@awebai/oats 0.29.4 → 0.30.1

package/docs/release-notes/v0.25.3.md

@@ -1,19 +1,17 @@
 # OATS v0.25.3 — `OATS_SOUL_ID`
 
-Kernel/Pi **0.25.3**. Tag `v0.25.3` → the commit carrying these notes. No API change;
-`features[]` unchanged; one additive hook environment variable and one additive
-`instance.json` field.
+Kernel/Pi **0.25.3**. No API change; `features[]` unchanged.
 
 ## Kernel
 
-- **`OATS_SOUL_ID`** — a soul's stable identity for capability hooks (`spawn`,
-  `retire`, `launch`): `<repo key>#<soul name>` for a workspace soul, the realpath of
-  `agents/<name>/soul` for a classic soul. Recorded as `instance.json.workspace.soul.id`.
-  Fixes the consequence of 0.25.1's per-commit soul cache found by the first outsider
-  rebuild: OKF 2.1.3 pins a soul's owner to `realpath(home/soul)`, which now changes with
-  every member commit → the next spawn of the same soul was refused `E_OWNER`. The provider
-  half (owners keyed by `OATS_SOUL_ID`, one-time migration of path pins) ships in OKF 2.1.4.
-- **`OATS_SOUL` is the content the home links** — for a workspace soul the per-commit
-  directory, never the swappable `agents/<name>/soul` pointer (spawn and retire hooks agree).
+- **`OATS_SOUL_ID`**: a soul's stable identity for capability hooks (`spawn`,
+  `retire`, `launch`): `<repo key>#<soul name>` for a workspace soul, the
+  realpath of `agents/<name>/soul` for a classic soul. Recorded as
+  `instance.json.workspace.soul.id`. OKF 2.1.3 pinned a soul's owner to
+  `realpath(home/soul)`, which 0.25.1's per-commit soul cache changes with
+  every member commit, so the next spawn was refused `E_OWNER`; OKF 2.1.4 keys
+  owners by `OATS_SOUL_ID`.
+- **`OATS_SOUL` is the content the home links**: for a workspace soul, the
+  per-commit directory, never the swappable `agents/<name>/soul` pointer.
 
-Contract: `docs/design/2026-09-23-workspace-module-contracts.md` § "0.25.3 — OATS_SOUL_ID".
+Contract: [workspace module contracts](../design/2026-09-23-workspace-module-contracts.md) §5.2.

package/docs/release-notes/v0.25.4.md

@@ -1,21 +1,17 @@
 # OATS 0.25.4
 
-Patch release: one kernel fix found by an operator rehearsal on 0.25.3.
+Patch release: one kernel fix.
 
 ## Fixed
 
 - **Quarantine retry never re-ran the owed retire hook on a workspace-mode
-  home.** When a required spawn hook fails and its compensation is incomplete,
-  the kernel retains the home with a cleanup descriptor
-  (`.oats-rollback-incomplete.json`). Module materialization had already
-  written a pre-hook `instance.json` stub (`{ modules, providers,
-  resolutionRevision }`), and `oats retire` trusted that stub over the
-  descriptor — so `meta.repo` was undefined, the retry reported *"retire hook
-  <cap>: did not run on this retry"* and *"cleanup descriptor lost its context
-  repo"* on every attempt, and only `--force` could remove the home (leaving
-  the provider's external state to be cleaned by hand). The retry now reads
-  the cleanup descriptor whenever the live record is not a complete spawn
-  record; the owed hook runs, the home stays while it fails, and is removed
-  once it succeeds. Regression test in `test/spawn-workspace.test.mjs`.
+  home.** When a required spawn hook fails and its compensation is
+  incomplete, the kernel keeps the home with a cleanup descriptor
+  (`.oats-rollback-incomplete.json`). `oats retire` trusted the pre-hook
+  `instance.json` stub over that descriptor, so every retry reported that the
+  retire hook did not run, and only `--force` could remove the home (leaving
+  the provider's external state to clean by hand). The retry now reads the
+  descriptor whenever the live record is not a complete spawn record: the owed
+  hook runs, and the home is removed once it succeeds.
 
 No contract changes. `oats version --json` is unchanged apart from the version.

package/docs/release-notes/v0.25.5.md

@@ -22,8 +22,7 @@ the version.
 
 ## Catalog
 
-- **oats.okf → v2.1.4** (mirror in `capabilities/oats-okf` synced, published
-  tag `2af47ad3`): sparse staging to `base.root` from a single-branch partial
+- **oats.okf → v2.1.4** (mirror in `capabilities/oats-okf` synced): sparse staging to `base.root` from a single-branch partial
   clone with streamed object reads (large repositories and large files outside
   the knowledge base no longer matter), `git-timeout` binding key (600 s for
   remote operations), migration record hygiene + `oats okf migrate --forget`,
@@ -36,7 +35,6 @@ the version.
   identity), host-only `residents` map, and the messaging-layer meta key
   `identity` on every spawn. Known limitation: sending mail/chat through a
   grant is rejected by the aweb server as of aw 1.36.1 (client bug; receive,
-  wake and whoami work). Guide truths in `docs/workspaces.md` and
-  `docs/rebuild-to-v2.md` updated from "1.11.2 ignores `team`" to what 1.12.0
-  does.
+  wake and whoami work). [workspaces.md](../workspaces.md) and the [rebuild guide](https://github.com/awebai/oats/blob/bdd7e55e1b798a97b8b5486001d7c17e522792a7/docs/rebuild-to-v2.md) describe what
+  1.12.0 does with `team`.
 

package/docs/release-notes/v0.25.6.md

@@ -1,37 +1,28 @@
 # OATS 0.25.6
 
-Decision 27 — per-spawn identity choice (local | global) — lands its kernel half.
-No new CLI flags; three provider-neutral additions and one manifest attribute.
+The kernel half of the per-spawn identity choice (local | global). No new CLI
+flags; three provider-neutral additions and one manifest attribute.
 
 ## Added
 
-- **`decision.effective.providers`** — the spawn decision now binds the merged
-  per-module payloads the providers will receive (exactly the preview's
+- **`decision.effective.providers`**: the spawn decision binds the merged
+  per-module payloads the providers will receive (the preview's
   `settings.<cap>`), so a confirmed apply covers every provider fact by value.
-- **`hostOnly` settings keys** — a capability manifest may mark a settings key
-  `hostOnly: true`; the resolver accepts it only from the deployment's
-  `oats-local.yaml settings.<cap>` and refuses it in the workspace file, `byTeam`
-  payloads, a soul's slot payload and `--provider` flags (`E_WORKSPACE_SCHEMA`,
-  reason `host-only-key`). Closes the documented hole where a committed file
-  could point a messaging provider at a custody root.
-- **Served identity on the roster** — `oats status --json instances[].identity`,
-  the text roster's `identity:` line and `oats inspect --home … selected.identity`
-  carry the principal an instance acts as, copied from its messaging provider's
-  hook meta (`{ mode, alias, team, address, resident, grant?, provider }`).
-- `oats version --json` `features[]` gains `served-identity`.
+- **`hostOnly` settings keys**: a manifest may mark a settings key `hostOnly:
+  true`, accepted only from the deployment's `oats-local.yaml`
+  `settings.<cap>` and refused elsewhere (`E_WORKSPACE_SCHEMA`, reason
+  `host-only-key`), so a committed file cannot point a messaging provider at a
+  custody root.
+- **Served identity on the roster**: `oats status --json`
+  `instances[].identity`, the roster's `identity:` line and `oats inspect
+  --home … selected.identity` carry the principal an instance acts as, from its
+  messaging provider's hook meta. Feature `served-identity`. Any messaging
+  provider that emits `identity` in its spawn or launch meta appears there.
 
-## Desktop (10B-0)
+## Desktop
 
-- **Terminal owner leases** (PR #117) — the Desktop's terminal wire is now
-  `terminalApi: 2`: every terminal is a lease (256-bit token) held by the
-  admitted renderer *document*; a navigation, reload or renderer crash revokes
-  the document and cleans its viewers; the 20-terminal cap is reserved
-  synchronously so parallel opens cannot overshoot; writes are bounded and
-  one-way. Maintainer's native gate (real Electron, tmux, PTY) passed 23/23:
-  open/ready/write/close, quota, reload revocation, source isolation, no
-  residue after quit. See `packages/desktop/docs/terminal-owner-leases.md`.
-
-## For providers
-
-oats.aweb 1.13.0 (next) can declare `residents` `hostOnly`. Any messaging provider
-that emits `identity` in its spawn/launch meta appears on the roster.
+- **Terminal owner leases** (#117, `terminalApi: 2`): every terminal is a
+  lease held by the admitted renderer document; a navigation, reload or
+  renderer crash revokes it and cleans its viewers; the 20-terminal cap cannot
+  be overshot by parallel opens; writes are bounded and one-way. See
+  [terminal owner leases](../../packages/desktop/docs/terminal-owner-leases.md).

package/docs/release-notes/v0.25.7.md

@@ -2,10 +2,8 @@
 
 ## Fixed
 
-- **A v2 deployment is a configuration boundary.** The ancestor walk that
-  composes legacy `oats-config.yaml` levels now stops at the directory holding
-  `oats-local.yaml`. A deployment created inside another scope (a scratch
-  deployment under an operator's workspace, a fixture under a repository) no
-  longer inherits the outer scope's files, and `oats inspect` no longer names
-  the outer checkout as its `scope.workspace` or lists the outer files in
-  `scope.chain`. Found by the Desktop engineer's Phase F study.
+- **A v2 deployment is a configuration boundary.** The ancestor walk over
+  legacy `oats-config.yaml` levels stops at the directory holding
+  `oats-local.yaml`, so a deployment inside another scope no longer inherits
+  the outer scope's files, and `oats inspect` no longer reports the outer
+  checkout as its `scope.workspace` or lists its files in `scope.chain`.

package/docs/release-notes/v0.25.8.md

@@ -2,47 +2,34 @@
 
 ## Fixed
 
-- **Desktop: quotes are escaped in attribute contexts** (#139). The views share
-  one escaper (`escapeHtml`) for element content and attribute values.
-
+- **Desktop: quotes are escaped in attribute contexts** (#139).
 - **The roster reports an instance where it actually is.** `oats status`
   reports each instance at the directory the kernel enumerated
-  (`<soul dir>/instances/<name>`), under that directory's name. An
-  `instance.json` whose `home` or `instance` disagrees no longer relocates or
-  renames the instance; the disagreeing values appear only as the diagnostics
-  `recordedHome` / `recordedInstance`. Before this, a hostile or corrupted
-  `instance.json` could make every consumer that acts on `home` (retire,
-  `inspect --home`, the Desktop's file roots) target a path outside the
-  deployment. Found by the Desktop engineer in Phase F slice F1.
+  (`<soul dir>/instances/<name>`), under that name. An `instance.json` whose
+  `home` or `instance` disagrees no longer relocates or renames it; the values
+  appear only as `recordedHome` / `recordedInstance`. A hostile or corrupted
+  `instance.json` could otherwise make retire, `inspect --home` or the Desktop
+  target a path outside the deployment.
 
 ## Added
 
-- **Team facts for workspace-model hooks** (human decisions 2026-09-24:
-  `oats.aweb` is the messaging default; teams are seamless). A workspace
-  deployment has no classic `team:` block, so lifecycle hooks of a workspace
-  spawn now receive: `OATS_TEAM_SCOPE` = the deployment directory;
-  `OATS_TEAM_ID` = the messaging slot's merged payload `team` (workspace base ⊕
-  `byTeam[<soul team>]` ⊕ soul ⊕ host ⊕ spawn), **empty when no shared team is
-  mapped — meaning "personal"**; and new `OATS_TEAM_LABEL` (the soul's team
-  label), `OATS_WORKSPACE_NAME` and `OATS_WORKSPACE_KEY` (canonical repository
-  key), so a messaging provider can derive a personal team per person per
-  workspace deterministically. Classic deployments are unchanged.
-- **Desktop F2: Capabilities, Sources, sync and approval, onboarding** (#143).
-  The Workspace view gains a Capabilities table (Capability | Status | Used
-  by, from `oats capabilities --json`, filtered by team and source) and a
-  Sources tab. It can run `oats sync` and approve pending packages: the Desktop
-  admits an approval only when its (id, version, executables digest) exactly
-  match the latest sync report it holds, and refuses a mismatch with
-  `E_APPROVAL_STALE`. A picked folder that isn't yet a workspace can be
-  onboarded through single-use offers held by the main process. The 0.24
-  Deployment inventory and Workspace readiness blocks are removed.
-- **Desktop: design parity with Redesign v3 and brand artwork** (#137, #128).
-  The Desktop F1 deployment model on kernel JSON (#126) is included too.
-- **`oats.aweb` is the workspace messaging default** (#140, human decision).
-  The onboarding skill makes messaging setup its own step before the first
-  spawn (#141).
-- **The onboarding next-step hint names `oats-operator-expert`** (#134).
-- **Phase D:**
-  - The OATS repository hosts a workspace-model workspace (D2, #127).
-  - `oats-operator-expert` and `integrations-expert` souls, with the experts' instructions on the workspace model (D3, #129).
-  - `oats.core` and `oats.setup` rewritten for the workspace model (D4, #133).
+- **Team facts for workspace-model hooks.** Lifecycle hooks of a workspace
+  spawn receive `OATS_TEAM_SCOPE` (the deployment directory), `OATS_TEAM_ID`
+  (the messaging slot's merged payload `team`, empty when no shared team is
+  mapped, meaning "personal"), and new `OATS_TEAM_LABEL`,
+  `OATS_WORKSPACE_NAME` and `OATS_WORKSPACE_KEY`. Classic deployments are
+  unchanged.
+- **Desktop: Capabilities, Sources, sync and approval, onboarding** (#143).
+  The Workspace view gains a Capabilities table and a Sources tab, runs `oats
+  sync` and approves pending packages only when (id, version, executables
+  digest) match the latest sync report (`E_APPROVAL_STALE` otherwise), and
+  onboards a picked folder. The 0.24 Deployment inventory and Workspace
+  readiness blocks are removed.
+- **Desktop: design parity with Redesign v3, brand artwork, and the
+  deployment model on kernel JSON** (#137, #128, #126).
+- **`oats.aweb` is the workspace messaging default** (#140); the onboarding
+  skill makes messaging setup its own step before the first spawn (#141), and
+  its next-step hint names `oats-operator-expert` (#134).
+- **The OATS repository hosts a workspace-model workspace** (#127), with the
+  `oats-operator-expert` and `integrations-expert` souls (#129), and `oats.core`
+  and `oats.setup` rewritten for the workspace model (#133).