@askexenow/exe-os 0.9.365 → 0.9.368

package/release-notes.json

@@ -1,47 +1,106 @@
 {
-  "current": "0.9.365",
+  "current": "0.9.368",
   "notes": {
+    "0.9.368": {
+      "version": "0.9.368",
+      "date": "2026-08-13",
+      "features": [],
+      "fixes": [],
+      "security": [],
+      "other": [
+        "v0.9.368 (#716)"
+      ],
+      "migration_notes": []
+    },
+    "0.9.367": {
+      "version": "0.9.367",
+      "date": "2026-08-13",
+      "features": [
+        "account termination is now irreversible by the terminated user — tombstone record, lock-before-write ordering, and legal-hold support, closing a path where a suspended account could restore itself (#688)",
+        "SSO cookie contract is verified at deploy time and monitored live, so a login that silently stops working is caught by the system instead of by a user (#696)",
+        "GoTrue's admin API is no longer served on the public internet from the auth page (#689)",
+        "atomic work claims enforced at every dispatch path — two agents can no longer pick up the same task (#656)",
+        "exe-os MCP tools are registered correctly in the agent runtime, plus stall detection so a wedged agent loop is surfaced instead of hanging silently (#693)",
+        "stack updates can roll back an unset pin, and a stale deploy now raises an alert rather than sitting unnoticed (#692)",
+        "automated task completion passes through a verification gate — work cannot be marked done without an artifact backing the claim (#694, #690)",
+        "wiki documents support seal/unseal, with matching cloud-docs endpoints (#687)",
+        "auth page: confirmation state, gated token tab, refreshed UX, and opt-in cross-app SSO cookies (#684)",
+        "email preflight now fails on incomplete SMTP credentials and warns on a bad sender or port, instead of appearing configured (#685)"
+      ],
+      "fixes": [
+        "restored 52 test files — including 33 gateway security suites — that had been running in no CI job since April (#662)",
+        "CI fails loudly when a required check cannot evaluate on a PR, instead of reporting a vacuous green (#673)",
+        "the x64 native lane builds again before running DB worker tests, which had been testing a missing artifact (#698)",
+        "release path is deadlock-proofed: the publish gate reads required-context status off the release lane, plus a drift monitor that catches npm falling behind main (#675)"
+      ],
+      "security": [],
+      "other": [],
+      "migration_notes": []
+    },
+    "0.9.366": {
+      "version": "0.9.366",
+      "date": "2026-08-13",
+      "features": [
+        "atomic work claims — two sessions can no longer take the same job, enforced at every dispatch path",
+        "Codex session consolidation + hook trust: Codex hooks were never actually running, so fresh installs captured nothing",
+        "auth page: confirmation state, gated token tab, and opt-in cross-app SSO",
+        "wiki docs: seal/unseal capability with cloud-docs worker endpoints"
+      ],
+      "fixes": [
+        "SECURITY: GoTrue's admin API is no longer published on the public internet",
+        "SECURITY: account termination was reversible by the terminated user — now tombstoned and lock-fenced",
+        "SSO cookie contract is gated at deploy and monitored live",
+        "task + tracker close gates now require a verification artifact, so automated completion cannot close work that was never verified",
+        "runtime: exe-os MCP tools are registered and the agent loop detects stalls",
+        "stack-update: unset-pin rollback and a stale-deploy alert",
+        "preflight: SMTP recovery fails on incomplete credentials instead of silently continuing",
+        "hook tests: empty stdout is now a clear diagnostic rather than an opaque JSON parse error, and hook fixtures are isolated from the live daemon"
+      ],
+      "infrastructure": [
+        "restored 52 test files that ran in NO CI job at all — including 33 gateway security suites covering permission-guard, api-router enforcement, read-only SQL and rate limiting, dark since 2026-04-20 and green in 17 seconds",
+        "a guard that fails loudly when a required check cannot evaluate on a pull request, so a required context can never again be satisfied by never running",
+        "native-addon smoke gate: node-llama-cpp's addon had zero coverage, meaning production was the first place it ever executed",
+        "the CI sweeper's four correctness fixes finally reached main — an absent required check no longer reads as green",
+        "stopped paying for lint and typecheck twice per PR; sweeps every 5 minutes",
+        "SHA-pinned the last mutable action ref"
+      ],
+      "security": [],
+      "other": [],
+      "migration_notes": []
+    },
     "0.9.365": {
       "version": "0.9.365",
       "date": "2026-08-13",
       "features": [
-        "mount cross-app service switcher in dashboard + team pages (#683)",
-        "phase 5 — org-aware usage/credits/keys/billing + persisted alert threshold (e51ca54c) (#677)",
-        "phase 6a — invite email via Resend + redeemability corrections (e51ca54c) (#678)",
-        "phase 4 — atomic spend-cap admission + freeze kill-switch (api-router lane) (#672)",
-        "phase 2 — self-serve org scoping (GET /v1/orgs, is_staff, panel mode 'self') (#653)",
-        "phase 3 — spend-limits model, authoring + ceiling guard, claim projection (e51ca54c) (#663)",
-        "detect the unsupervised-daemon state (ad8886b8) (#623)",
-        "phase 0 — planning-doc truth, permsSubject() identity join, live self-edit warning (#649)"
+        "org permissions: self-serve org scoping, spend-limits with an atomic admission cap and freeze kill-switch, role revoke path, and invite emails that are actually redeemable",
+        "dashboard: org-aware usage, credits, keys and billing with persisted alert thresholds, plus the cross-app service switcher",
+        "daemon: detects the unsupervised-daemon state instead of failing silently"
       ],
       "fixes": [
-        "deadlock-proof the release path — drift monitor + required-context gate off the release lane (#675)",
-        "write stack state files 0644 so the drift watchdog can read them (exe-monitor#27) (#680)",
-        "teach the named-subagent default at every layer, not just the ladder (#614)",
-        "honest backup verification — index is healthy, the alarm was not (e0b92e67) (#632)",
-        "attribute every kill + verify PID identity before signalling (7a915790, 9fc28233, 42aa8c56) (#636)",
-        "digest-pin every shipped image, make strict-digest the DEFAULT (#679)",
-        "move extended-tests out of CI workflow so a non-required job stops gating releases (debdb921) (#655)",
-        "match agent healthcheck to the PINNED image generation (bug 9ce2a68b coupling) (#676)",
-        "live manifest first, packaged only as offline fallback (bug c00e1544) (#674)",
-        "resolve the exe-db container dynamically in wire-update-service.sh (bug 7ff62674) (#666)",
-        "project attribution must survive git worktrees (e19ce3a3) (#661)",
-        "--services is run-scoped, managed-set writes additive-only (bug db262248) (#660)",
-        "fail-closed manifest signatures + built-in verification key (bug c00e1544) (#664)",
-        "make managed-permissions mode explicit in the shipped stack (e51ca54c) (#668)",
-        "role 'none' clears the roster admin bit + a real revoke path in the panel (Phase 1, e51ca54c) (#650)",
-        "enforce prepaid credit balance with a 402 gate (5a862f9c) (#642)",
-        "add missing /openai segment to Gemini base URL (#648)",
-        "stop committing empty secrets in wrangler [vars] (b6f1cbf9) (#647)",
-        "make isolation real and non-optional (2b7072a7) (#621)"
+        "api-router: prepaid credit balance is now enforced with a 402 gate — a zero or negative balance could previously consume AI indefinitely (P0 5a862f9c)",
+        "daemon: every kill is attributed and the PID identity verified before signalling (7a915790)",
+        "memory: project attribution survives git worktrees (e19ce3a3)",
+        "stack: every shipped image is digest-pinned and strict-digest is now the DEFAULT",
+        "stack-update: fail-closed manifest signatures with a built-in verification key; live manifest first with the packaged copy only as an offline fallback (c00e1544)",
+        "stack-update: --services is run-scoped and managed-set writes are additive-only (db262248)",
+        "stack-update: state files written 0644 so the drift watchdog can read them",
+        "db-integrity: honest backup verification — the index was healthy and the alarm was not (e0b92e67)",
+        "worker: stop committing empty secrets in wrangler [vars] (b6f1cbf9)",
+        "api-router: add the missing /openai segment to the Gemini base URL",
+        "monitor: agent healthcheck matches the pinned image generation (9ce2a68b)",
+        "deploy: resolve the exe-db container dynamically; managed-permissions mode is explicit in the shipped stack",
+        "dispatch: the named-subagent default is taught at every layer, not just the ladder",
+        "tests: hermetic isolation is real and non-optional (2b7072a7)"
       ],
-      "security": [],
-      "other": [
-        "v0.9.365 (#686)",
-        "build + push the exe-dashboard image on main (was hand-shipped) (#654)",
-        "right-size the x64 Linux release gate to native-module verification (e8f2cccd) (#651)",
-        "release(stack): 0.9.35 — pin exe-auth v0.5.0 (EXE INTELLIGENCE front door) (#645)"
+      "infrastructure": [
+        "release path is deadlock-proof: the publish gate now asserts the branch-protection REQUIRED CONTEXTS on the release SHA instead of waiting for a whole workflow run to conclude, and it runs on a local runner so it can never hold the lane it is waiting for. A non-required job can no longer gate a release",
+        "release-drift monitor: every 30 minutes the published npm dist-tag is compared against main's package.json and alerts on divergence — v0.9.363 was believed shipped while npm served 0.9.362 for five days",
+        "x64 Linux release gate right-sized to native-module verification (e8f2cccd) — the full 8,400-test matrix no longer runs on the shared VPS",
+        "extended-tests moved out of the CI workflow so a non-required nightly job stops gating releases",
+        "dashboard image is built and pushed on main instead of being hand-shipped"
       ],
+      "security": [],
+      "other": [],
       "migration_notes": []
     },
     "0.9.364": {
@@ -72,53 +131,6 @@
       "security": [],
       "other": [],
       "migration_notes": []
-    },
-    "0.9.363": {
-      "version": "0.9.363",
-      "date": "2026-08-12",
-      "features": [
-        "runtime smoke gate: a post-deploy check that verifies the deployed system actually works — cloud sync reaches 'complete' with an advancing cursor and DB backup passes integrity — so a merged-but-never-deployed fix can no longer masquerade as done (#600)",
-        "account identity + lifecycle: one authoritative identity bound to the verified GoTrue subject (not a client-asserted device id) plus enforceable account suspension at the network boundary; additive migration with a gotrue_sub partial-unique index and legacy backfill (#597)",
-        "named-subagent identity + employee memory brief at spawn: dispatch work to a subagent wearing an employee's identity with spawn-ledger-gated memory attribution, and inject the employee's scoped memory brief on first tool use; the PreToolUse matcher now upgrades on existing installs so Task/Agent dispatch is actually captured (#596, #601)",
-        "stack: machine-enforce two invariants — exactly one GoTrue per host and a canonical SSO cookie contract (#598)"
-      ],
-      "fixes": [
-        "cloud sync had a 0% success rate: background sync destroyed the daemon socket under backpressure ('Sync failed: Connection closed'), so no sync ever completed. The socket is now preserved and sync completes end-to-end (verified live: 'Cloud sync: complete', 5,430 pushed) (#593)",
-        "local-store durability: DB backup can no longer lose data — a failed integrity check quarantines the file instead of deleting it, FTS corruption rethrows instead of silently returning an empty store, and the integrity verdict is a trustworthy tri-state; the online-backup integrity route is pinned to the write path (#590, #594)",
-        "daemon: background sweeps moved off the event loop so a long sweep can no longer block MCP handling (#591)",
-        "support: recording a fixed version must no longer auto-close a still-open bug (#599)"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
-    },
-    "0.9.362": {
-      "version": "0.9.362",
-      "date": "2026-08-08",
-      "features": [
-        "p0 timers: daemon timers moved off the event loop — long-running timer callbacks no longer block the daemon event loop, and a worker-race in timer scheduling is closed so overlapping ticks cannot starve MCP handling (Codex gpt-5.5 build, triage 2026-08-06) (#562, re-review findings closed in #571)",
-        "p0 durability: last-mile durability for the local store — encrypted backups now actually run, the write path preserves the WAL and does not drop the ledger, and duplicate writes are de-duplicated (Codex gpt-5.5 build) (#560, 5 Codex NO-GO findings closed in #570)",
-        "p0 postinstall: postinstall now fails loud on genuine failures — the real exit code is propagated instead of being swallowed, so a broken install surfaces immediately instead of silently degrading (rebuild of #561, Codex findings fixed) (#574)"
-      ],
-      "fixes": [
-        "p0 provenance: app-image provenance repo map hardened against spoofing — the imageName→ghRepo mapping is enforced so a cross-named app image cannot masquerade under another repo's provenance (#572)"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
-    },
-    "0.9.359": {
-      "version": "0.9.359",
-      "date": "2026-07-30",
-      "features": [],
-      "fixes": [
-        "org-mode: the org-mode-anchor keychain probe no longer risks raising the DESTRUCTIVE macOS 'A keychain cannot be found to store org-mode-anchor' dialog (whose 'Reset To Defaults' button can wipe the login keychain). nativeKeychainAllowed() now skips the native keychain — a best-effort mirror of the authoritative home-anchored file, so nothing is lost — in the daemon (EXE_IS_DAEMON), SSH/remote sessions, and on macOS with no default keychain (probed via a read-only `security default-keychain` that never invokes SecurityAgent). A healthy interactive GUI login is unaffected. Strictly-safer 1-file guard tightening (#514)",
-        "privacy: stop unconsented telemetry + support-content egress (bug 4b8b47fd, P0) (#510)",
-        "internal (dormant — no user-facing change until the org feature is wired): AI-Partner phase-1 infrastructure — B1 org-mode privacy/crypto boundary via a boot-resolved SyncCipher (existing single-user installs keep byte-identical v=1 cloud-sync encryption; the org path stays dormant until an org-membership anchor exists) + partner signing identity + sealed mailbox envelope (#504), and B2 sealed-mailbox relay/transport with cross-tenant SQL-predicate scoping (#505)"
-      ],
-      "security": [],
-      "other": [],
-      "migration_notes": []
     }
   }
 }