v0.1.0-beta.9

The desktop app (.deb, .AppImage, .dmg, .msi below) is unsigned:
signing certificates are a separate, not-yet-made decision. Two
one-time warnings to expect on first launch:

• macOS: Gatekeeper blocks the unsigned app on a normal double-click.
  Right-click (or Control-click) the app → Open → Open in the
  dialog. Only needed once.
• Windows: SmartScreen will warn about an unrecognized app. Click
  More info → Run anyway. Only needed once.

[0.1.0-beta.9] - 2026-09-21

Added

• runner: Resolve secret references through a runner-local secret store
• cli: Add tack service install|uninstall|status
• projects: Give a project its own default agent model
• api: List an attempt's artifacts and decisions
• desktop: Add the tack-desktop Tauri shell and its supervisor
• frontend: Stop the run-with-agent modal asking for five typed fields
• desktop: Give the app a real per-user data root and a first-run choice
• desktop: Keep the app alive behind a tray icon when the window closes
• runner: Route claude-code and codex through a configured provider endpoint
• runner: A Provider trait and registry replace the Vercel-only match arms
• api,cli,frontend: Turn the embedded runner on and hand it a key from the UI
• orch,runner: Carry per-model price, context window and modality on the wire
• frontend: Compose the Agents page from an installed binary to a completed attempt
• desktop: The tray reports the runner's real state, and stages the binary cargo built
• api: Let a caller ask for one item's executions, and bound the answer either way
• executions: The badges ask for the items on screen, not the newest N install-wide
• smoke,docs: Prove the stranger's path, and close Part VI
• frontend: Graphite goes dark olive with white on-accent
• tack-orch: Implement DocketAdapter::dispatch against POST /dispatch/{project}
• orch: Read a dispatched pipeline run back by its own id
• release: Generate the changelog and release notes from commit history
• ix-m5: Extract LocalProcessHarness/HarnessGrammar, migrate codex
• ix-m5: Migrate claude_code onto LocalProcessHarness (phase 2/3)
• ix-m9: Ratchet maintainability check to the target budgets
• ix-x2: Add shared bounded-poll helpers to tack-test-support
• runner: Docket as a harness
• runner: Opencode as a harness
• runner: A harness can pause and ask the operator
• A run can ask before it acts — the board half
• cli: Tack start moves an item to in-progress and checks out its branch; tack open prints its URL
• github: Inbound issue state by polling
• github: Comments both ways
• codex: Read token usage from the turn.completed line
• codex: The tool list selects the sandbox mode
• github: Per-project token reference and manual issue link
• runner: A grammar can drive its own handshake over stdin
• opencode: An asking request runs over acp and pauses for the operator
• codex: An asking request runs over app-server and pauses for the operator

Changed

• runner: Remove the opencode harness adapter
• Finish stripping board archaeology from Rust comments/logs
• Strip board archaeology written in prose from Rust comments
• frontend: Decide the execution summary's shape at the API boundary, and record VI-C31 and VI-C28 on the board
• Comments and one operator-facing string state what is true
• orch: Surface the legacy Docket compatibility label on orch-link
• Refuse a new runner-v1 execution request when Docket already owns the item
• Collapse the mirror guard's enablement check onto settings.rs's resolver
• orch: Give the docket pipeline-dispatch trigger a caller
• ix-m1: Move inline test modules to /tests.rs
• ix-m3-db: Create tack-test-support crate
• ix-m3-cli: Consolidate test helpers
• ix-m3-api: Consolidate test helpers into tests/common
• ix-m3-runner: Consolidate test helpers
• ix-m3-orch: Consolidate test helpers into tests/common
• ix-m4-api-runner_protocol: Prune test binary to the rules
• ix-m4-db-repository: Prune version_concurrency.rs to the rules
• ix-m4-db-repository: Prune status_update_checked.rs to the rules
• ix-m4-db-repository: Prune execution_retention.rs to the rules
• ix-m4-db-repository: Prune event_artifact_retention.rs to the rules
• ix-m4-db-repository: Prune orch_repo.rs to the rules
• ix-m4-db-repository: Prune integration.rs to the rules
• ix-m4-db-repository: Prune execution_repo.rs to the rules
• ix-m4-api-security: Prune chaos_recovery.rs to the rules
• ix-m4-api-security: Prune trust_boundary.rs to the rules
• ix-m4-api-security: Prune wip_limit_race.rs to the rules
• ix-m4-api-security: Prune board_drag_wip_race.rs to the rules
• ix-m4-api-security: Prune cors.rs to the rules
• ix-m4-api-handlers: Prune crud.rs to the rules
• ix-m4-api-handlers: Prune production_router.rs to the rules
• ix-m4-api-handlers: Prune executions_runner_admin.rs to the rules
• ix-m4-api-handlers: Prune economics.rs to the rules
• ix-m4-api-handlers: Prune item_concurrency.rs to the rules
• ix-m4-api-handlers: Prune attempt_scoping.rs to the rules
• ix-m4-api-handlers: Prune attempt_lists.rs to the rules
• ix-m4-api-handlers: Prune operator_read_routes.rs to the rules
• ix-m4-api-handlers: Prune provisioning.rs to the rules
• ix-m4-api-handlers: Prune local_runner.rs to the rules
• ix-m4-db-migrations: Prune orch_migrations.rs to the rules
• ix-m4-db-migrations: Prune orch_metrics.rs to the rules
• ix-m4-db-migrations: Prune stale_reconcile.rs to the rules
• ix-m4-db-migrations: Prune item_source_migration.rs to the rules
• ix-m4-api-orchestration: Prune dispatch/dual_scheduling.rs to the rules
• ix-m4-api-orchestration: Prune auto_dispatch/sprint.rs to the rules
• ix-m4-api-orchestration: Prune dispatch/item.rs to the rules
• ix-m4-api-orchestration: Prune reporting/agent_activity.rs to the rules
• ix-m4-api-orchestration: Prune control_plane/resource.rs to the rules
• ix-m4-api-orchestration: Prune reporting/budget_policy.rs to the rules
• ix-m4-api-orchestration: Prune dispatch/pipeline.rs to the rules
• ix-m4-api-orchestration: Prune auto_dispatch/hook.rs to the rules
• ix-m4-api-orchestration: Prune reporting/approvals.rs to the rules
• ix-m4-api-orchestration: Prune reconciler/terminal_status.rs to the rules
• ix-m4-api-orchestration: Prune fleet_templates/fleet_membership.rs to the rules
• ix-m4-api-orchestration: Prune reconciler/broadcast.rs to the rules
• ix-m4-api-orchestration: Prune control_plane/settings.rs to the rules
• ix-m4-api-orchestration: Prune reporting/run_readback.rs to the rules
• ix-m4-api-orchestration: Prune reconciler/wiring.rs to the rules
• ix-m4-api-orchestration: Prune fleet_templates/templates.rs to the rules
• ix-m4-api-orchestration: Prune auto_dispatch/gate.rs to the rules
• ix-m4-api-orchestration: Trim hook.rs/terminal_status.rs preambles under the 10-line budget
• orch-scheduling: Table-drive wiring.rs eligibility/priority/fleet tests
• orch-scheduling: Shrink policy.rs preamble, names and test bodies
• orch-scheduling: Shorten scheduler.rs preamble and test names
• ix-m4-cli-embedded_runner: Prune embedded_runner_live_secret.rs to the rules
• ix-m4-cli-embedded_runner: Prune embedded_runner_orphaned_credential.rs to the rules
• ix-m4-cli-embedded_runner: Prune embedded_runner_state_scoping.rs to the rules
• ix-m4-api-runner_vertical_slice: Prune repository_crash.rs to the rules
• ix-m4: Prune tack-runner bootstrap_entrypoint and g2_journal_corruption_test
• ix-m4: Shorten 8 over-length test names in docket_adapter_test
• ix-m4: Prune tack-orch docket_adapter_test.rs
• ix-m5: Prune codex harness tests to the audit's §5 shape (phase 3/3)
• ix-m5: Dedupe cross-adapter harness tests, share provider/log plumbing
• ix-m8-cli: Move tack-desktop supervisor tests to supervisor/tests.rs
• ix-m8-cli: Shrink extraction overhead to bring test-line total down
• ix-x2: Shorten test names over the 60-char budget
• ix-x2: Extract patch_token_field_is_tri_state's case table
• ix-x3-api: Fixture-ize and split the four oversized runner-protocol/chaos test files
• runner: One harness lifecycle, a harness is a descriptor and a grammar
• Breaking: Remove model_profiles, a table nothing read
• Breaking: frontend: Remove the Docket control plane's own pages
• Breaking: frontend: The everyday views stop talking to the Docket bridge
• Breaking: api,cli: The Docket control-plane bridge leaves the server and the CLI
• Breaking: orch: Tack-orch is the runner-v1 execution domain and nothing else
• Breaking: A project template no longer carries an orchestration block
• Breaking: db: The Docket bridge's tables are dropped
• db: Drop the template column nothing reads
• runner: The capture cap leaves the harness descriptor

Fixed

• ci: Raise the MSRV to 1.89, the floor the dependency graph already required
• ci: Make the MSRV job build on the toolchain it pins
• desktop: Let the workspace build without a staged sidecar
• runner: Re-run live gateway proofs against the corrected stored key
• runner: Make the catalog URL per-provider data, not a hardcoded constant
• Rewrite the four remaining opencode mentions the sweep missed
• tests: Repoint stale file-name comments in tack-api tests
• runner: Enable the keychain feature the macOS store already calls
• runner: Stop naming vendors in claude-code's own dispatch code
• cli: Reconcile the catalog seam the two Wave 15 cards left
• desktop: Move the first-run dialog off the main thread
• install: Stop the one-liner picking the runner archive,...

v0.1.0-beta.7

What's Changed

• Chore(deps): Bump the cargo-minor-patch group with 2 updates by @dependabot[bot] in #21
• Chore(deps): Bump object_store from 0.13.2 to 0.14.0 by @dependabot[bot] in #22
• chore(deps): bump the npm-minor-patch group across 1 directory with 9 updates by @dependabot[bot] in #43
• chore(deps): bump the cargo-minor-patch group across 1 directory with 11 updates by @dependabot[bot] in #44
• chore(deps): bump dtolnay/rust-toolchain from 1.85.0 to 1.100.0 in the actions-minor-patch group across 1 directory by @dependabot[bot] in #38

New Contributors

• @dependabot[bot] made their first contribution in #21

Full Changelog: v0.1.0-beta.6...v0.1.0-beta.7

v0.1.0-beta.6

Full Changelog: https://github.com/yielab/tack/commits/v0.1.0-beta.6