process exits, concurrent prompt renders do not start a herd of duplicate syncs even while recovering an expired lease, and the next render sees the refreshed mirror. The previous in-process goroutine could be terminated by normal CLI exit or race a test fixture's cleanup.

Affects: statusline, local cache, sync

What to do (local): Update if statusline is embedded in a shell or agent prompt; no config change is required.

Check: a2a version

a2a update --yes

The ordinary CI gate no longer depends on ambient Git identity or a cold duplicate Go cache

fix · low impact

Git-backed tests now receive a process-local fixture identity, the checkout-owned validation runner has a documented scoped-test entrypoint, GitHub's setup-go cache feeds the exact build cache consumed by make check, and workflow syntax validation fails closed with pinned actionlint. The public-only classification backstop no longer rejects the private source repository, and CodeQL has the read scope its analyze step needs under restrictive workflow permissions. CodeQL execution is scoped to the public repository where code scanning is enabled; private CI keeps its gosec, govulncheck, and gitleaks gates without spending minutes on an upload GitHub will refuse. Lifecycle wire parity retains every case while reusing one immutable repository fixture.

Affects: contributors, GitHub Actions, make check

Standing known issues no longer disappear on the next update

fix · normal impact

Current limitations now live once in a schema-validated standing list instead of being copied into every version file. a2a whatsnew, its MCP twin, the HTML release view, and the authored GitHub Release body append that list independently of the selected version range, including when there are no newer change entries. The existing release-array machine shape remains unchanged, and a resolved issue is removed in one place.

Affects: a2a whatsnew, a2a_whatsnew, release notes, release workflow

The v0.16.3 runtime candidate passed all 50 declared live cells

policy · low impact

The immutable public runtime candidate d6418b9 completed the full protected GitHub matrix with two independent identities: 50 pass, zero fail, zero timed-out, and zero not-run cells across CLI, MCP, lifecycle, contracts, authorization boundaries, failure recovery, thread reconstruction, and space migration. The audit observed 179 workflow runs; its two red runs were the expected and explicitly claimed cross-section boundary probes. The final tagged tree differs from that runtime candidate only by this evidence statement and the matching README baseline; local gates, release preflight, renderer checks, and the filtered-public leak proof are repeated on the exact tag candidate.

Affects: release confidence, GitHub live E2E

Known issues

The macOS companion remains ad-hoc signed and may require manual approval

known issue · normal impact

The release cohort authenticates the exact macOS app and ad-hoc signing protects its bundle integrity, but the app is not identified or notarized through a paid Apple Developer account. A quarantined download may require one explicit System Settings → Privacy & Security → Open Anyway decision. Interactive Notification Center, Focus, Login Items, VS Code trust/profile, and remote-window checks remain release-environment evidence rather than claims inferred from hermetic tests.

Affects: macOS notifications, VS Code notifications

Current guidance: Keep Gatekeeper enabled and approve only the A2A Notifier version obtained through the verified a2a release cohort.

Install or update

macOS and Linux:

curl -fsSL https://raw.githubusercontent.com/ydnikolaev/a2ahub/main/scripts/install.sh | sh

Already installed? Run a2a update --yes. Windows archives and manual downloads are in the assets below.

Release artifacts include checksums, per-asset Sigstore bundles, SBOMs, and SLSA provenance. See SECURITY.md for verification commands.