@askexenow/exe-os 0.9.244 → 0.9.246

package/release-notes.json

@@ -1,6 +1,206 @@
 {
-  "current": "0.9.244",
+  "current": "0.9.246",
   "notes": {
+    "0.9.246": {
+      "version": "0.9.246",
+      "date": "2026-06-09",
+      "features": [
+        "Entity Profile UI — knowledge graph explorer + entity detail view",
+        "log MCP session open/close to stderr for docker logs visibility",
+        "Graph→PostgreSQL sync timer — automatic SQLite→exe-db projection",
+        "project GraphRAG data to PostgreSQL during cloud sync pull",
+        "add behavior effectiveness tracking — attribution, conflicts, scoring, load",
+        "close the reinforcement loop — dreaming reads investigation data",
+        "add reviews to Cloudflare support system — separate from bugs/features",
+        "self-improvement auto-merges simple fixes, notifies on failures",
+        "automatic investigation record system for debugging cycle tracking",
+        "smoke test + Playwright E2E + self-improvement cron",
+        "P0 procedures — verify your own fix + confidence decay",
+        "boot output as formatted table with box-drawing characters",
+        "show auto-fix cycle status in exe-os boot",
+        "graceful daemon restart — persist MCP sessions for transparent recovery",
+        "default to keyword+graph search, embeddings opt-in",
+        "server-side telemetry storage + admin insights endpoint",
+        "enrich telemetry payload with usage counters and auto-insights",
+        "add telemetry auto-insight computation engine",
+        "auto-calibration in dreaming cycle + telemetry integration",
+        "first-class time estimation on tasks — auto-tracked, queryable",
+        "add agent assertion system — confidence tracking on task lifecycle",
+        "auto-run dreaming cycle on session end — zero-touch self-improvement",
+        "add dreaming system + structured handoffs to platform procedures",
+        "add snapshot + boot to platform procedures and operating procedures",
+        "add `exe-os boot --project X` CLI command for project boot verification"
+      ],
+      "fixes": [
+        "spawn lock dedup, MCP recovery mutex, health timeout 60→180s",
+        "exclude release-note chores from generated notes",
+        "dedupe stale MCP session recovery",
+        "embeddings OFF by default for all users — opt-in via EXE_EMBEDDINGS=1",
+        "keep generated env templates in sync",
+        "bootstrap monitor env and lazy-init recall memory",
+        "registry proxy accepts license keys + stack-update reads .env license",
+        "stack-release uses defaultBranch per repo (wiki uses master)",
+        "prevent stale task intercom prompts",
+        "v0.9.241 — 13 more bug fixes (28 total this session)",
+        "sync lockfile for Docker build — npm ci --omit=dev works again",
+        "keep review notifications session-local and test-safe",
+        "CI Dockerfile reference — Dockerfile.exed → Dockerfile.exe-os",
+        "v0.9.240 — 15 bug fixes across HYGO, Jack, platform (stack v0.9.15)",
+        "keep daemon memory recall FTS bounded",
+        "keep daemon cloud sync off CRDT heap path",
+        "suppress ENOBUFS in reapers + skip boot-time sync execution",
+        "MCP health probe in prompt hook + Docker image build tolerance",
+        "plug MCP session memory leak — zombie McpServer instances accumulated",
+        "lower RSS watchdog to 1.5/2.5GB + add GC after heavy operations",
+        "snapshot crash — daemon fallback + dreaming scope binding",
+        "skip duplicate initStore in WS client — prevents 2-8s event loop block",
+        "add session scope imports to dreaming, project-boot, telemetry-upload",
+        "resolve typecheck errors for npm publish",
+        "add setImmediate yields to Graph→PG sync — prevent event loop blocking"
+      ],
+      "security": [
+        "fix shell injection, SSRF, socket leaks, backup validation",
+        "bump v0.9.139 — 2 CRITICAL security fixes, 14 bug fixes, 6 features, customer config preservation",
+        "fix 2 CRITICAL + 1 HIGH from post-fix audit",
+        "validate X-Agent-Role against roster — prevent privilege escalation",
+        "release: stack v0.9.8 — security hardening + Hygo bug fixes",
+        "add webhook HMAC-SHA256 validation + disable query param auth in prod",
+        "pin GitHub Actions to SHAs, update jose to 6.2.3",
+        "harden support intake against abuse and data leakage",
+        "bump to v0.9.22 — Codex MCP parity + customer bug fixes + security audit remediation",
+        "audit: pre-hygo exe-gateway security report",
+        "add SECURITY.md — trust document for pre-install security evaluation",
+        "fix 4 pricing tier bypass vulnerabilities (audit F1-F4)"
+      ],
+      "other": [
+        "cover singleton employee spawn lock",
+        "cover registry proxy license auth fallbacks",
+        "update release notes for v0.9.243",
+        "stack release v0.9.16",
+        "bump v0.9.243 for stack release",
+        "bump v0.9.242 for stack release",
+        "add STACK-RELEASE.md — full release process documentation",
+        "claurst competitive analysis — npm distribution + free-tier mode",
+        "bump stack.release.json to v0.9.240 for CI image build",
+        "update release notes for v0.9.238-239",
+        "release: stack v0.9.14 — gateway audit fixes",
+        "release: stack v0.9.13 — HYGO deployment readiness",
+        "incremental Graph→PG sync — 86K rows → deltas only",
+        "batch Graph→PG sync — 500 rows per INSERT instead of row-by-row",
+        "consolidate daemon timers into unified orchestration tick (#78)",
+        "revise GLiNER — Haiku API now, GLiNER when cost matters",
+        "capture GLiNER entity extraction in ARCHITECTURE.md",
+        "detailed design system structure + Phase 2 component list",
+        "exe-os-design-system — unified design system for all products",
+        "GoTrue JWT unified auth architecture — founder directive 2026-06-08",
+        "Thread + Graph Discovery architecture — unified knowledge view",
+        "move heavy jobs to 9 PM — GraphRAG, skill sweep, backup",
+        "Mode 3 Client-Side RAG architecture — memories never leave device",
+        "bump to v0.9.230 — P0 WAL backup corruption fix for Jack",
+        "bump to v0.9.225"
+      ],
+      "migration_notes": []
+    },
+    "0.9.245": {
+      "version": "0.9.245",
+      "date": "2026-06-09",
+      "features": [
+        "Entity Profile UI — knowledge graph explorer + entity detail view",
+        "log MCP session open/close to stderr for docker logs visibility",
+        "Graph→PostgreSQL sync timer — automatic SQLite→exe-db projection",
+        "project GraphRAG data to PostgreSQL during cloud sync pull",
+        "add behavior effectiveness tracking — attribution, conflicts, scoring, load",
+        "close the reinforcement loop — dreaming reads investigation data",
+        "add reviews to Cloudflare support system — separate from bugs/features",
+        "self-improvement auto-merges simple fixes, notifies on failures",
+        "automatic investigation record system for debugging cycle tracking",
+        "smoke test + Playwright E2E + self-improvement cron",
+        "P0 procedures — verify your own fix + confidence decay",
+        "boot output as formatted table with box-drawing characters",
+        "show auto-fix cycle status in exe-os boot",
+        "graceful daemon restart — persist MCP sessions for transparent recovery",
+        "default to keyword+graph search, embeddings opt-in",
+        "server-side telemetry storage + admin insights endpoint",
+        "enrich telemetry payload with usage counters and auto-insights",
+        "add telemetry auto-insight computation engine",
+        "auto-calibration in dreaming cycle + telemetry integration",
+        "first-class time estimation on tasks — auto-tracked, queryable",
+        "add agent assertion system — confidence tracking on task lifecycle",
+        "auto-run dreaming cycle on session end — zero-touch self-improvement",
+        "add dreaming system + structured handoffs to platform procedures",
+        "add snapshot + boot to platform procedures and operating procedures",
+        "add `exe-os boot --project X` CLI command for project boot verification"
+      ],
+      "fixes": [
+        "embeddings OFF by default for all users — opt-in via EXE_EMBEDDINGS=1",
+        "keep generated env templates in sync",
+        "bootstrap monitor env and lazy-init recall memory",
+        "registry proxy accepts license keys + stack-update reads .env license",
+        "stack-release uses defaultBranch per repo (wiki uses master)",
+        "prevent stale task intercom prompts",
+        "v0.9.241 — 13 more bug fixes (28 total this session)",
+        "sync lockfile for Docker build — npm ci --omit=dev works again",
+        "keep review notifications session-local and test-safe",
+        "CI Dockerfile reference — Dockerfile.exed → Dockerfile.exe-os",
+        "v0.9.240 — 15 bug fixes across HYGO, Jack, platform (stack v0.9.15)",
+        "keep daemon memory recall FTS bounded",
+        "keep daemon cloud sync off CRDT heap path",
+        "suppress ENOBUFS in reapers + skip boot-time sync execution",
+        "MCP health probe in prompt hook + Docker image build tolerance",
+        "plug MCP session memory leak — zombie McpServer instances accumulated",
+        "lower RSS watchdog to 1.5/2.5GB + add GC after heavy operations",
+        "snapshot crash — daemon fallback + dreaming scope binding",
+        "skip duplicate initStore in WS client — prevents 2-8s event loop block",
+        "add session scope imports to dreaming, project-boot, telemetry-upload",
+        "resolve typecheck errors for npm publish",
+        "add setImmediate yields to Graph→PG sync — prevent event loop blocking",
+        "convert SQLite short hex IDs to valid UUIDs for PostgreSQL projection",
+        "delay initial graph sync tick to 60s + add debug logging",
+        "share DB init state between MCP HTTP and timer ticks"
+      ],
+      "security": [
+        "fix shell injection, SSRF, socket leaks, backup validation",
+        "bump v0.9.139 — 2 CRITICAL security fixes, 14 bug fixes, 6 features, customer config preservation",
+        "fix 2 CRITICAL + 1 HIGH from post-fix audit",
+        "validate X-Agent-Role against roster — prevent privilege escalation",
+        "release: stack v0.9.8 — security hardening + Hygo bug fixes",
+        "add webhook HMAC-SHA256 validation + disable query param auth in prod",
+        "pin GitHub Actions to SHAs, update jose to 6.2.3",
+        "harden support intake against abuse and data leakage",
+        "bump to v0.9.22 — Codex MCP parity + customer bug fixes + security audit remediation",
+        "audit: pre-hygo exe-gateway security report",
+        "add SECURITY.md — trust document for pre-install security evaluation",
+        "fix 4 pricing tier bypass vulnerabilities (audit F1-F4)"
+      ],
+      "other": [
+        "bump v0.9.245",
+        "sync v0.9.244 published artifacts",
+        "bump v0.9.244",
+        "cover registry proxy license auth fallbacks",
+        "update release notes for v0.9.243",
+        "stack release v0.9.16",
+        "bump v0.9.243 for stack release",
+        "bump v0.9.242 for stack release",
+        "add STACK-RELEASE.md — full release process documentation",
+        "claurst competitive analysis — npm distribution + free-tier mode",
+        "bump stack.release.json to v0.9.240 for CI image build",
+        "update release notes for v0.9.238-239",
+        "release: stack v0.9.14 — gateway audit fixes",
+        "release: stack v0.9.13 — HYGO deployment readiness",
+        "incremental Graph→PG sync — 86K rows → deltas only",
+        "batch Graph→PG sync — 500 rows per INSERT instead of row-by-row",
+        "consolidate daemon timers into unified orchestration tick (#78)",
+        "revise GLiNER — Haiku API now, GLiNER when cost matters",
+        "capture GLiNER entity extraction in ARCHITECTURE.md",
+        "detailed design system structure + Phase 2 component list",
+        "exe-os-design-system — unified design system for all products",
+        "GoTrue JWT unified auth architecture — founder directive 2026-06-08",
+        "Thread + Graph Discovery architecture — unified knowledge view",
+        "move heavy jobs to 9 PM — GraphRAG, skill sweep, backup",
+        "Mode 3 Client-Side RAG architecture — memories never leave device"
+      ],
+      "migration_notes": []
+    },
     "0.9.244": {
       "version": "0.9.244",
       "date": "2026-06-09",
@@ -300,38 +500,6 @@
         "bump to v0.9.220"
       ],
       "migration_notes": []
-    },
-    "0.9.237": {
-      "version": "0.9.237",
-      "date": "2026-06-08",
-      "features": [
-        "graceful daemon restart — persist MCP sessions for transparent recovery"
-      ],
-      "fixes": [
-        "19 P1/P2 fixes — full audit remediation for July 1 launch",
-        "9 P1/P2 fixes — daemon stability, MCP reliability, data safety"
-      ],
-      "security": [],
-      "other": [
-        "bump to v0.9.237"
-      ],
-      "migration_notes": []
-    },
-    "0.9.234": {
-      "version": "0.9.234",
-      "date": "2026-06-08",
-      "features": [],
-      "fixes": [
-        "daemon memory leak — 3 fixes prevent 3.5GB growth over 20 hours",
-        "P0 WAL checkpoint before backup — prevents SQLITE_CORRUPT on large DBs",
-        "6 launch blockers for July 1 public launch",
-        "remove duplicate sessionScope filter — corrupted SQL parameter binding"
-      ],
-      "security": [],
-      "other": [
-        "bump to v0.9.230 — P0 WAL backup corruption fix for Jack"
-      ],
-      "migration_notes": []
     }
   }
 }