Changelog

Added: 1 change. Fixed: 7 changes. Changed: 1 change. Key changes: Mechanic disk-reclaim domain: a propose-only maintenance domain that reclaims over-retained safety/undo artifacts under the instance dir — redundant verified DB snapshots, corruption forensics, recovery snapshots, unpruned config-file backups, and orphaned model weights — each by structural signature match with a newest-N retention floor and live-file exclusion. Surfaced on the maintenance heartbeat (report-only) and applied only through an explicit operator confirm via `roboticus mechanic`, matching the workspace/plugins-skills domains. Addresses multi-GB backup accumulation that the mechanic previously never cleaned. macOS bundled-sidecar SIGKILL (v1.5.0 prod outage):the update/runtime-install path did not ad-hoc code-sign the extracted llama.cpp binaries+dylibs on macOS, so AMFI/taskgated rejected the runtime-invalid signature and SIGKILLed llama-server at exec (both the embedder :11435 and chat host :11436), silently degrading to the n-gram embedder floor and a connection-refused chat route. Install-time now ad-hoc-signs the runtime, and the daemonself-heals it once per lifetime before spawning either sidecar (unconditional re-sign, since `codesign --verify` passes on disk even while the kernel rejects the signature at exec). Mechanic hygiene routed to a paid cloud provider: the workspace grounding-judge classified ambiguous files by escalating to OpenRouter on every maintenance heartbeat (an inverted route gate) and timed out noisily. It is now pinned to the local route with `NoEscalate` (cloud impossible by construction) and runs only when that route is healthy, degrading to mechanical-only otherwise; the caller is tagged (Rule 14) so a failure is attributable without a goroutine-stack dump. The scheduler lease-renewal test is now deterministic (event-synchronized rather than wall-clock-bound), eliminating a slow-CI-runner timing flake.

Added: 3 changes. Changed: 6 changes. Fixed: 12 changes. Instrumentation: 1 change. Key changes: Hugging Bay as a selectable model-catalog source: `roboticus models catalog {search,files,install}` and the dashboard Catalog controls can now discover and install GGUF chat models from [Hugging Bay](https://huggingbay.xyz) as well as HuggingFace, selected with `--source huggingbay` (CLI) or the `source` control param (dashboard). A new `internal/catalog.Source` interface fronts both registries; `GGUFSpec` gains an optional `url` so a source that hosts files by a self-contained URL (rather than a repo/revision/file triple) can be installed and re-provisioned on restart. The SHA-256 pin remains the single trust boundary: downloaded bytes are fail-closed verified against the resolved hash regardless of origin, so an alternative source's hosted bytes are untrusted and the content hash is the control (identical guarantee to the HuggingFace path). Recall index-health coverage gauge: `RunHygiene` records, after the reactivation FTS rebuild, the active-memory total and how many active rows are still missing their FTS row (`HygieneReport.ActiveMemoryTotal` / `ActiveMemoryMissingFTSAfter`, via a `db.MemoryIndexHealth` probe). Post-repair the deficit should be `0`; a non-zero value is the red flag that recall did not fully heal, surfaced in the mechanic hygiene report. Best-effort — a probe error never fails the hygiene run. Semantic subgoal typing replaces the pronoun-scramble denylist (CC-2): derived subgoals are typed via the embedding intent classifier, and only genuine task subgoals flow into executive-state population and the verifier coverage contract; conversational (identity/chat/ack/roleplay) fragments are excluded. This retires the brittle, language-specific `dropConversationalIdentityGoals` phrase denylist — no phrase or word matching. The shared classifier exemplars are untouched. Background and off-pipeline callers are pinned to the local maintenance route (CC-4): the distillation heartbeat, `turn_analysis`, and the session-less `sessions_analyze` diagnostic now request `Service.MaintenanceModel()` with `AgentRole=subagent` instead of re-deciding the route per call. The LLM reranker resolves an empty model to `Models.Primary` at both assembly seams (mirroring the already-safe workspace judge). Under the current local-only prod config this is structural regression-proofing; it keeps these callers local even if a cloud fallback is later added. The onboarding interview is intentionally left un-pinned pending an operator product call.

Added: 2 changes. Changed: 4 changes. Fixed: 7 changes. Everything since v1.4.3 traces to one root-cause pass (`docs/releases/foundation-rca.md`) that collapsed a spread of fidelity, recall, and local-primary symptoms into four common causes, each fixed at its root. CC-1 (control/diagnostic plane stops speaking cloud): the circuit breaker no longer blocks the only model on a sole-local route (`fallbacks=[]`), and a turn that answered directly from recall is no longer stamped `degraded` by the toolless-stall override. CC-2 (typed scaffold, not echoable text): derived subgoals are typed via the embedding classifier (retiring a brittle pronoun-scramble denylist), leaked scaffold is stripped by provenance instead of by rendered prefix, and world-knowledge subgoals skip a wasted verifier repair. CC-3 (an active memory is recallable again): decay had left 584/779 (75%) of active semantic memories dark to recall; reactivation now rebuilds the derived FTS index and migration 085 heals the backlog, so a gutted index renders a hedged notice instead of a confident false 'no memory' denial. CC-4 (background paths stop drifting to cloud): background callers (distillation, turn analysis, reranker) are pinned to the local maintenance route and every session-less router selection is now audited. Also: a Go 1.26.5 bump patching crypto/tls GO-2026-5856, and a ~37% local-prefill win from a compacted reflect/continuation overlay. Gated by `go test -race`, an ABORT premortem, and a full 10/10-green behavioral soak.

Added: 2 changes. Fixed: 2 changes. Instrumentation: 1 change. Key changes: LittleLamb default-on deterministic tool-caller: when the bundled chat host is enabled, a no-native-tool-call turn now asks the sidecar's grammar-constrained decision whether to force a valid on-surface tool call or keep the model's direct answer, so local tool-calling no longer depends on each model emitting well-formed calls. Augment-not-replace: a correct drafted answer is preserved alongside any forced call, and every routing decision (router input, choice, and fail-open error) is recorded in turn diagnostics for RCA. Speed-aware local model auto-pick: setup and install choose the local chat model by measured backend throughput, not RAM alone. A discrete NVIDIA/AMD GPU gets the larger tier; an Apple/integrated (Metal/Vulkan) or CPU backend is capped to a model it can actually run at interactive speed, so a machine is never handed a model that fits memory but crawls. Adds Qwen2.5-3B as an eval candidate (the measured sweet spot for integrated GPUs). Local-primary latency: dynamic grounding (local time, proof obligations) is emitted after conversation history, so the static prefix and the growing history reuse the llama.cpp KV cache across a turn's ReAct inferences and across turns; only the volatile tail re-prefills. The bundled chat endpoint is exempted from the 60s fast-endpoint timeout so a legitimately long local inference is not cut off mid-generation. A no-progress route now advances to a fallback route before terminating instead of churning in place. Durable memory reactivation: a one-time heal re-activates durable memory that decay wrongly pruned (follow-through on the v1.4.2 recall fix), touching only decay-pruned entries and never those superseded, deduplicated, or derivable.

Fixed: 4 changes. Key changes: Recall no longer ignores durable memory: recall was excluding consolidated ("promoted") memory — roughly four-fifths of stored content on a long-lived instance — and decaying the rest on a blind timer, so an agent progressively lost reach of its own history. Durable memory is now a first-class recall candidate (promoted-fallback leg) and recall reinforces confidence, so usefulness keeps memory alive rather than a timer aging it out. Plus six consolidation correctness fixes: silent semantic-fact loss during promotion, a dead index-sync branch that never demoted stale entries, distinct load-bearing-token preservation through dedup, UTF-8-safe content previews, and fail-loud episodic dedup. Context-compaction digest now runs: the proof-carrying digest Engine was configured on yet producing zero digests, because the producer built from a different message base than the consumer read, so every digest was discarded. Producer and consumer now build from one shared persisted base, and the splice is anchored to a content fingerprint of the coverage boundary so a shifted window can never drop a live turn. Load-bearing tokens (numbers, paths) are preserved.

Added: 2 changes. Changed: 3 changes. Fixed: 7 changes. Key changes: `models recommend` unified advisor: one command across three horizons — default ranks recorded benchmark evidence, `--scan` probes configured providers and applies a chain (was `models suggest`), `--discover` ranks installable HuggingFace models for this host's RAM (was `models whichllm`). Tool-caller (LittleLamb) sidecar status surfaced in Models → Local Runtime. Breaking — `mechanic` is now exactly two subcommands: `check` (read-only diagnostics across all maintenance domains) and `repair` (apply, with confirmation). The per-domain subcommands (`config-repair`, `autonomic`, `workspace`, `plugins-skills`, `security`) and the `fix` alias are removed; their logic runs inside `check`/`repair`. Breaking — `models` selection is one advisor: `models suggest` and `models whichllm` are removed, folded into `models recommend` (see Added).

Added: 6 changes. Changed: 1 change. Fixed: 1 change. Security: 2 changes. Key changes: RBAC: per-role tool policy, in-chat `/grant` with presets + `@username`, F18 in-chat group onboarding (`/admit`) with `user admitted-chats` / `user revoke-chat` CLI, dashboard Access tab. Agent self-service: `set_config` (operator-authorized config mutation), read-only `mcp_status`, dashboard "Connect (OAuth)" turnkey MCP authorization, `provider balance`. Empty memory recall returns a neutral, non-reflectable signal and memory previews are rune-safe, so weak local models no longer parrot recall scaffolding as the answer. Windows upgrade (#164): the embedder runtime re-provisions in place by quiescing the bundled sidecars first (freeing the locked DLL), then resuming them — no manual daemon stop.

Fixed: 2 changes. Documentation: 1 change. Known: 1 change. Key changes: `roboticus upgrade all` no longer aborts on a locked embedder DLL (Windows).Windows cannot overwrite a file held open by another process, so re-provisioning the bundled embedder runtime while the daemon is running failed to extract `libomp140.x86_64.dll`. That transient lock was misclassified as a broken artifact and returned as afatalerror — aborting the whole upgrade even though the main binary had already updated. It is now treated as atransient, retryable condition: a non-fatal warning with a "stop Roboticus and re-run" hint, so the binary upgrade completes and embeddings run on the n-gram fallback until re-provisioned. (The fail-loud classification for a genuinely corrupt asset or a bad extractor is unchanged.) The over-classification dated to the v1.3.3 "fail loud on broken runtime provisioning" change, which did not account for a Windows in-use lock. `roboticus daemon stop` works on Windows. It previously failed with `signal SIGTERM to pid …: not supported by windows` — Go's `os.Process.Signal` does not support `SIGTERM`/`SIGKILL` on Windows, so stop errored before doing anything. The stop signal is now delivered through a platform-specific path: `TerminateProcess` on Windows, POSIX signals unchanged on Unix/macOS. Folded the v1.3.10 turnkey MCP OAuth feature (`mcp auth`) into the evergreen reference docs — the wiki MCP section and the `[[mcp.servers]]` field table (incl. the `oauth` / `oauth_client_id` / `oauth_token_url` fields) in `configuration.md`. On Windows the daemon's embedder/chat sidecars are not yet grouped in a Job Object, so a forceful `daemon stop` can orphan the embedder `llama-server` and keep its DLL locked. Full embedder re-provisioning on Windows needs that Job Object (tracked); the above fixes un-brick the upgrade and restore `daemon stop`.

Added: 2 changes. Changed: 3 changes. Fixed: 4 changes. Documentation: 1 change. Key changes: Turnkey MCP OAuth — `roboticus mcp auth <NAME>`. Authorize an OAuth-protected MCP server with no token to paste: the CLI runs the full discovery chain (RFC 9728 protected-resource metadata → RFC 8414 authorization-server metadata → RFC 7591 dynamic client registration), opens the authorize page, completes the PKCE code exchange on a loopback redirect, and stores the token in the machine keystore. The daemon resolves and refreshes that token on startup, so a configured OAuth server connects on the next restart. Static `auth_token_env` bearer servers keep working unchanged. `roboticus daemon restart` reports both the old and the new PID, so a restart is verifiable at a glance instead of leaving you to guess whether the process actually rolled. The embedding-provider dropdown always offers "bundled-llama.cpp (recommended)" as a first-class option, folding the legacy `llama-cpp` / `bundled-embedder` spellings into it — the local-first embedder is always one click away, no manual provider string required. Dashboard dropdowns are themed to match the rest of the console (a styled custom control layered over the native `<select>` via progressive enhancement, so it stays keyboard- and screen-reader-accessible and degrades to the native control if scripting is off).

Added: 4 changes. Changed: 5 changes. Fixed: 10 changes. Security: 3 changes. Key changes: Broad GPU offload (CUDA / ROCm / SYCL), pulled a la carte. No GPU binary is bundled any longer; the package ships only the CPU/Metal binary and stays light. On boot the chat host detects the host GPU vendor and, in the background, fetches ONLY the matching vendor-native llama.cpp backend for that silicon (NVIDIA CUDA, AMD ROCm/HIP, Intel SYCL), else the cross-vendor Vulkan binary, SHA256-verified fail-closed, then hot-restarts onto it (the sidecar serves on CPU/Metal until it lands, so boot is never blocked and an offline box just stays on CPU). A vendor-native binary that fails at runtime downgrades to Vulkan before CPU, and `/status` reports the real offload backend in use (`cuda-gpu` / `rocm-gpu` / `sycl-gpu` / `vulkan-gpu` / `metal` / `cpu`). `get_tool_list` — active discovery of the full tool catalog by keyword, so the model finds and loads a tool before ever claiming a capability is unavailable. Local responsiveness: the prompt now reuses the llama.cpp KV prefix cache. The bundled chat host was re-prefilling the entire framework prompt every turn. The stable system prefix is HMAC-wrapped independently and byte-stable across turns, the per-session boundary key persists (instead of regenerating each turn), and the per-turn dynamic tail (local time, proof obligations, capability snapshot) is a separate post-catalog message so it can never perturb the cached prefix. Cross-turn prompt-eval collapses by roughly 20-30x on the measured hardware. Lean base tool surface. Every turn ships a minimal base tool set in a fixed order for prefix-cache stability; the model pulls more on demand via `request_tools` / `get_tool_list`. Installs carrying a stale `tool_search.top_k=15` are migrated to the lean default on repair.

Added: 4 changes. Changed: 1 change. Fixed: 13 changes. Folded: 4 changes. Security: 4 changes. Key changes: In-chat operator onboarding. An operator can `/grant <role> <sender>` in a channel to bind a new sender to an RBAC role — hard operator-gated, no self-claim. Proactive slow-path notice. A slow-but-not-failed turn now tells the user it's still working (cold-start aware) and, near the deadline, offers to raise the limit — instead of a silent wait that ends in a give-up. Mechanic owns host tuning. llama.cpp ctx-size is RAM-derived (clamped) and flash-attn is enabled only where the backend supports it (Metal), both reported by the mechanic. Removed models no longer reappear. The models-config write now does a full `[models]`-table rewrite instead of an `ApplyConfigPatch` JSON-merge, so map-key deletions (policy/overrides/timeouts) persist instead of being resurrected.

Added: 5 changes. Changed: 4 changes. Fixed: 20 changes. Key changes: Operator circuit kill-switch. `roboticus circuit open|quarantine <provider>` lets the operator force a provider out of rotation (and back) without editing config, for fast incident response. DB-access fairness foundations. A write-fairness gate with per-subsystem, caller-tagged write accounting and a daemon-routed reset, plus writer lock-hold instrumentation at the choke point. Every hygiene cycle now surfaces who spent the single serialized writer's budget (Rule 14), the groundwork for the priority-admission gate. All-in on shaping: guard exhaustion never substitutes a canned message. When a guard chain exhausts, the model's own content is delivered through a single answer-fidelity delivery chokepoint; the now-dead canned-message helpers were removed. A correct answer is never discarded for a templated non-answer (F25). Capability-denial over-constrainer culled to observe-only. The reactive capability-denial guard is de-fanged to honesty-only (it suppresses no policy/sandbox/financial/prompt-leak guard) and logs every would-fire for the termination soak.

Added: 3 changes. Fixed: 13 changes. Key changes: Bundled llama.cpp chat sidecar is the local-first default provider. `roboticus setup` now offers `bundled` first and as the default (local model, no API key, no Ollama), routing the primary to the bundled chat sidecar; README and dashboard provider colors align to the bundled runtime. Local-first onboarding with no separate install. Localized prefer-local for autonomous turns. `AgencyConfig.PreferLocalModel` (default on) routes agency-delegated turns to a free local model with cloud fallback, scoped strictly to autonomous turns so it never downgrades an interactive user turn. Mandatory `request_tools` + `recall_memory` tool-surface floor. These two tools are now on the surface of every turn, never prunable by any envelope (lightweight, focused, truncated, or read-only). Recorded production showed `request_tools` denied 372x while the surface-widen signal was ignored, making tool-starvation an unrecoverable lockout; a failing test proved the v1.3.5 widen did not cover it. x402 micropayment no longer hijacks any HTTP 402. A standard keyed provider's 402 ("out of credits") was misread as a crypto micropayment request and attempted an on-chain wallet payment. x402 is now gated to providers explicitly opted in (`x402_enabled`); every other 402 maps to an honest "out of credits".

Fixed: 2 changes. Key changes: Tool-envelope starvation: the model's withheld-tool need is now honored. The per-turn tool classifier routes subagent/action turns to narrow focused envelopes that withheld the action tools (`write_file`/`edit_file`/`orchestrate-subagents`) — a `focused_delegation` envelope even shipped zero orchestration tools while its reason claimed to retain them. When the model deliberately reached for a real registered tool it was hard-blocked for the whole turn (the framework's own grounding judge twice certified the model was truthfully blocked and the surface genuinely starved). Root: the widen valve fired only for light-budget envelopes and `Expanded()` no-op'd otherwise, so a narrow focused envelope could never recover a withheld tool. Now any narrow per-turn surface widens when the model signals it reached for a withheld real tool — dropping the focused profile + cap so the full ranked surface (including the blocked tool) is admitted on the retry. The model's correct cognition overrides the classifier's surface guess. `internal/pipeline/turn_policy.go`, `internal/pipeline/pipeline_stages_envelope.go`. Inbound injection sanitizer no longer corrupts legitimate operator input. The L2 redaction pattern `you are now [^.\n]+` matched a benign operator message ("see if you are now able to do some of the stuff you were previously blocked on") and ate the rest of the clause, replacing it with `[REDACTED]` before the model ran. L2 now gates on an actual persona-swap target (unrestricted/jailbroken/DAN/admin/dev-mode/…), mirroring the already-tight L4 patterns; real jailbreaks still redact. `internal/agent/injection.go`.

Fixed: 3 changes. Removed: 1 change. Changed: 3 changes. Added: 1 change. Key changes: The canned "we held this back" non-answer no longer overwrites a forgiven answer. When the grounding judge forgives a behavioral-guard rejection as honest grounded content, the retry signal is now cleared at the source, so neither exhaustion handler (post-success or verifier) fail-closes over the real answer. RCA `introspection_discovery`, pinned from recorded state via new soak instrumentation: `task_deferral` mis-fired "action-bearing turn finalized without action-specific tool evidence" on a read-only introspection turn, exhausted, and buried the model's real subagent summary under the canned line even though the judge had forgiven it. Genuine deferrals (scheduling) and non-forgivable hard-safety guards (false capability denials, financial/filesystem/config) still fail-closed. `internal/pipeline/guard_retry.go`. Forgiveness cannot disable a co-occurring hard-safety fail-closed. The guard chain short-circuits at the first retry guard, so when a forgivable guard fires first, a hard-safety guard registered later (financial/execution/filesystem) never runs. Forgiveness now re-validates the content against the non-forgivable hard-safety guards before clearing the retry; if any would fire, the turn fails closed. This closes an ABORT-premortem dealbreaker: a financial fabrication on a turn that also tripped a forgivable guard could otherwise have shipped. `internal/pipeline/guard_context.go` (`anyHardSafetyGuardFires`). Eliminated the `named_topic_continuity` exact-match guard. It retried any return-to-topic answer that did not contain the literal session topic anchor (`strings.Contains`), so a semantically-correct answer phrased differently was retried to exhaustion, a brittle exact-match that flipped run-to-run. Deleted (not de-fanged), with its anchor helpers and context field; the full guard chain drops 16 → 15. Bundled local chat host runs serial (1 slot). The RAM-tiered parallel slots (1/2/3 by RAM) are removed: RAM is not the bottleneck for parallel local inference, compute is, so N "parallel" slots split one CPU-bound model N ways and a concurrent burst made one turn exceed its inference deadline. The host now runs one inference at a time (`llm.SidecarChatSlots = 1`, the single source of truth for llama-server `--parallel` and the provider's `MaxConcurrency`); concurrent turns queue client-side and complete reliably at full speed.

Fixed: 2 changes. Key changes: Content-pack refresh was a silent dead channel.The upgrade client decided pack freshness by `installed.Version == manifest.Version`, and the registry manifest's top-level `version` was frozen at `0.11.0` for several releases — so `roboticus upgrade all` printed "pack already at version 0.11.0", skipped the fetch, and reported success while leaving providers, skills, and product-knowledge stale. The refresh decision now compares the manifest'sper-pack `sha256` (and per-file hashes for skills) against the installed content hash — both already present — so a changed pack is fetched and an unchanged one is skipped without download. Fixed in both the outer pack-selection gate and the inner product-knowledge gate (which short-circuited on the version before downloading). Verified that the live manifest regenerates per-pack hashes from current content, so the gate is sufficient with no site-side change. Upgrade download timeout hardened. Large asset/binary downloads (tens of MB) use a generous-timeout HTTP client instead of the 30s total timeout intended for small JSON metadata, which could abort an in-progress download on a slow link ("context deadline exceeded while reading body").

Fixed: 2 changes. Changed: 1 change. Key changes: Bundled chat host dropped forced-tool-call turns. The small bundled model returns prose instead of a tool call under `tool_choice=required`, which the framework treated as a provider failure (HTTP 500, dropped turn). The bundled chat provider now declares `RejectRequiredToolChoice` (the handling Ollama-format local models already get), so the framework degrades to automatic tool choice instead of failing. Also protects sub-agents routed to the local host. (Root cause confirmed from preserved soak evidence, correcting an earlier concurrency misdiagnosis.). Concurrent local-host turns could time out. The host ran a single llama-server slot, so concurrent turns (sub-agent fan-out, multiple channels) serialized and the over-queued turn could exceed the client timeout. The host now serves multiple parallel slots scaled to system RAM (`SidecarChatParallelSlots`; a constrained or detection-failed host keeps one slot, no memory regression), with `--ctx-size` scaled per slot, and the client caps in-flight requests per provider (`Provider.MaxConcurrency`) so overflow queues client-side instead of failing. The `local-chat-host` soak runner uses the product's real per-turn timeout (300s) and preserves the daemon log + per-turn responses into the report dir, so failures are diagnosable from recorded state (Rule 14) instead of vanishing with temp dirs.

Added: 8 changes. Fixed: 11 changes. Changed: 2 changes. Removed: 1 change. Key changes: Local LLM chat host (bundled, no Ollama). The bundled `llama.cpp` sidecar (embeddings-only in v1.2.0) is now a first-class local chat backend: Roboticus serves a local model with no separate install. External `llama.cpp`/Ollama and cloud providers remain first-class peers. Dedicated Models page (Local-runtime, Catalog, Providers, Routing, Comparison) with a HuggingFace install flow: discover a repo, list its GGUF files, fit-check against the real download size, and install any quant (content-hash pinned, SHA256-verified on next start). `mechanic` braille spinner on work-bearing steps — the per-table row counts, both integrity checks, and the maintenance VACUUM now run under a braille spinner so a slow step shows activity instead of a frozen-looking terminal. The spinner is a no-op on non-TTY/`--json` output. Delegation now happens when explicitly requested. Root-caused a multi-layer defect where an instructed delegation never invoked `orchestrate-subagents`: the planner plans delegation from a semantic intent signal, the turn requires delegation evidence, pre-response shaping pins and steers the tool, and the tool-surface pruner force-includes the orchestration tool (it was pruned for low relevance to the task content). Validated across the authority ladder: operator delegates, peer honestly refuses.

Added: 7 changes. Changed: 4 changes. Fixed: 3 changes. Security: 1 change. Key changes: Bundled nomic embedder sidecar — a daemon-supervised, GGUF-content-hash-pinned `llama.cpp` process serving `nomic-embed-text` on loopback, removing the external Ollama embedding dependency while keeping the main binary `CGO_ENABLED=0` static. It is the standing default for implicit installs. Autonomous x402 micropayments — wired on and gated fail-closed by a Money-typed `TreasuryPolicy` (per-payment cap + hourly/daily budgets via a spend ledger + minimum reserve). Dormant until a wallet + RPC + passphrase are configured. Self-custody `roboticus wallet import` signs from a user-supplied key. Centralized logging (`internal/core/logging.go`) with context-propagated correlation IDs and console/JSON format selection; the daemon no longer emits raw JSON logs into interactive command output. CLI install/upgrade/daemon-control surfaces adopt the design language. `guard_retry_count` now counts the actual number of guard-triggered re-inferences, including grounding-judge-mediated ones (was a flat 0/1).

Fixed: 1 change. Key changes: `upgrade`/`update all` no longer skips the voice-runtime refresh with `Warning: ... unsafe archive path "./"`. The voice-piper archive carries a `./` root entry (as most tar tools emit); the voice extract loops passed it straight into the shared `safeArchiveTarget`, which rejected `.` as unsafe — so the voice runtime never refreshed on any upgrade since v1.1.0. Root-entry handling now lives once in `safeArchiveTarget` (it reports the harmless archive root as a skip), so all three extract loops (skills, product-knowledge, voice tar/zip) treat it consistently; path-traversal rejection is unchanged.

Security: 2 changes. Changed: 3 changes. Key changes: Injection output-cap fails loud instead of silently dropping output. The v1.1.3 input DoS cap also made the L4 output scan score any tool/LLM output over 256 KB as a maximal threat, so a legitimately large clean output (a file read, a web fetch, an inbox summary) was either mislabeled `[Tool output filtered: potential injection detected]` or silently emptied. Output now has a separate 1 MiB cap and is scanned by a bounded prefix: a clean large output passes through, a real injection in the prefix is still caught, and an oversized output records an honest `tool_output_scan_truncated` event. The fail-closed input cap is unchanged — input and output are deliberately asymmetric. Positional instruction-override injections are now detected. `CheckInput` matched "ignore … previous" but not positional phrasings ("ignore everything above", "ignore the preceding", "ignore below" — HTML-entity-encoded included), which scored 0 and reached the model unsanitized. A positional-override pattern now scores them at least caution so they are redacted. Flaky tests eliminated across nine packages, and gated. A fixed `time.Sleep` followed by an assertion on async state was the top source of flaky CI. An audit of all 64 test-sleep sites converted the flaky ones to `assert.Eventually` polling (plus atomic watched-file writes, a load-invariant concurrency ratio, explicit eviction timestamps, and a size-detectable keystore change). A new CI guard (`scripts/check-test-sleeps.sh`) fails any PR that adds a `time.Sleep` to a test beyond the reviewed baseline, pointing authors at `assert.Eventually`. Adversarial-issue coverage is 0 gaps / 100%. Two new guard-edge regression scenarios, a systemic corpus fix (deferred/unshipped fixes are excluded until they ship), and justified out-of-scope classifications for non-behavioral fixes.

Added: 1 change. Fixed: 1 change. Key changes: Read-only inbox-summarize capability (`read_inbox`): the agent reads recent messages from the configured mailbox via a read-only `ListRecent` (IMAP `SINCE` scope, `BODY.PEEK` so mail is never marked seen, bounded full bodies), registered only when IMAP email is configured. Live-verified against a Proton Bridge (5 real messages, read-only, no `state.db` touch). The agent answers with an honest limitation instead of exhausting its retry budget. RCA (production turn `696abbc9`): asked to act on an introspection-only turn (no action tools), it narrated future actions, the `task_deferral` guard rejected every attempt, and after six attempts it emitted the canned "couldn't get a confident answer." That exhaustion now yields an honest limitation answer ("only read-only introspection tools were available; enable the needed tool/capability"). Instrumentation: the blocked diagnostics name this case correctly, and `primary_diagnosis` is set on every blocked-exhaustion turn.

Fixed: 4 changes. Changed: 3 changes. Key changes: Injection-detector unbounded-scan DoS: input over a 256 KB cap is treated as a threat and short-circuited before NFKC normalize + regex, instead of stalling the pipeline ~25s on a single oversized inbound message. Injection `Sanitize` HTML/percent-entity decode bypass: entity-encoded injections that `CheckInput` flags no longer survive sanitization unredacted. In-app `update all` / `upgrade all` gained `--version` to install, reinstall, or downgrade a specific release, matching `install.sh --version`. `install.sh` installs in place over an existing `roboticus` on PATH instead of hardcoding `/usr/local/bin`, so it can never shadow the self-updated binary.

Fixed: 4 changes. Added: 1 change. Changed: 2 changes. Security: 1 change. Key changes: Inbound messages are no longer dropped on transient DB contention. The inbound dedup claim is an idempotency guard, but a claim error (a SQLITE_BUSY while a maintenance hygiene run held the single WAL writer) was treated as fatal and silently ate the user's message. It now FAILS OPEN — process the message and surface the failure — for every channel and every transient cause. The cron scheduler runs again. A non-nullable scan of `NULL schedule_every_ms` silently dropped every cron-expression job on every tick; production cron had not run since 2026-04-06. The scan is nullable and fails loud; legacy `cron_runs` columns are converged so the revived worker records run history. Email channel STARTTLS support for IMAP and SMTP, with configurable SMTP transport security (`smtp_security`). Enables a local mail bridge (e.g. Proton Bridge on 127.0.0.1) that advertises STARTTLS. `state.db` now uses a dedicated single-connection serialized writer pool plus a concurrent read pool, instead of one shared pool. Writes serialize on one connection (minimal lock-hold, smaller corruption window) while WAL readers run concurrently; the backup `VACUUM INTO` moved off the writer. In-memory databases keep a single shared handle.

Fixed: 1 change. Added: 3 changes. Removed: 1 change. Key changes: The daemon now FAILS LOUD when its API address cannot bind (or the API server later terminates): previously it logged one error and kept running half-alive — channels and agency up while clients silently reached whatever process owned the port (a split-brain with two live agents). Agency candidate attempt budget and parking: evaluation now has memory of prior decisions. A candidate is not re-decided inside a cooldown window (stops per-cycle audit bloat — production had accreted 23,015 decisions for one junk candidate and 1,226 per stuck scheduler candidate), and one that has burned its executed-attempt budget without resolution is PARKED with a single operator notification instead of being re-investigated every cadence tick forever. Config: `decision_cooldown_minutes`, `max_candidate_attempts`, `attempt_window_hours`, `park_retry_after_hours` (zero disables). A new hygiene repair class heals the accumulated churn damage on every install: duplicate `tool-fact:` working-memory accretions collapse, junk unresolved-questions whose candidate exhausted its budget are removed, and aged agency audit rows are pruned (parked markers survive). The semantic response cache is removed entirely: the pipeline cache stage, the llm-layer two-tier cache, the `semantic_cache` table (migration 065), the maintenance eviction task, and the cached guard preset. Production data showed it was harmful and valueless: zero entries stored since 2026-04-16, `tokens_saved = 0` lifetime, and an entirely pathological replay population (greeting/ack replays, a stale clock reading served 11 times, and the incident's stale-directive-to-a-greeting replay). Behavioral soaks always wiped the cache, so all certified behavior was already cache-off. The `no_cache` request field is accepted and ignored for wire compatibility; cache stats surfaces keep their shape and truthfully report zero. In-flight request deduplication (a concurrency concern) is retained.

Added: 5 changes. Changed: 7 changes. Fixed: 19 changes. Removed: 3 changes. Key changes: Agency/autonomy: runtime-owned policy and execution seams, discrete control levels with conservative defaults, a daily cloud-token budget cap for unattended proactive work, agency audit records, and a forgive-only grounding judge that reduces guard over-firing without weakening hard-safety guards. On-demand tool surface: a small always-native floor plus an embedder-ranked catalog hydrated via a `request_tools` meta-tool (removes context-budget pressure that previously squeezed out memory). Collapsed the two memory tools into a single polymorphic `recall_memory(memory_id?, query?)` verb: an id fetches full content, a topic returns a ranked preview list, and an id-miss with a topic falls back to search. Empty args backfill the query from the last user message. Memory tiering is now fully internal — the source tier no longer appears in the tool schema, the tool output, or the injected memory index. Recall facts reach the verifier via a machine-only `Result.Metadata` envelope, keeping the model-facing output de-tiered and legible. Embedder foundation: `nomic-embed-text` is embedded with its required task-instruction prefixes (in-distribution, stable margins); the ollama runtime is pinned and asserted (`models embedder-check` + startup fail loud on drift); stored vectors carry an `embedding_version` fingerprint and re-embed themselves on a model/prefix/runtime change.

Fixed: 3 changes. Key changes: Hardened `roboticus upgrade all` against transient GitHub release-asset CDN failures by retrying temporary HTTP failures and falling back from `browser_download_url` to the GitHub release asset API URL with `Accept: application/octet-stream`. Added retry/backoff to the public Linux/macOS and Windows bootstrap installers so fresh installs do not fail on a single transient `SHA256SUMS.txt` or binary download error.

Fixed: 8 changes. Key changes: Closed the web/chat streaming liveness gap where a turn could be marked successful without durable, visible assistant content. Made stream finalization pipeline-owned and fail-closed: empty/unusable streams now emit typed visible errors instead of persisting blank assistant messages.

Fixed: 6 changes. Key changes: Moved macOS local daemon install/start onto the user LaunchAgent path (`~/Library/LaunchAgents`, `gui/$UID`) instead of defaulting local desktop installs through root LaunchDaemons. Isolated behavior soaks from the operator's live `~/.roboticus/state.db` by default and removed report assumptions tied to live DB snapshotting.

Fixed: 4 changes. Key changes: Published the post-`v1.0.8` behavioral hotfix as `v1.0.9` so installer and upgrade flows can resolve a newer binary artifact instead of remaining on the original `v1.0.8` tag. Hardened the release workflow's changelog validation so release versions are matched literally rather than interpreted as regular expressions.

Changed: 3 changes. Fixed: 3 changes. Key changes: Turned `v1.0.8` into a diagnostic-trust release focused on benchmark/RCA. Made `web_search` the canonical built-in public-web discovery surface through. Removed release-critical benchmark CLI loopback through Roboticus `/api/**`. Improved provider/RCA classification for request-shape defects, breaker-open.

Changed: 3 changes. Fixed: 3 changes. Key changes: Turned `v1.0.7` into an explicit behavior-hardening release with canonical. Tightened model/routing truth so lifecycle policy, intent-scoped exercise,. Removed several framework-owned false negatives around tool use and authoring. Fixed multiple observability/RCA truth seams so turn diagnostics, trace flow,.

Changed: 8 changes. Key changes: The scoped parity systems have final dispositions in. The release is not claiming verbatim Rust recreation where Go now has a.

Replaced all HTTP polling with WebSocket topic subscriptions. Pipeline events push real-time activity to dashboard. Struct-driven settings schema. Plugin/app catalog. 8 workspace/theme bug fixes. 77 files changed.

Added: 4 bot commands, 5 CLI commands. Fixed: 3 architecture gaps, FTS coverage. Memory system now auto-indexes at ingestion and searches all 5 tiers via FTS5. Model baselining detects memory recall capability.

Fixed: 5 bugs. Added: 3 beyond-parity features. Memory recall was fundamentally broken — 5 compounding issues caused confabulation instead of actual recall. Multi-turn tool use with remote providers was silently broken due to message serialization.

Added: 22 changes. Changed: 14 changes. Fixed: 5 changes. Key changes: Go runtime: Full rewrite from Rust to Go with modernc.org/sqlite (no CGO). ReAct agent loop: 25-turn state machine with idle detection and loop prevention. Prompt ordering: Firmware before personality (matching Rust prompt.rs). Injection defense: 5 markers (Rust set), full content replacement with flagging instead of silent strip.

Added: 5 changes. Changed: 4 changes. Fixed: 4 changes. Key changes: Agent efficacy push: Memory introspection, selective forgetting, relationship-memory automation, and task operating state are now first-class parts of the shared pipeline. Introspection-driven execution: Task-oriented turns now begin from introspected runtime truth, can compose specialists from a clean slate, and preserve executed state across normalization retries. Delegation and composition flow: Empty-roster specialist requests now progress into composition and delegation instead of collapsing into narrated intent or centralization. Task-path truthfulness: Filesystem/runtime blockers now surface as real blockers instead of canned fallback prose.

Added: 8 changes. Fixed: 4 changes. Changed: 2 changes. Key changes: Model categorization with 29-model capability profiles, skill authoring API, Landlock/Job Object script confinement, typestate session lifecycle, delegation scoring engine, and critical signal adapter fixes.

Added: 6 changes. Changed: 1 change. Fixed: 1 change. Key changes: New `roboticus tui` terminal application, configurable context budget tiers, integrations management endpoints/CLI, tool output noise filtering, and dashboard configuration/routing UX improvements.

Added: 7 changes. Fixed: 10 changes. Changed: 5 changes. Key changes: server crate split (`roboticus-cli`/`roboticus-api`/slim server), unified error model, channel adapter helper extraction, model categorization/router spec, and broad hardening around SQL safety, session integrity, config generation, and silent error triage.

Added: 8 changes. Fixed: 18 changes. Key changes: DB fitness hardening (DF-1–DF-18): 18-item SQLite performance audit resolved — retention pruning for 5 high-growth tables, orphan cleanup sweeps (working memory + embeddings), `auto_vacuum=INCREMENTAL`, 6 missing indexes, episodic dead-entry pruning, cache NULL-expiry fix, `PRAGMA synchronous=NORMAL` under WAL, CHECK constraints on 11 columns, and dead `proxy_stats` table removal. Memory hygiene mechanic: `roboticus mechanic` detects and (with `--repair`) purges contaminated memory entries using 7 deterministic LIKE-prefix patterns across 3 tiers, with JSON-structured findings. Circuit breaker window reset: `record_failure()` now tracks `window_start` for rolling-window accumulation — failures spaced ~60s apart correctly accumulate instead of resetting. Embedding auth for local providers: `EmbeddingConfig.is_local` skips API key resolution and auth headers for Ollama/llama.cpp.

Added: 14 changes. Key changes: Compliance-first self-funding control plane: Complete revenue opportunity lifecycle (intake → qualify → score → plan → fulfill → settle) with DB-backed restart safety, strategy-level scoring (confidence/effort/risk/priority/recommendation), feedback persistence per opportunity and summary by strategy, configurable post-settlement asset routing (default `USDC`), EVM swap submission with tx-hash tracking and on-chain receipt reconciliation, tax payout lifecycle mirroring swap tasks, and operator-visible accounting (net profit, attributable costs, retained earnings, tax allocation) across API, CLI, and mechanic surfaces. Revenue mechanic integration: Mechanic can probe, reconcile, and repair orphaned or stale revenue jobs and swap/tax reconciliation mismatches via `run_gateway_provider_and_revenue_checks` and `run_gateway_integrated_repair_sweep`.

Changed: 8 changes. Fixed: 5 changes. Note: 1 change. Key changes: Terminology normalization: `soul_text` → `os_text`, `soul_history` → `os_personality_history` (migration 020) for firmware/OS terminology coherency. Behavior soak hardening: `scripts/run-agent-behavior-soak.py` now includes regression checks for filesystem capability truthfulness, subagent capability response quality, and affirmative continuation quality, with rubric updates to score substantive outcomes over brittle phrase matching. Internal protocol fallback leakage: response sanitization no longer surfaces protocol-placeholder fallback text; empty/degraded sanitized content now resolves through deterministic user-facing quality fallback. Markdown count execution reliability: execution shortcut path now handles recursive markdown-file count prompts deterministically, including strict numeric-only responses when requested (`count only` / `only the number` style prompts).

Added: 3 changes. Changed: 7 changes. Fixed: 2 changes. Security: 1 change. Key changes: Routing observability UX: Metrics dashboard now includes an explorable model-decision graph and a routing-profile spider graph (correctness/cost/speed) with runtime apply support via safe config patching. Model shift telemetry: Non-streaming inference pipeline now emits websocket `model_shift` events when execution model differs from selected model (fallback or cache continuity path). Agent message contract: `/api/agent/message` responses now expose both routing-time and execution-time model fields (`selected_model`, `model`, `model_shift_from`) for continuity diagnostics. Routing dataset privacy default: `GET /api/models/routing-dataset` now redacts `user_excerpt` by default; explicit opt-in is required to include excerpts.

Added: 15 changes. Changed: 7 changes. Removed: 4 changes. Key changes: Wiring Remediation (Phase 0): Comprehensive Tier 1–3 wiring audit remediation. 14 gates cleared — all functional wires verified against code. See `docs/audit/wiring-audit-v0.9.md` for the full re-audit. Unified Request Pipeline: API (`agent_message`) and channel (`process_channel_message`) paths now share `prepare_inference` + `execute_inference_pipeline` in `core.rs`, eliminating 6+ behavioral asymmetries between entry points. `post_turn_ingest` Tool Results: All call sites now pass actual tool call name + result from the ReAct loop instead of `&[]`. Episodic memory captures tool-use context, improving digest quality. Gate System Note: `build_gate_system_note` now wired in both API and channel paths (previously channel-only).

Added: 6 changes. Changed: 2 changes. Key changes: Model Metascore Routing (2.19 core): Unified per-model scoring replaces availability-first routing. `ModelProfile` combines static provider attributes (cost, tier, locality) with dynamic observations (quality, capacity headroom, circuit breaker health). `metascore()` produces a transparent 5-dimension breakdown (efficacy, cost, availability, locality, confidence) with configurable weights for cost-aware mode. `select_by_metascore()` is now the primary routing decision in `select_routed_model_with_audit()`. Tiered Inference Pipeline (2.3): `ConfidenceEvaluator` scores local model responses using token probability, response length, and self-reported uncertainty signals. Responses below the confidence floor trigger automatic escalation to the next model in the fallback chain. `EscalationTracker` records escalation events for capacity/cost telemetry. Routing hot path: `select_routed_model_with_audit()` now extracts features from user content, classifies task complexity, builds model profiles, and selects via metascore — replacing the previous first-usable-model strategy. Rate limiter architecture: `GlobalRateLimitLayer` is now constructed once at startup and shared between the axum middleware stack and `AppState`, enabling admin observability of the same rate-limit counters the middleware uses.

Security: 3 changes. Fixed: 14 changes. Key changes: HIGH: RwLock held across LLM call: Config read-lock was held for the entire duration of streaming LLM calls, blocking all config writes. Now clones needed values and drops the lock before the network call. HIGH: CSS selector injection: Browser `click` and `type_text` actions now validate CSS selectors, rejecting inputs containing `{`/`}` (which can escape selector context into rule injection) and enforcing a 500-character length limit. HIGH: SSE streaming drops tool-use deltas: OpenAI-format SSE chunks with `content: null` (common in function-call and tool-use deltas) were silently dropped. Now emits an empty-string delta, matching the Anthropic and Google format arms. HIGH: Done event schema mismatch: The SSE `stream_done` event used `"content"` key while all streaming chunks used `"delta"`, causing clients to miss the done signal. Now consistently uses `"delta"`.

Security: 13 changes. Fixed: 26 changes. Key changes: HIGH: WebSocket API key leak: Replaced `?token=` query-string authentication on WebSocket upgrade with a ticket-based flow, preventing API keys from appearing in server logs, proxy logs, and browser history. HIGH: Prompt injection in tips: `get_turn_tips` and `get_session_insights` now sanitize LLM-generated tips before rendering, preventing stored prompt injection via malicious session content. HIGH: Float policy bypass: Policy enforcement on `amount` fields now falls back to `as_f64()` conversion, closing a bypass where float amounts evaded integer-only checks. HIGH: Tool call parsing failures: `parse_tool_call` now uses `rfind` with a candidate loop, correctly parsing tool calls that contain the delimiter character in arguments.

Fixed: 19 changes. Added: 2 changes. Key changes: CRIT: Cron jobs silently never firing: `run_cron_worker` timestamp format lacked timezone suffix (`Z`), causing `evaluate_cron` RFC 3339 parse to always fail — all cron-scheduled jobs were silently skipped. HIGH: Telegram chunk_message UTF-8 panic: Byte-level string slicing in `chunk_message` panicked on multi-byte characters (emoji, CJK). Now uses `floor_char_boundary()` matching the Discord adapter. Release notes for v0.8.5 and v0.8.6 (missing from previous releases, blocking release doc gate). Roadmap section 1.24: Built-in CLI Agent Skills (Claude Code + Codex CLI).

Security: 9 changes. Fixed: 14 changes. Added: 2 changes. Key changes: CRIT: Unauthenticated rate-limit actor identity: Removed `x-user-id` header as rate-limit actor identity — it was unauthenticated and trivially spoofable. CRIT: Stable token fingerprinting: Replaced `DefaultHasher` with SHA-256 for token fingerprinting, since `DefaultHasher` is not stable across processes and could cause cache/rate-limit bypasses. Windows daemon error propagation: `schtasks /Create` errors now propagate instead of being silently dropped; post-spawn verification added; `schtasks /Delete` errors during uninstall handled correctly. CLI API key headers: Added `--api-key`/`ROBOTICUS_API_KEY` global CLI argument. All 22 bare `reqwest` calls replaced with `http_client()` helper that injects API key as default header.

Security: 6 changes. Fixed: 22 changes. Key changes: WASM preemptive timeout (BUG-101): WASM plugin execution now runs on a dedicated thread with `recv_timeout`, providing true preemptive timeout instead of the previous post-hoc elapsed-time check that allowed malicious modules to run indefinitely. Script runner orphan kill (BUG-102): Script runner now captures the child PID before `wait_with_output()` and sends `kill -9` on timeout, preventing orphan process accumulation. reqwest Client panic (BUG-105): `VectorDbSource::new()` and `GraphSource::new()` now return `Result` instead of panicking via `.expect()` when TLS initialization fails. Signal handler crash (BUG-108): SIGTERM handler installation now falls back to SIGINT-only mode instead of crashing via `.expect()` in containerized environments.

Security: 3 changes. Fixed: 16 changes. Changed: 1 change. Key changes: WebSocket message size limit: Unauthenticated WebSocket connections now enforce a 4 KiB inbound message limit and no longer echo full message bodies, closing a ~3x memory amplification DoS vector. Hippocampus TOCTOU fix: `drop_agent_table` auth check and DROP are now wrapped in a single transaction, preventing race-condition bypasses. Agent amnesia on DB error (SF-2): `list_messages` calls in agent routes now propagate errors instead of silently returning empty history via `.unwrap_or_default()`. Governor silent write failures (SF-1): Session expiry and compaction errors are now logged at warn/error level; `tick()` returns an accurate expired count instead of silently swallowing failures with `.ok()`.

Security: 4 changes. Fixed: 4 changes. Added: 1 change. Key changes: Auth bypass when no API key: Requests to non-exempt API routes now fail closed when no API key is configured — only loopback connections are allowed. Previously, missing API key config silently allowed all traffic. A2A replay protection: Added nonce registry with TTL-based expiry to the A2A protocol, preventing message replay attacks within the nonce window. UTF-8 panic in memory truncation: Replaced unsafe byte-level string slicing with `floor_char_boundary()` to prevent panics on multi-byte characters (emoji, CJK) near the 200-char truncation point. Script plugin zombie processes: Script timeout now explicitly kills the child process and reaps it, preventing zombie accumulation.

Added: 3 changes. Fixed: 5 changes. Key changes: 100+ API route integration tests: Comprehensive test coverage for sessions, turns, interviews, feedback, skills, model selection, channels, webhooks, dead letters, admin, memory, cron, context, and approvals endpoints. Tests exercise both success and error paths including validation, 404s, auth, and edge cases. Workspace test count now at 3,316. Homebrew tap distribution: macOS/Linux users can install via `brew install robot-accomplice/tap/roboticus`. 29 stabilization bug fixes: Resolved input validation gaps, API error format inconsistencies, query parameter hardening, security headers, dashboard trailing content, model persistence, cron field naming, and Windows TOML path issues discovered during exhaustive hands-on testing of v0.8.1. HTML injection prevention: Closed remaining sanitization coverage gaps in API write endpoints.

Fixed: 12 changes. Changed: 2 changes. Key changes: 40 smoke/UAT bug fixes: Resolved 40 bugs (5 critical, 6 high, 15 medium, 14 low/UX) discovered during comprehensive smoke testing of all 85 REST routes, 32 CLI commands, and 13 dashboard pages. Input validation hardening: Added field-length limits, HTML sanitization, and null-byte rejection across all API write endpoints. CI scripts use POSIX grep: Replaced all `rg` (ripgrep) invocations with standard `grep -E`/`grep -qE` in CI scripts for broader runner compatibility. Windows compilation: Added conditional `allow(unused_mut)` for platform-gated mutation in security audit command.

Security: 17 changes. Fixed: 22 changes. Added: 16 changes. Changed: 4 changes. Key changes: CORS hardening: Removed wildcard `Access-Control-Allow-Origin: *` fallback when no API key is configured; CORS now always restricts to the configured bind address origin. Wallet key zeroing: Decrypted API keys in the keystore and child agent wallet secrets are now wrapped in `Zeroizing<String>` so key material is zeroed on drop. Telegram invalid-token resilience: Telegram `404/401` poll failures are now classified as likely invalid/revoked bot-token errors with explicit repair guidance and adaptive backoff to reduce noisy tight-loop logging. Subagent runtime activation sync: Taskable subagents are now auto-started at boot and kept in sync with create/update/toggle/delete operations, fixing the `enabled > 0, running = 0` stall where configured subagents stayed idle.

Fixed: 6 changes. Key changes: Windows daemon startup and binary update reliability fixes, dashboard render boundary hardening, and loopback-proxy migration safeguards with explicit deprecation guidance for v0.8.0 removal.

Added: 4 changes. Changed: 3 changes. Key changes: Subagent contract enforcement: Added explicit `subagent` vs `model-proxy` role validation, fixed-skills persistence/validation, and strict rejection of personality payloads for taskable subagents. Model-selection forensics pipeline: Added persistent `model_selection_events` storage, turn-linked forensics APIs (`GET /api/turns/{id}/model-selection`, `GET /api/models/selections`), and live dashboard views for candidate evaluation details. Roster and status semantics: `/api/roster`, `/api/agent/status`, and dashboard agent views now distinguish taskable subagents from model proxies and report taskable counts with clearer operator-facing terminology. Subagent model assignment options: Added support for `auto` (router-controlled) and `commander` (primary-agent-assigned) model modes for taskable subagents, including runtime model resolution behavior.

Fixed: 3 changes. Key changes: Release integrity follow-up: Merged post-tag regression fixes from the 0.6.0 release branch into `develop`, including web peer-scope identity validation, dashboard WebSocket token encoding, and release-gate compile/test stabilization. Session creation stability: Restored explicit default agent scope behavior in DB session creation paths to avoid `500` failures in session lifecycle APIs/tests.

Added: 4 changes. Changed: 5 changes. Key changes: Capacity headroom telemetry: New `GET /api/stats/capacity` endpoint exposes per-provider headroom, utilization, and sustained-pressure flags for operator visibility. Capacity-aware circuit preemption: Circuit breakers now accept soft capacity pressure signals and expose preemptive `half_open` state before hard failure trips. Routing quality now capacity-weighted: `select_for_complexity()` scores candidates by model quality and provider headroom, rather than binary near-capacity fallback behavior. Inference feedback loop now records capacity usage: both non-stream and stream response paths record provider token/request usage and update capacity pressure signals.

Added: 18 changes. Changed: 7 changes. Key changes: Addressability Filter: Composable filter chain for group chat addressability detection. Agent only responds when mentioned by name, replied to, or in a DM. Configurable via `[addressability]` config section with alias names support. Response Transform Pipeline: Three-stage pipeline applied to all LLM responses -- `ReasoningExtractor` (captures `<think>` blocks), `FormatNormalizer` (whitespace/fence cleanup), `ContentGuard` (injection defense). Replaces the previous inline `scan_output` approach. All 10 crate READMEs updated to v0.5.0 with expanded descriptions and key types. All 10 `lib.rs` files now have `//!` crate-level doc comments.

Added: 6 changes. Fixed: 3 changes. Changed: 2 changes. Key changes: Slash commands for agent chat: `/model`, `/models`, `/breaker`, `/retry` for runtime LLM control. Runtime model override via `/model set <model>` — temporarily forces a specific model, bypassing routing. Credit/billing errors now permanently trip the circuit breaker (no auto-recovery to HalfOpen) — providers with exhausted credits are never probed again until explicitly reset via `/breaker reset`. Dashboard "Save to keystore" button now sends `Content-Type: application/json` header — previously failed with "Expected request with 'Content-Type: application/json'".

Fixed: 3 changes. Key changes: `roboticus daemon start` now verifies the service is actually running after `launchctl load` — previously reported "Daemon started" even when the service crashed immediately. `roboticus daemon install` resolves the config path to absolute before embedding in the plist — previously used the relative path which launchd couldn't resolve.

Added: 5 changes. Fixed: 7 changes. Security: 4 changes. Key changes: `roboticus daemon start|stop|restart` subcommands for full daemon lifecycle management. Interactive prompt after `roboticus daemon install` asking whether to start immediately. Replaced stale `[providers.local]` (localhost:8080) with `[providers.moonshot]` in bundled and registry provider configs. Added `moonshot/kimi-k2.5` to dashboard known-models list for settings autocomplete.

Added: 10 changes. Changed: 5 changes. Fixed: 2 changes. Key changes: Signal channel adapter backed by signal-cli JSON-RPC daemon (`roboticus-channels::signal`). Unified thinking indicator (🤖🧠…) for all chat channels (Telegram, WhatsApp, Discord, Signal). `thinking_threshold_seconds` moved from per-channel (`TelegramConfig`) to `ChannelsConfig` level. Channel message processing is now platform-agnostic via `send_typing_indicator` / `send_thinking_indicator` helpers.

Security: 8 changes. Fixed: 11 changes. Changed: 10 changes. Added: 1 change. Key changes: Plugin sandbox: validate tool names against allowlist; reject path-traversal payloads; add `shutdown_all` for graceful teardown. Browser restrictions: block `file://`, `javascript:`, `data:` URI schemes in CDP navigation; harden Chrome launch flags. Telegram adapter now processes all updates in a batch, not just the first. Cron worker dispatches jobs instead of unconditionally marking success.

Full roadmap implementation — 35 items across 7 phases. ReAct agent loop, RAG retrieval pipeline, embedding provider integration, ANN index, persistent semantic cache, sub-agent framework, and comprehensive bug fixes from code review.

Added: 5 changes. Changed: 1 change. Fixed: 1 change. Key changes: Initial Project Roboticus baseline for Roboticus. Multi-crate Rust workspace foundation (runtime crates + integration test crate). Prepared packaging/publish metadata for early release workflows. Early release stabilization fixes for binary packaging, startup wiring, and quality gates.