@animalabs/connectome-host 0.7.3 → 0.8.0

package/.env.example

@@ -23,11 +23,18 @@ ANTHROPIC_API_KEY=sk-ant-...
 # GITLAB_TOKEN=glpat-...
 # GITLAB_API_URL=https://gitlab.example.com/api/v4
 
-# Notion (knowledge-miner.json: syncntn)
+# Notion — only if you add a Notion MCP server block back to
+# knowledge-miner.json (none ships by default; see TRIUMVIRATE-SETUP.md Step 6)
 # NOTION_STORAGE_URL=http://localhost:8000
 # NOTION_WORKSPACE_ID=...
 
-# Scribe — audio/video transcription (knowledge-miner.json: scribe)
-# GEMINI_API_KEY=...           # REQUIRED if you keep the scribe server (recipe uses bare ${GEMINI_API_KEY}); powers transcription
-# NOTION_API_KEY=...           # optional (recipe uses ${NOTION_API_KEY:-}); only scribe--scribe_notion_page needs it
-# SCRIBE_GLOSSARY_URL=...      # optional (recipe uses ${SCRIBE_GLOSSARY_URL:-}); unset = transcribe without a glossary
+# Web UI credentials (triumvirate.json: webui). Defaults to admin:admin —
+# CHANGE THESE for anything reachable beyond your own machine.
+# WEBUI_USERNAME=admin
+# WEBUI_PASSWORD=admin
+
+# Scribe — audio/video transcription. Only if you add a scribe block back to
+# knowledge-miner.json (none ships by default; see TRIUMVIRATE-SETUP.md Step 6)
+# GEMINI_API_KEY=...           # required by the scribe block (bare ${GEMINI_API_KEY}); powers transcription
+# NOTION_API_KEY=...           # optional (block uses ${NOTION_API_KEY:-}); only scribe--scribe_notion_page needs it
+# SCRIBE_GLOSSARY_URL=...      # optional (block uses ${SCRIBE_GLOSSARY_URL:-}); unset = transcribe without a glossary

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -19,8 +19,9 @@
 
 ---
 
-- [ ] `CHANGELOG.md` updated under `## Unreleased` — or this change is
-      internal-only / test-only / docs-only (apply the `no-changelog` label).
+- [ ] Changelog fragment added — `changelog.d/<slug>.<breaking|added|changed|fixed>.md`
+      (see `changelog.d/README.md`) — or this change is internal-only /
+      test-only / docs-only (apply the `no-changelog` label).
 
 <!-- AI-assisted contributions are welcome and normal here — see
      CONTRIBUTING.md for the attribution convention (footer + Co-Authored-By). -->

package/.github/workflows/changelog.yml

@@ -14,19 +14,24 @@ jobs:
     if: "!contains(github.event.pull_request.labels.*.name, 'no-changelog')"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
 
-      - name: Require CHANGELOG.md update when src/ changes
+      - name: Require changelog fragment when src/ changes
         run: |
           base="${{ github.event.pull_request.base.sha }}"
           head="${{ github.event.pull_request.head.sha }}"
           changed=$(git diff --name-only "$base...$head")
+          # Fragments must be *added* — a deleted or renamed fragment also
+          # appears in --name-only and must not satisfy the check.
+          added=$(git diff --name-only --diff-filter=A "$base...$head")
           echo "Changed files:"
           echo "$changed"
-          if echo "$changed" | grep -q '^src/' && ! echo "$changed" | grep -qx 'CHANGELOG.md'; then
-            echo "::error::This PR touches src/ but not CHANGELOG.md. Add an entry under 'Unreleased' (see CONTRIBUTING.md), or apply the 'no-changelog' label if the change is internal-only."
+          if echo "$changed" | grep -q '^src/' \
+             && ! echo "$added" | grep -Eq '^changelog\.d/[^/]+\.(breaking|added|changed|fixed)\.md$' \
+             && ! echo "$changed" | grep -qx 'CHANGELOG.md'; then
+            echo "::error::This PR touches src/ but carries no changelog entry. Add a fragment changelog.d/<slug>.<breaking|added|changed|fixed>.md (see CONTRIBUTING.md), or apply the 'no-changelog' label if the change is internal-only."
             exit 1
           fi
           echo "OK"

package/.github/workflows/ci.yml

@@ -25,15 +25,17 @@ jobs:
         os: [ubuntu-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 24
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.3.14
 

package/.github/workflows/publish.yml

@@ -15,15 +15,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 24
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.3.14
 
@@ -51,7 +53,9 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Require changelog section for this release
         run: |
@@ -63,7 +67,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           # node 24 ships npm >= 11.5.1, required for OIDC publishing.
           node-version: 24
@@ -91,7 +95,9 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Mirror changelog section into release notes
         env:

package/CHANGELOG.md

@@ -1,7 +1,408 @@
 # Changelog
 
+Entries land with the change that causes them, as fragment files in
+[`changelog.d/`](changelog.d/) that are folded into a version section at
+release time — see [CONTRIBUTING.md](CONTRIBUTING.md#changelog).
+
 ## Unreleased
 
+## 0.8.0 — 2026-09-05
+
+### Added
+
+- Recipes accept `agent.proseRouting: "disabled"` for tool-only external publication when paired with a supporting Agent Framework release.
+- **`modules.instructions`** — a shared living-instructions file (a CLAUDE.md
+  analogue kept in a workspace mount) injected into every agent's context on
+  every turn, ephemeral subagents included. `true` for defaults
+  (`instructions/AGENTS.md`, 32 KB cap, `system` position) or
+  `{ path, header, maxBytes, position }`. Reads resolve through the workspace
+  mount (scoping + traversal guard apply), are bounded to `maxBytes`, reject
+  symlinks leading outside the mount (realpath containment), are cached by
+  `(realpath, mtime, size)`, and fail open — a missing file never blocks
+  inference. Recipe validation cross-checks the path's mount prefix against
+  the effective workspace mounts (explicit and implicit alike) at load time,
+  requires `autoMaterialize: true` on a read-write instructions mount so
+  agent curation edits actually reach the disk-side injection, and rejects
+  the host-managed `_config` mount (it materializes only on branch-changing
+  commands). Validation and the runtime share one mount builder
+  (`src/workspace-mounts.ts`), so the two cannot drift.
+
+- Recipes accept the default-off `agent.strategy.compressionSourceOnly` flag and pass it through to Context Manager's residence-scoped L1 compression request builder (#103).
+
+- Gate telemetry stamps why the turn fired: `x-gate-origin` (heartbeat |
+  event | mail | operator | raw reason), `x-gate-channel` and
+  `x-gate-counterparty` (adapter-namespaced ids, never content or display
+  names) ride the stream lane under the same `GATE_TELEMETRY=1` + base-URL
+  gate as the debt stamp; background calls on the complete lane carry debt
+  only (#113).
+
+- Gate-bound Anthropic calls carry an `x-gate-debt-chunks` header with the
+  live compression-debt pending-chunk count (membrane `dynamicHeaders`,
+  antra-tess/membrane#65) — the gateway records it per ledger row and strips
+  it before the vendor. Double-gated on `GATE_TELEMETRY=1` AND a configured
+  `ANTHROPIC_BASE_URL`, so the stamp can never reach a vendor endpoint;
+  unreadable state sends no header rather than a guess (#109).
+
+- Health tab renders the per-agent compression-debt reduction (state, pending
+  chunks, oldest age, merge queue) and says "not reported by this stack" when
+  absent — the queue is now distinct from context composition, and the top
+  line reads "inference queued" (#110).
+
+- Add complete fail-closed recipe validation and strategy passthrough for `foldingStrategy: "kv-unified"`; partial policies, invalid occupancy bands, unsafe approximation grids, and implicit treeification are rejected at load time.
+
+- **`agent.provider: 'openai-compatible'`** — run an agent against any
+  OpenAI chat-completions endpoint (Ollama, vLLM, Together, Groq, NanoGPT,
+  ...) via membrane's existing `OpenAICompatibleAdapter`, which no host ever
+  wired. The recipe names the endpoint (`agent.baseUrl`, validated as an
+  absolute http(s) URL at load) and the model (required — no default for an
+  arbitrary endpoint); the key comes from `OPENAI_COMPATIBLE_API_KEY`
+  only (no `OPENAI_API_KEY` fallback — `baseUrl` is recipe-controlled, so a
+  fallback would silently send a real OpenAI credential to an arbitrary
+  endpoint) and may be absent for local servers.
+  `agent.baseUrl` with any other provider is rejected at load time.
+
+- Recipes can pass the Context Manager source-only compression controls through Host/FKM, including the new default-off L1 and merge final-fallback modes, with boolean validation and cross-agent isolation.
+
+### Added
+
+- **`agent.cacheKeepalive` — hold an idle agent's 1h prompt cache warm.** With
+  `cacheTtl: "1h"`, an idle agent's cached prefix expires after an hour and its
+  next wake pays a **2x cache write** over the entire context. Reading an entry
+  restarts its clock, so membrane now replays the last request with
+  `max_tokens: 0` (prefill only) to refresh it at cache-**read** price (0.1x).
+  On by default for the anthropic provider; `{ "enabled": false }` opts out.
+  - **Cost is proportional to actual idleness, not to `maxIdleHours`.** A poke
+    fires only when the entry is genuinely near expiry, so a busy agent never
+    fires one — its own traffic already refreshed the TTL. Measured on mythos
+    llm-calls over 36h: 563 of 637 gaps were under 5 minutes, only 5 exceeded
+    1h.
+  - Knobs: `maxIdleHours` (default 24, measured from the last **real** request
+    so pokes cannot extend their own mandate) and `refreshAfterMinutes`
+    (default 45). Recipe validation **rejects `refreshAfterMinutes >= the cache
+    TTL`** — such a keepalive always fires after the entry has already expired,
+    paying a full cache write on every poke while still looking like a healthy
+    successful call.
+  - Events land in `service-stderr.log`, warn-level for `ineffective` and
+    `disabled`, so a background spender is legible without opening a billing
+    dashboard.
+  - Sizing, from fable-cm's 11-day log (~500k-token prefix): 49.7M tokens of
+    `cache_creation` landed on turns following a >1h idle gap — ~$944 of write
+    premium at fable-5 rates that this converts to ~$308 of reads.
+
+- **`provider: "mock"` — run the whole host with zero provider spend and no
+  credentials.** Wires membrane's existing `MockAdapter` (previously
+  unreachable from any recipe) as a first-class provider: echoes the last
+  user message by default, or returns `agent.mock.defaultResponse` with
+  `agent.mock.echoMode: false` for deterministic scripted output. No API
+  key is required or read. Mock calls still ride the generic logging
+  decorator, so `llm-calls.*.jsonl` receipts work exactly as they do for
+  real providers. `recipes/mock-test.json` is a ready-made offline smoke
+  recipe (loopback webui, everything else off).
+
+### Added
+
+- **Hybrid prose routing.** Recipes may set `agent.proseRouting: "hybrid"`: unprefixed text keeps ordinary frozen-locus delivery, while a leading `>>>destination` publication envelope routes through Agent Framework’s existing authorized cross-surface resolver. Source text retains the envelope; recipients see only the body; success/failure returns to resident context.
+
+- **`conversations` recipe block — per-channel conversation forks.** Maps to
+  agent-framework's `ConversationRouter`: the recipe's agent becomes a dormant
+  trunk template, and qualifying incoming channel messages spawn per-channel
+  fork agents seeded from the trunk's current context. Recipe surface: `bind` /
+  `trigger` rules per channel kind (`dm`/`groupDm`/`channel`), `idleTtlMs`
+  (default 12h), `closurePrompt`, and `agentPrefix`. The host fills
+  `templateAgent` from the recipe and creates a fresh stateful strategy instance
+  for each fork. Absent block means no routing and no behavior change.
+
+- **Protective reaction-suppression baseline for Discord adapters.** Stdio
+  MCPL children now receive `DISCORD_SUPPRESSED_REACTIONS_BASELINE` — the
+  agent-framework's exported refusal-annotation set (`REFUSAL_REACTION_BASELINE`,
+  comma-joined) — so a never-configured Discord adapter defaults to
+  suppressing exactly the markers this host's framework stamps, instead of
+  defaulting to nothing. An operator-set value on the server entry
+  supersedes the house baseline, and the adapter's own precedence (filters-file
+  key including explicit `[]` → legacy operator env → baseline) governs
+  enforcement; lost configuration stays stale rather than re-defaulting.
+  Requires an agent-framework release carrying the `REFUSAL_REACTION_BASELINE`
+  export.
+
+- **Standing autobiographical production target.** Recipes may set `agent.strategy.productionBudgetTokens` to keep the summary forest deep enough for a later live context-budget descent without a fold storm. This is a context-token target passed through to Context Manager, not a provider-spend ceiling; omission preserves Context Manager defaults.
+
+- **`mcpl_list` reports manifest freshness.** Each loaded server now shows the
+  last validated manifest revision plus fetch and grant-negotiation timestamps.
+  Older Agent Framework versions remain legible as `manifest=unknown`, and the
+  server-authored revision is quoted and bounded before reaching model-facing
+  text.
+
+- **`BEDROCK_BASE_URL` env hook** for the bedrock provider — mirrors
+  `ANTHROPIC_BASE_URL`, routing bedrock-runtime calls through an inference
+  gateway (gate.animalabs.ai/bedrock/<credSet>). The gate reads the agent
+  token from the SigV4 Credential (`AWS_ACCESS_KEY_ID` slot), discards the
+  client signature, and re-signs with real AWS creds. First user: Princess,
+  moved off the first-party Anthropic API (classifier "bio" false-positive
+  streak) onto Bedrock Sonnet 4.5 via gate apse1 — needs membrane ≥1dcd4e3
+  for `global.` inference-profile id pass-through.
+
+### Changed
+
+- **Dependency floor: agent-framework `^0.10.0`, chronicle `^0.3.0`,
+  membrane `^0.5.78`.** af 0.10.0 brings `ConversationRouter` (the
+  per-channel conversation-fork machinery this release’s `conversations`
+  recipe surface targets, and includes the current `hybrid` prose router) and exports `nudgeAgent`, which `/nudge` has
+  called since it landed — on every published af before 0.9.0 that call
+  was a guaranteed `TypeError`, so the floor also makes `/nudge` actually
+  work. Chronicle `^0.3.0` aligns the whole tree on one chronicle copy
+  (previously context-manager `0.6.3` nested its own `0.3.0` next to the
+  host's `0.2.x`). Operators: run a clean `npm ci` — a stale
+  `node_modules` predating the lock is the known failure mode here.
+
+- **The public triumvirate recipes boot from a fresh clone.**
+  `knowledge-miner.json` no longer ships a `syncntn` (Notion) block pointing at
+  an org-internal adapter that isn't publicly available — with `NOTION_*` env
+  vars unset the block failed recipe load, and with them set it died at spawn
+  on the dangling `../syncntn` path. The `scribe` block is dropped for the
+  same reason: it hard-required `GEMINI_API_KEY` and a `../scribe-mcp`
+  sibling checkout, neither mentioned anywhere in the setup guides — a
+  guide-following fresh install always got a crashed miner. Notion and
+  Scribe are now add-a-block opt-ins, documented in SETUP.md and
+  TRIUMVIRATE-SETUP.md (the miner prompt's tool-name contracts are
+  unchanged). `triumvirate.json` declares
+  webui Basic-Auth defaulting to `admin`/`admin` (override via
+  `WEBUI_USERNAME` / `WEBUI_PASSWORD` in `.env`) instead of bare
+  `"webui": true`, which the non-loopback bind guard refuses to start.
+
+- **agent-framework `^0.11.0`** (was `^0.10.0`). Activates `proseRouting:
+  "disabled"` for recipes that set it (#100 accepted the key; the runtime now
+  implements it — generated prose is never published externally, only explicit
+  tools speak), plus AF 0.11's Windows workspace-mount fix and the
+  org-acceleration 429 cooldown. Clears the last two standing cross-package
+  `tsc` errors — the typecheck is fully clean at this lock.
+
+- Changelog entries now land as per-change fragment files in `changelog.d/`
+  (`<slug>.<breaking|added|changed|fixed>.md`), folded into the version
+  section at release time — concurrent PRs no longer conflict in
+  `CHANGELOG.md`. Editing `## Unreleased` directly still works and is merged
+  at the same point.
+
+- **membrane `^0.5.80`** (was `^0.5.78`, lockfile-resolved 0.5.79). Two
+  latent cache behaviors the host already configures become ACTIVE with this
+  relock: the prompt-cache keepalive (`agent.cacheKeepalive`, on by default —
+  previously passed to an adapter version with no such field and silently
+  ignored, so idle gaps over the 1h TTL repaid a full cache write on wake)
+  and the floating cache marker (incremental prompt caching inside the native
+  tool loop, membrane's default-on). Both reduce cost; neither changes
+  visible agent behavior. Also clears two of the four standing cross-package
+  `tsc` errors (the membrane-typing pair).
+
+- Depend on `@animalabs/agent-framework` ^0.12.0 and `@animalabs/membrane` ^0.5.82 —
+  the published versions that implement the active-turn trigger and the
+  lane-aware `dynamicHeaders` the wake-cause stamp (#113) relies on; the
+  compatibility cast and optional lookup are gone, and an adapter-level test
+  proves a stream call carries the origin trio while a complete call carries
+  debt only.
+
+### Fixed
+
+- **Prompt-cache keepalive events all go to stderr**, so every one of them lands
+  in `service-stderr.log` beside `[inference-refusal]` instead of being split by
+  severity across two sinks. Routine `refreshed` events previously went to
+  stdout — which the host unit leaves on the journal — so the log an operator
+  actually greps showed nothing. Observed on fable-cm 2026-08-23: the keepalive
+  refreshed a 523,102-token prefix three times, correctly and with zero cache
+  writes, while a monitor tailing `service-stderr.log` reported no activity for
+  three hours. A background spender that can't be found in the operator's log is
+  indistinguishable from one that never ran.
+
+- Plumb `agent.strategy.compressionRecallBudgetTokens` through recipe validation and Framework strategy construction, with positive-integer validation instead of silently accepting an inert key.
+
+- **Saved recipe snapshots no longer contain resolved secrets.** `loadRecipe`
+  substitutes every `${VAR}` — API tokens included — and the host then wrote
+  that fully resolved recipe to `$DATA_DIR/.recipe.json` at default file mode:
+  plaintext credentials in the exact directory deployments bind-mount and back
+  up (found by an external recipe review that verified live tokens in a backed
+  up `data/` directory on a production VM). The snapshot now keeps the
+  pre-substitution form — `${VAR}` references literal, a URL `systemPrompt`
+  kept as the URL — and a resumed session re-runs substitution, validation,
+  and the prompt fetch against the *current* environment, so secret rotation
+  and remote prompt updates take effect on restart without re-cooking. The
+  file is written 0600 and re-chmod'd 0600 on every save. Legacy resolved
+  snapshots (no `$unresolved` marker) still load verbatim, with no
+  substitution, so a literal `${...}` surviving in prose cannot fail them;
+  resuming an unresolved snapshot whose required env var has since disappeared
+  fails loudly naming the variable instead of silently starting the default
+  recipe.
+
+- **Ephemeral subagents inherit the caller's `proseRouting` mode.** They
+  previously always ran AF's `'locus'` default regardless of the recipe, so a
+  resident running `proseRouting: "disabled"` still spawned subagents whose
+  between-tool-calls prose published live into its open channel as parent
+  speech (field-confirmed on a deployed resident, 2026-08-26 — including
+  after the recipe adopted `"disabled"`, which reached only the resident).
+
+### Fixed
+
+- **`mcpServers.<id>.source` accepts cook's npm registry form.**
+  `validateRecipe` demanded `source.url`, but connectome-cook's source grammar
+  also has `{ "npm": "pkg@version" }` — which the shipped knowledge-miner
+  recipe uses for its gitlab server, so that recipe failed to load
+  (`mcpServers.gitlab.source.url must be a non-empty string`). Exactly one of
+  `url` / `npm` is now required; the field remains build-tooling metadata,
+  ignored at runtime.
+
+## 0.7.4 — 2026-08-03
+
+### Changed
+
+- **Frontdesk agents ride the adaptive path.** `frontdesk` strategies now
+  default to adaptive resolution + kv-stable folding, same as
+  `autobiographical` (a recipe can pin `adaptiveResolution: false` to keep the
+  old hierarchical renderer). The hierarchical renderer reserves nothing for
+  the raw tail and cannot shed summary mass, so a long-lived frontdesk agent
+  eventually saturates its fixed context budget into a terminal
+  `UncoveredDropError` refusal loop — the 2026-08-03 boter clerk outage.
+  Details and deltas:
+  - Topic-aware chunking now rides context-manager's `chunkBoundaryHint` seam
+    (requires CM ≥0.6.3) instead of a fork of `rebuildChunks` that silently
+    bypassed chunk-record persistence and the fail-closed orphan guard.
+  - Existing frontdesk stores carry no chunk records (the fork never wrote
+    them); context-manager's `migrateChunkRecords` backfills them from L1
+    `sourceIds` on first load, so upgraded stores do not re-compress lived
+    history. First boot re-plans folds (one-time KV churn, possibly a burst of
+    L1 production for the un-summarized frontier).
+  - The salience-biased L1 emission order is retired (it was a hierarchical-
+    renderer concept); unanswered questions/@mentions are still preserved
+    verbatim through the compression prompt.
+  - Witnessed chunks now get the base witnessed compression prompt; the fork
+    predated witnessed prompts and overrode them.
+
+### Added
+
+- **Every WebUI inspection panel now works per fleet child.** One persistent
+  scope dropdown in the sidebar header ("inspecting: …") replaces the
+  per-tab pill rows Lessons/Files carried — MCPL, Context, Settings, Pins,
+  Health, and the main-pane Context document all follow it, instead of the
+  previous split where only Lessons/Files could switch (statefully, via
+  duplicated pickers), Context 404'd by mis-sending the child name as an
+  `?agent=` param, and MCPL/Settings/Pins/Health were silently locked to the
+  fleetmaster. Backed by one generic fleet IPC verb pair
+  (`panel-request`/`panel-response`) dispatching into a shared panel layer
+  (`src/web/panel-data.ts`) that both the WebUI host and headless children
+  run — a new panel op needs no protocol change to work fleet-wide.
+  Details:
+  - `/debug/context/{,makeup,coverage,curve,preview,maintenance}` and
+    `/healthz` accept `?scope=<child>` — the host proxies to the child over
+    the fleet IPC and answers with its JSON verbatim (still curl-able;
+    connectome-doctor / fleet hub can now watch children through the host).
+    `/curve?scope=<child>` passes through to the scoped JSON.
+  - The MCPL tab shows the scoped process's **live** loaded servers
+    (connection status, tool counts — the long-missing fleet mcpl snapshot)
+    above the shared registry file; registry edits stay host-scope (the
+    file is one cwd-shared registry, so a "child-local edit" would be a
+    lie) and the panel says so instead of hiding the fact.
+  - Settings mutations, dry-run previews (single-flight guard now lives in
+    the target process), and pin add/remove run inside the scoped child;
+    child pins snapshots ship picker candidates (real store ids) since the
+    SPA has no window into a child's message store.
+  - Scoped WS responses (`lessons-list`, `workspace-*`, `mcpl-list`,
+    `settings-state`, `pins-list`) now echo their `scope`, and the SPA
+    drops replies that arrive after the operator switched — fixing a
+    pre-existing race where a slow child's lessons/files could render under
+    another child's header.
+  - Child health snapshots include the child's recent provider-call ledger.
+- **TUI: context budget gauge.** The status bar's `ctx:` readout and the fleet
+  tree's per-agent readouts show `142k/180k` against the *live* runtime budget
+  (runtime overrides win over the recipe), and the status segment goes yellow at
+  75% / red at 90% — "how close to compression/trouble" at a glance instead of a
+  bare number.
+- **TUI: fleet view viewport.** The tree now scrolls with the cursor
+  (`┈ N lines above/below ┈` markers) instead of clipping past the bottom of the
+  terminal — previously a large fleet let the cursor walk below the fold and
+  Del:stop targeted rows the operator couldn't see.
+- **TUI: fleet view opens with a summary header** — agent counts
+  (running/done/failed/cancelled across local subagents *and* fleet children),
+  children up/crashed, session cost — plus the active ops alerts in full (the
+  status bar only has room for a count).
+- **TUI: event timestamps.** Alerts, tool batches, subagent results, wake
+  triggers, branch switches, errors and user messages get an `HH:MM` prefix, so
+  scrollback read an hour later still answers "when".
+- **TUI: root-agent tool completions are visible.** Verbose shows every
+  `✓ tool (1.2s)`; terse shows the slow ones (≥2s). Slow *running* tools show a
+  live elapsed in the status bar after 5s — "still executing" and "stuck" no
+  longer look identical.
+- **TUI: the status bar names the worst active alert** (`⚠ 2 ·
+  compression-quarantine`), with quarantine and inference-exhausted outranking
+  the merely-recent.
+
+### Changed
+
+- **TUI: thinking honors the Ctrl+V verbose toggle.** Terse mode collapses live
+  thinking to a counting one-liner (`💭 thinking… ~1.2k tok`) and replayed
+  history thinking to one truncated line per block — the toggle's label always
+  claimed this.
+- **TUI: session-history replay caps at the last 50 messages** (marker points at
+  the web UI for the rest) instead of flooding scrollback with the whole session.
+- **TUI: elapsed times are humane everywhere** — `5m48s`, not `348s`; the fleet
+  tree and both peek views now agree.
+- **TUI: peek-proc renders child `ops:alert` events properly** (red `⚠ kind:
+  message`, cyan for `-clear`) instead of a dim `· ops:alert` dot line, and no
+  longer prints dot lines for per-block/per-round bookkeeping events.
+- **TUI: the status-left segment truncates to fit** the terminal width instead of
+  shoving the tokens/mem segment off the row.
+
+### Fixed
+
+- `cancel-subagent-result` was missing from the headless runtime's
+  subscription-filter exemptions: a parent that narrowed the event stream
+  could never see its own cancel confirmations.
+- The Vite dev server proxies `/debug`, `/healthz`, `/curve`, and `/files`
+  to the running host — previously every HTTP panel fetch 404'd under
+  `bun run dev`.
+- **TUI: "Branch switched" announcements survive.** The line was printed *before*
+  `refreshFromStore()` cleared the scrollbox, so it was destroyed unread.
+
+### Upgrade notes
+
+- **subagents/lessons/retrieval are now opt-in** (they were opt-out, and
+  DEFAULT_RECIPE enabled all three). A recipe that omits them ran them under
+  v0.7.2 and stops running them on this upgrade — that is the fix for
+  "lessons injected despite following the onboarding guide" (Discord issue
+  #32) working as intended. A recipe that *explicitly* enables them keeps
+  them, deliberately: a defaults change cannot tell old boilerplate from a
+  real choice. Before upgrading an existing deployment, run
+
+      bun scripts/audit-module-optins.ts <recipes-and-data-dirs...>
+
+  It reports every explicit enable, every omission that changes behavior,
+  and every retrieval-without-lessons combination that would go silently
+  inert — and modifies nothing; the decisions stay with the operator.
+  Persisted `data/.recipe.json` files are launch-time snapshots, not
+  authoritative sources — the audit lists them separately as pointers back
+  to the source recipe. Retrieved-lesson injection also moved from the
+  system prompt to after the last user message, which keeps the stable
+  prefix KV-cacheable.
+
+### Added
+
+- **Operator retrieval traces.** The Web UI now exposes operator-only,
+  process-memory retrieval traces at `/debug/retrieval` and a readable
+  lesson-selection viewer at `/debug/retrieval/view`, including invoking-agent
+  attribution, mechanical candidates, relevance decisions, cache provenance,
+  and the exact injected lesson block. Exact conversation/model inputs remain
+  opt-in via literal `includeInputs=1`.
+
+### Fixed
+
+- **OpenAI retrieval reasoning effort.** Recipes using `openai-responses` or
+  `openai-codex` can set `modules.retrieval.reasoningEffort` independently of
+  the primary agent. Unsupported providers fail recipe validation instead of
+  receiving an invalid OpenAI-shaped request, and reasoning-enabled retrieval
+  requires an explicit model instead of falling through to the Claude default.
+  
+- **`mcpl_list` reports the live MCPL policy boundary.** Each server now shows
+  connected/retrying state, whether its initial policy was established, its
+  effective grant, host-masked and deny-by-default capability paths, and the
+  separate host-owned `host/command` authority. During a rolling upgrade,
+  fields unavailable from an older agent-framework render as `unknown` rather
+  than as a misleading empty grant.
+
 ## 0.7.3 — 2026-08-01
 
 ### Changed
@@ -68,8 +469,6 @@
   write, output, breakpoints, duration and verdict, with refusals and errors
   highlighted. Cumulative totals for the session remain in the Usage panel.
 
-## Unreleased
-
 ## 0.7.0 — 2026-07-26
 
 ### Added
@@ -89,8 +488,6 @@
   `/debug/context/makeup` this costs nothing and makes no `count_tokens` network
   call, so it is safe on the 15s health poll.
 
-## Unreleased
-
 ## 0.6.1 — 2026-07-26
 
 ### Fixed
@@ -105,8 +502,6 @@
   text/id filter. Caught by checking the endpoint against a real store before
   anyone used the panel.
 
-## Unreleased
-
 ## 0.6.0 — 2026-07-26
 
 ### Added
@@ -170,8 +565,6 @@
   measured cost, and notes runs are serialized so a second click is refused
   rather than queueing another pause.
 
-## Unreleased
-
 ## 0.5.3 — 2026-07-26
 
 ### Added
@@ -294,8 +687,6 @@
 - `compressionMaxTokens` recipe passthrough — cap compression output for
   models with low output ceilings (2c78936).
 
-## Unreleased
-
 ### Fixed
 
 - **TUI bug sweep** (#64): operator-safety and observability fixes.