Yard v0.3.0

Added

• Per-worker API key pass-through (invocation.pass_env). Zero-key is
  now framed as the default for the subscription-first audience, not an
  identity rule: a custom worker profile can name env vars (e.g.
  OPENAI_API_KEY) that reach that worker only, while every other worker
  stays key-scrubbed and Yard never reads or stores the values. README and
  AGENTS.md reworded accordingly; a native API adapter is on the roadmap.

• Self-restart on upgrade. yard notices when its own binary is replaced
  (cargo install while running) — the status line announces the new build
  and u re-execs into it in place. No more silently-stale TUI sessions;
  a now also works on queued tasks (instructions ride into the run).

• Partial = continue, not redo (harness phase H2). Re-running a Partial
  task injects the previous run's checkpoint, summary, and unresolved
  validation failures into the packet ("do not redo finished work"). The
  auto-drain now continues self-reported partials automatically
  (attempts-capped) and halts only on merge-conflict partials (marked via a
  partial-reason file). The TUI a key now also answers Partial/Blocked
  tasks — the reply becomes rerun instructions threaded into the
  continuation packet; the Answer screen shows what the previous run says is
  still missing.

• Worker management from the TUI. The Home arrow keys now continue past
  the queue into the workers panel; Enter/Space toggles a worker on/off
  (persisted as enabled: in workers.yaml — routing and planning skip a
  disabled worker).

• Model/effort presets sync from the CLIs. codex models and reasoning
  efforts come from the CLI's own ~/.codex/models_cache.json (the models
  available to this account); claude effort levels are parsed from
  claude --help, and its model aliases are the documented stable set. No
  hand-maintained id lists; typing an exact id still works.

• Custom workers via config alone. Any subscription-backed CLI can be
  added as a third worker in workers.yaml with an invocation template
  (args, sandbox_args/full_access_args, model_args, effort_args,
  image_args; placeholders {run_dir} {model} {effort} {image}).
  Codex and Claude Code keep their first-class adapters; see README
  "Adding a worker".

• Role profiles (plan §13.4). Tasks run under a prompt-mode role derived
  from their kind — builder / reviewer / researcher / security — with
  role-specific working rules in the packet, replacing the old worker-keyed
  guidance. A workspace extends a role by writing .agents/agents/<role>.md
  (appended to that role's packets as "Workspace role notes").

Fixed

• TUI responsiveness: the mid-run refresh no longer spawns worker --version
  probes every second (which froze the event loop ~100ms and ate keystrokes),
  and the Run Monitor renders from a cache instead of rescanning the runs
  directory and re-parsing the whole worker log every frame.
• Keyboard shortcuts work with the Korean IME on: 2-beolsik jamo map back to
  their QWERTY keys on shortcut screens (ㅡ→m, ㅗ→h, Shift+ㅁ→A).
• Single-press shortcuts under a CJK IME (macOS): on shortcut screens Yard
  auto-selects an ASCII input source (the im-select pattern), so the first
  keypress is no longer swallowed by IME composition; the IME is restored on
  text-input screens and on exit. Toggle via Settings ("Auto IME switch") or
  auto_ime in .agents/yard.yaml.
• Quitting mid-run no longer duplicates work: the worker survives a quit, and
  on restart Yard now ADOPTS a still-alive worker (task stays Running, the
  Monitor tails its live log, the idle loop evaluates and merges its result
  when it lands) instead of requeueing the task into a second worker. The
  auto-drain waits for an adopted worker rather than starting overlapping
  work; only a dead worker with no result is requeued.
• Worker-loss audit fixes: a stale plan finished late by an orphaned planning
  worker can no longer clobber a newer intent/queue (supersession guard); a
  still-running planning worker from a previous session is reported instead
  of being silently duplicated; Esc now also stops an adopted worker; a dead
  background job thread fails the job instead of leaving the UI busy forever;
  and integration only ever aborts its OWN in-progress merge — a merge the
  user has in progress is reported and left untouched.