@geminixiang/mikan 1.0.0-beta.8 → 1.0.0-beta.80

package/CHANGELOG.md

@@ -9,6 +9,1155 @@ any release.
 
 ## [Unreleased]
 
+## [1.0.0-beta.80]
+
+### Fixed
+
+- Post no Slack usage summary for a `[SILENT]` response: the reply and its thread were deleted, so the summary for a quiet recurring event landed at the top level of the channel on every run.
+- Stop warning `Could not remove snapshot image mikan-migrate:...` for every migrated container on each startup; the startup sweep now leaves a snapshot alone while its container still runs from it, and still reclaims snapshots no container uses.
+
+## [1.0.0-beta.79]
+
+### Changed
+
+- Load the Discord adapter and `discord.js` only when Discord is active, saving about 38 MB of memory and 90 ms of startup in processes that do not run Discord.
+- Use pi's `typebox` 1.3.27 for tool and settings schemas instead of the incompatible `@sinclair/typebox` 0.34; platform tool packs now share pi's `AgentTool` schema types. Schema validation errors retain field paths but use typebox 1's wording.
+- **Breaking (SDK):** `new ChatHistorySync()` now requires `{ isCommandText }`, so sessions no longer import the command inventory from the adapters. Pass the newly exported `isCommandText` to keep filtering command messages out of synced history.
+
+### Security
+
+- Only send the Slack bot token to `https://*.slack.com` file URLs, and stream incoming attachments to disk with a 100 MiB limit instead of buffering whole files in memory; a download over the limit is rejected, not retried, and leaves no partial file.
+
+### Fixed
+
+- Reject missing sandbox helper executables as ordinary `ENOENT` errors instead of emitting an unhandled child-process error.
+- Accept `thinking: max` in subagent profiles; they kept their own level list without `max`, while settings and `/pi-model` accepted it.
+- Spill oversized MCP JSON results as indented JSON so `read` and `grep` can inspect them; the compact single-line spill exceeded `read`'s per-line limit.
+- Record a Discord channel without a name (such as a DM) under its channel id instead of a `null` name.
+
+### Tests
+
+- Type-check tests, E2E code, and the embedder example in pre-commit and CI, and remove every `any` and double assertion from tests.
+- Run tests in random order and print the seed, so order-dependent tests fail visibly and can be reproduced.
+
+## [1.0.0-beta.78]
+
+### Added
+
+- Capture durable knowledge after each settled human run: Jev gates the exchange, and the conversation's model adds or updates stamped lines under `## Captured knowledge` in the conversation `MEMORY.md`; configured secrets are redacted from captured entries (ADR 0011).
+- Give each new managed image container a per-office home volume (`mikan-home-<key>`) at `/root`. A stopped container whose image or mounts are stale is recreated from the current image with the same volume, so `/root` survives image upgrades; running containers are never interrupted (ADR 0009).
+- Add `mikan sandbox status|diff|migrate` to inspect managed containers and move legacy containers onto a home volume with the daemon stopped.
+
+### Changed
+
+- Bound MCP tool results like `bash`: JSON is re-serialized compactly, oversized results become a structural digest (keys, counts, and pagination kept) within Pi's 50KB/2000-line limit, and the full result is spilled to `.mikan/mcp-output/` in the runtime workspace. `structuredContent` is used when `content` is empty, binary resources are no longer inlined, error text is bounded, and MCP results pass through secret redaction.
+- Shared top-level channel sessions no longer rotate every two weeks; they stay current until `/new`, and Pi's automatic compaction bounds the model context (ADR 0010).
+- The sandbox image installs its runtime outside `/root` and is published only with mikan releases.
+- Document the Vault as the store for development credentials that sandbox programs read directly; OpenConnector is the path for third-party service access (ADR 0013).
+
+### Removed
+
+- Remove scheduled Dream memory maintenance. Conversation `MEMORY.md` is written only by the agent and by post-run memory capture; existing `dream.json` checkpoints are no longer read (ADR 0012).
+
+## [1.0.0-beta.77]
+
+### Added
+
+- Provision the standard sandbox image with Node.js 24, Chromium, ffmpeg, pinned `agent-browser` 0.38.1, and a checksummed Google Workspace CLI so `jev_browser` and capture workflows work without runtime installation and current-page recording preserves hydrated browser state.
+
+### Changed
+
+- Run every `jev_browser` command through the conversation-authorized sandbox executor, preserve native snapshots, refs, frames, tabs, screenshots, HAR, and recording, serialize calls per runner, and make named-session continuity and close-only operations explicit.
+- Bound autonomous browser failures and repeated action cycles, refresh current page evidence before reporting completion, and refuse to silently resurrect an explicitly closed named session as `about:blank`.
+- Delegate persisted session behavior to public Pi session and harness APIs instead of maintaining duplicate storage semantics.
+
+### Fixed
+
+- Log LLM cancellation reasons and Pi run ids only while provider transport is active, avoiding false abort logs during authentication, payload hooks, retry waits, tool execution, or after structural requests finish.
+
+### Security
+
+- Harden state and credential ownership by preserving explicit vault mount targets outside secret directories, rejecting migration collisions, keeping private file writes atomic, and deriving session operations from authorized conversation identities.
+
+## [1.0.0-beta.76]
+
+### Changed
+
+- Update `@earendil-works/pi-agent-core` and `@earendil-works/pi-ai` to 0.87.0, including their aligned telemetry and harness dependencies.
+
+## [1.0.0-beta.75]
+
+### Added
+
+- `jev_browser` agent tool: drives a real Chrome browser toward a natural-language goal, deciding each step (click, type, select, scroll, wait) itself using a Jev decision per step against ref-indexed accessibility snapshots — the same architecture as [`browser-use/jev-ultrafast`](https://github.com/browser-use/jev-ultrafast). A `commands` mode forwards raw [`agent-browser`](https://github.com/vercel-labs/agent-browser) CLI argument arrays directly, covering screenshot, video recording, HAR capture, cookies, and any other agent-browser capability beyond the click/type/select loop. A named `session` spans multiple calls against the same browser (start a recording, run a goal, stop the recording, screenshot the result) and stays open by default; every result reports `browserContinuity` in plain language so a caller can tell whether the browser it just used was actually the same one a prior call left open. Tool progress lines are prefixed `jev_browser ·`, matching the existing `jev ·` treatment. Requires the `agent-browser` CLI installed on the host (not a mikan dependency); host sandbox only.
+- Jev decision cost (from the `jev` tool, `jev_browser`'s decision loop, Slack auto-reply gating, and task-intent classification) is now reported to Sentry/OpenTelemetry as `agent.jev.cost`, `agent.jev.duration`, and `agent.jev.calls`, tagged by which feature made the call. Previously this spend was invisible next to the primary chat model's per-run cost — it only ever appeared inside a tool call's raw JSON text.
+
+### Changed
+
+- Every agent tool now requires the `label` parameter the system prompt already promises for every tool call, so its progress line always shows a real description instead of silently falling back to the raw tool name.
+
+## [1.0.0-beta.74]
+
+### Security
+
+- Host sandbox tool output (bash, read, and every other agent tool) is now scrubbed of any configured secret env var's value before it reaches the model or the durable session transcript. Host sandbox mode does not isolate environment variables, so a command like `echo $OPENROUTER_API_KEY` previously returned the key in plain text with no defense beyond the model choosing not to repeat it; it is now replaced with a `[SECRET:VAR_NAME]` placeholder using mikan's existing secret env var inventory.
+
+### Fixed
+
+- Stop and shutdown-restart notices ("Stopping…", "Stopped.", the restart notice) are now recorded in the conversation's `log.jsonl`, matching every other agent reply. Previously these control messages reached the platform but left no trace in the human-readable history the agent (and operators) grep, so a stopped run looked, on later review, like it had never been interrupted.
+
+## [1.0.0-beta.73]
+
+### Changed
+
+- Admin: redesigned the page around a persistent icon sidebar and a single active settings pane (Claude/ChatGPT settings-app style), replacing the pill-tab-plus-accordion layout. Conversation and workspace scope each get their own rail; every pane shares one quiet header (title, one-line description, actions) instead of a stack of bordered cards. Widened the page from 960px to 1180px so the sidebar-plus-pane layout has room to breathe.
+
+## [1.0.0-beta.72]
+
+### Added
+
+- Admin: the Skills panel (conversation and global) can now create, edit, and delete skills directly, not just list and preview them. Saving writes `SKILL.md` straight into the workspace skills tree the harness loader reads, so a new or edited skill is available on the conversation's next turn.
+
+## [1.0.0-beta.71]
+
+### Changed
+
+- Built-in subagents now use the full 100-turn / $10 allowance, and the model-facing `subagent` tool can only request a larger token allowance instead of accidentally shrinking turn, cost, or duration budgets (for example, to $0.30).
+
+### Fixed
+
+- Shared-memory guidance now keeps personal, project-specific, and tool-specific knowledge in its proper scope, prevents memory from overriding system mechanisms, and removes the obsolete shared `SYSTEM.md` environment log.
+- Console usage summaries now show cache-read tokens alongside fresh input tokens.
+- Sandbox provisioning no longer logs `Container … already running` on every readiness check; creation, restart, drift, and failure messages remain visible.
+
+## [1.0.0-beta.70]
+
+### Fixed
+
+- Sandbox: a container migrated to the office-key mount layout (or recreated after its mount configuration drifted) no longer re-migrates on every subsequent restart. The one-time bridging snapshot image is now removed once the new container is confirmed up, instead of being kept forever on the mistaken assumption that the container would eventually run from the base image again. In production this had pinned dozens of containers to increasingly stale snapshots and left their images unreclaimed, consuming disk space on every restart.
+
+## [1.0.0-beta.69]
+
+### Changed
+
+- `harness/jev.ts` is now backed by [`@geminixiang/jev`](https://github.com/geminixiang/jev), a standalone SDK shaped like pi-ai (providers own auth, a model catalog, and a wire implementation) instead of a hand-rolled OpenRouter fetch client. `evaluateWithJev`'s signature, types, and error classes are unchanged, so the auto-reply gate, DM task-intent classification, and the `jev` tool are unaffected. The swap adds request retries and timeouts, neither of which existed before, and a path to other Jev backends (TypeSafe, Vercel AI Gateway, Cloudflare Workers AI) without touching call sites.
+
+## [1.0.0-beta.68]
+
+### Added
+
+- `jev` agent tool: the model can now call Jev directly with a `state` (text or JSON) and any number of boolean / choice / score `questions`, mirroring the decisions API one-to-one — structured instructions and criteria, per-option probabilities, confidence, and score legends all pass through. Available to the main agent and to the `worker`, `software-engineer`, `data-scientist`, and `summarizer` subagent profiles. A missing `OPENROUTER_API_KEY` is reported as a tool error so the model judges for itself.
+- Slack: DM messages in a task thread (and top-level DMs while a task is running) are classified by Jev as `status`, `steer`, or `request` before spending a model turn. Status questions are answered from recorded task state; steering is delivered into the running task; anything else starts a normal run. The regex status matcher remains as the fallback.
+- `task_status` reports `queued` for tasks that were admitted but have not started executing yet.
+
+### Changed
+
+- `harness/jev.ts` accepts structured JSON for state, instructions, and criteria, and returns `confidence` and `legend` on choice / score answers.
+- Jev auto-reply and task-intent state renders `<@U…>` mentions as `@Name` (the bot as `@mikan`) so Jev can tell a message addressed to someone else from one addressed to mikan.
+- Tool progress lines for `jev` calls are prefixed with `jev ·` so users can see which steps came from a calibrated judgment.
+
+## [1.0.0-beta.67]
+
+### Changed
+
+- Slack: unaddressed thread replies in shared channels now pass through the same `/pi-auto-reply` gate as top-level messages instead of being dropped unconditionally. In `jev` mode, Jev scores the message together with its surrounding scope (the channel's recent top-level messages, or the thread's messages plus whether mikan has already replied there), so bare follow-ups like "then roll it back" are judged in context. `off` still requires a mention; `on` now admits thread replies too.
+- Deploy docs: `/pi-auto-reply` slash command description lists `on | off | jev`.
+
+## [1.0.0-beta.66]
+
+### Added
+
+- `/pi-auto-reply` gains a third state, `jev`: alongside manual `on`/`off`, a Slack channel can now delegate the "does this unaddressed message address mikan" decision to Jev (`typesafe/jev`), a fast typed-decision model, on a per-message basis. Any evaluation failure (including a missing `OPENROUTER_API_KEY`) fails closed to "not addressed" so a misconfiguration cannot make the bot noisy in a shared channel.
+- `harness/jev.ts`: a standalone `evaluateWithJev` client for Jev, reached through OpenRouter's `/api/alpha/decisions` REST API using the same `OPENROUTER_API_KEY` pi-ai's `openrouter` chat provider reads. Jev returns typed decisions (boolean probability, choice, score) instead of generated text, so it is a plain function call sites use directly rather than a selectable chat provider in `models.ts`'s catalog.
+- Jev-mode auto-reply decisions (channel, probability, addressed, truncated message text) are logged at info level for observability.
+
+## [1.0.0-beta.65]
+
+### Added
+
+- Slack: when a run resolves to exactly one completed subagent profile with a known persona, the final answer posts as a fresh message under that profile's own username/icon (`Data Scientist`, `Software Engineer`, `DevOps Engineer`, `Account Manager`, `Business Development`, `Creative Producer`, `Ad Operations Specialist`) instead of mikan's own identity. Mixed-profile or partially-failed runs keep mikan's identity, since `chat.update`/`chat.appendStream` cannot carry a Slack identity and there is no single "who answered this" to attribute.
+- The `react` tool (add an emoji reaction to the triggering message) is now documented in the system prompt with two unconditional triggers tied to `start_task`'s existing bar: react before starting any multi-step investigation, change/test, or long wait, and react instead of writing "nothing to report" on a periodic/background check with nothing to report.
+- Discord and Telegram now wire the `react` tool into their responders (previously Slack/GitHub-only despite the tool being granted everywhere); a shared short-name-to-Unicode translation covers what the prompt recommends for platforms whose reaction API takes a Unicode character rather than a name.
+- `creative-producer` subagent profile gains the `generate_image` tool grant, matching its image-deliverable description.
+
+### Changed
+
+- Built-in subagent profile `maxTokens` raised from 100,000 to 1,000,000: the old cap was a common budget-exceeded trip for ordinary investigative tasks (e.g. a repo-wide architecture review), not just runaway loops.
+- The `analysis-only` subagent profile is renamed `summarizer`: it is a DAG synthesis node over upstream dependency output, not a mid-task advisor.
+- Office data policy for non-Slack platforms is now an explicit rule (ADR 0008): only Slack conversations can be public, and Telegram/Discord/GitHub offices always resolve to private rather than falling through an "unknown" branch by omission.
+- The Admin office visibility card now states the effective outcome in plain words instead of the internal policy model; public Slack channels get one "Hide the files in this channel from other offices" checkbox, other conversation kinds show the fixed Hidden state with no control.
+- `settings.json` ownership (schema, scope merge, readers, writers, one-time migrations) is gathered under `src/settings/`.
+
+### Docs and maintenance
+
+- Describe mikan as an organization-wide, per-conversation-isolated agent.
+- Move the three remaining top-level source files into their owning modules (`adapters/messages.ts`, `adapters/index.ts`, `cli/process-lifecycle.ts`); pure move, no behavior change.
+
+## [1.0.0-beta.64]
+
+### Changed
+
+- The retired door-policy keys (`sandbox.image.workspaceMount`, `sandbox.workspace`) are dropped at load time and no longer appear in the resolved sandbox settings or the Admin office view.
+
+### Added
+
+- `mikan office migrate-door-policy` removes the retired keys from the global and every registered office settings file, preserving all other settings and leaving files without them untouched. Only an explicit shared-support `private` visibility is carried into `office.visibility`; `full`, `isolated`, and legacy `private` are removed without deriving any grant.
+
+## [1.0.0-beta.63]
+
+### Changed
+
+- Office data policy is now a single **visibility** derived from the Slack conversation type (ADR 0008): public channels are public offices; private channels, DMs, group DMs, externally shared channels, and unknown kinds are private. Every office receives the same projection — its own directory read-write, every other public office read-only under `/workspace/public/<office key>`, and shared `MEMORY.md`/`skills/` read-write for public offices or read-only for private ones. Nothing mounts the workspace root.
+- The five-way door policy (`isolated`, `trusted/shared-support`, `trusted/full`, …) is retired. Legacy settings still parse but no longer change the projection; offices that still declare `full` are reported once per process. The Admin "door policy" control and `/pi-sandbox door` are replaced by one switch that can narrow a public channel to private (`/pi-sandbox visibility <private|default>`); nothing can widen beyond what Slack allows.
+- Backends without a managed projection (`host`, `container:*`, `cloudflare:*`) now serve private offices with a one-time logged warning instead of refusing, since they are trusted deployments by definition.
+
+### Added
+
+- The Slack adapter records channel kinds for every registered office from the channel list loaded at startup, so offices created before kinds were recorded keep their public status without waiting for a new message.
+
+### Fixed
+
+- Recreating a sandbox container after a visibility change removes empty `/workspace/public/<key>` mountpoints that `docker commit` carried over from the previous mount set.
+
+## [1.0.0-beta.62]
+
+### Changed
+
+- Scheduled events now live in host-only per-office state (`<state dir>/conversations/<office key>/events/`) and are never mounted into a sandbox. The `event` tool and the Admin portal are the only writers, both confined to the current office; `create` never overwrites, deleting a record cancels its timer or cron immediately, and the Slack App Home lists only the opener's DM office schedules. The filesystem watcher is gone: hand-edited records take effect on the next start.
+- OpenConnector is an ordinary MCP server with a deployment default. When a Slack conversation has not declared `open-connector`, mikan mints that conversation's runtime token with `OPENCONNECTOR_ADMIN_TOKEN` and saves a normal `mcpServers` entry in its settings; conversations may override it with a self-hosted server or disable it like any other MCP entry. The loader no longer fills `connectionName`; connection selection belongs to OpenConnector.
+
+### Added
+
+- `mikan office migrate-events` moves legacy `<workspace>/events/*.json` records into the owning office's state and reports records it cannot attribute.
+- `mikan office migrate-openconnector` converts legacy `open-connector-runtime-token.json` files into conversation MCP entries.
+
+### Fixed
+
+- The agent `event` tool can no longer list, read, update, or delete another office's events, and `scope=all` is rejected.
+
+### Docs and maintenance
+
+- Redraw the architecture diagram as a single rounded page and refresh the README image.
+- Support local Slack E2E runs, capture intake and session markers on failure, and schedule E2E events through the `event` tool instead of writing files.
+- Record the Office isolation policy, storage inventory, and OpenConnector history audit under `docs/`.
+
+## [1.0.0-beta.61]
+
+### Added
+
+- Ground Slack DM progress replies in runtime/v4 task observations; common task-thread status queries no longer steer work, and ordinary followups do not repeat completion mentions.
+- Slack DM task handoff: independent task threads keep the main conversation free, with text steering in active task threads and continuation after stopping.
+
+### Fixed
+
+- Keep thread stop acknowledgements in the source thread, including shared-channel unmentioned stop controls.
+- Notify Slack DM task requesters with a fresh in-thread mention after normal completion.
+- Finalize stop acknowledgements that arrive after the cancelled run has already settled.
+- Propagate final response delivery failures so rejected updates do not trigger completion notifications.
+- Honor stop during runner preparation and keep older active tasks visible in status queries.
+- Report task admission, asynchronous startup, and status inspection failures through the existing Sentry/OTLP observability path.
+
+### Changed
+
+- Publish the already built and verified npm package without rerunning build and repository setup lifecycle scripts.
+- Keep the documented and CI coverage commands as stable entry points while maintaining their shared Vitest invocation in one place.
+- Validate debug Session View selections from their path and header, leaving full parsing to consumers that load session content instead of inspecting the same file twice.
+
+## [1.0.0-beta.60]
+
+### Fixed
+
+- Separate CJK-adjacent bold dollar amounts for Slack's Markdown parser while preserving code and link destinations.
+- Validate Session View selections through read-only inspection so active and repeatedly selected historical sessions do not conflict with writer ownership or appear corrupted.
+
+## [1.0.0-beta.59]
+
+### Fixed
+
+- Keep Slack's working indicator in its own paragraph so progressive heading and table updates can replace existing rich-text messages without `block_mismatch`.
+- Pace failed progressive redraws as well as successful ones, retaining accumulated text for recovery instead of retrying on every delta.
+
+### Changed
+
+- Use Commander for CLI option parsing, subcommand validation, and generated help.
+- Guide interactive onboarding with arrow-key selections, masked credentials, and a final confirmation before saving. Cancel without writing settings.
+- Refuse custom-provider onboarding when models.json already exists, without printing credentials or writing partial settings.
+
+## [1.0.0-beta.58]
+
+### Added
+
+- Restore Slack `/pi-auto-reply on|off` with the original per-conversation marker files, without judge models or rules.
+- Expose the admin portal command on Discord and Telegram.
+
+### Changed
+
+- Collapse conversation sections in the Admin portal, load their data only when opened, remember their open state, and open Vault and Session View links in new tabs.
+
+## [1.0.0-beta.57]
+
+### Changed
+
+- Export raw platform conversation, channel, session, thread, message, and user identifiers so Sentry traces can be mapped directly back to their source while continuing to exclude human-readable names and conversation or tool content.
+
+### Removed
+
+- Remove telemetry identifier hashing and the `TELEMETRY_HASH_KEY` deployment setting.
+
+## [1.0.0-beta.56]
+
+### Added
+
+- Add content-free agent diagnostics for actual model IDs, token and cost totals, first-token latency, context utilization, message and attachment counts, payload sizes, tool categories and status, and retry, compaction, and budget summaries.
+
+### Security
+
+- Replace raw conversation, session, message, thread, and user telemetry identifiers with stable opaque values, support deployment-specific HMACs through `TELEMETRY_HASH_KEY`, and stop sending usernames to Sentry.
+
+## [1.0.0-beta.55]
+
+### Added
+
+- Export explicitly configured, content-free traces and metrics over standard OTLP HTTP/protobuf, including GenAI and OpenInference attribution for Arize Phoenix. Sentry remains available for sanitized issues and legacy metric fallback without duplicate spans; zero configuration remains network-free.
+- Add a guided Admin dialog for configuring MCP servers, with structured fields or pasted standard `mcpServers` JSON and card-based installed-server management.
+
+### Changed
+
+- Delegate the agent run loop, retries, compaction, persistence, cancellation, and the native `read`, `write`, `edit`, and `bash` tools to Pi's `AgentHarness` and execution-tool implementations. mikan retains budgets, platform presentation, authorization, and sandbox-backed execution routing.
+- Upgrade `pi-agent-core` and `pi-ai` to 0.85.1, including GPT-6 Astra catalog entries and the 30-minute prompt-cache TTL for GPT-5.6+ Responses models.
+- Consolidate harness, office, session, sandbox, web-adapter, and shared-command ownership without changing the published root exports.
+
+### Removed
+
+- Remove managed skill packages and their Admin/package materialization surfaces. Workspace and conversation skills remain supported.
+- Remove the auto-reply judge, command, configuration, and UI; explicit platform triggers remain supported.
+- Remove the unused `/api/agent-events/stream` SSE mirror, its token setting, and supporting event types. The authenticated session viewer continues to use `/session/stream`.
+
+### Fixed
+
+- Preserve Pi's native optional tool schemas, require an explicit authorized execution environment for native file/shell tools, and keep container working directories inside the guest instead of applying them to the host Docker process.
+
+## [1.0.0-beta.54]
+
+### Changed
+
+- Admin portal: MCP servers are added by pasting the server's standard `mcpServers` JSON (Claude Desktop / Cursor shape), stored as-is; the old name / target / `KEY=value` form is gone. Every add and preset install is followed by a real connection check, and the response shows the tool count or the server's own error; a per-server **Test** button re-checks an installed entry. Query-string values in listed URLs are redacted. stdio entries now run their command on the host at save time.
+
+## [1.0.0-beta.53]
+
+### Changed
+
+- Graceful shutdown drains in-flight runs for up to five minutes (was 30 seconds) after stopping intake; runs still open at the deadline are aborted and their conversations receive a restart notice instead of silence. The pm2 template `kill_timeout` is now six minutes; update your `ecosystem.config.cjs` to match. Shutdown failures now log every nested step error.
+
+### Added
+
+- Send the run user (id and username) with Sentry events instead of stripping it, so Conversations show who sent each message; email and IP stay dropped.
+- Set the Sentry conversation id to the session key on every agent run so Agent Monitoring groups gen_ai spans per thread.
+- Report subagent outcomes to Sentry from the subagent tool: `agent.subagent.runs` / `agent.subagent.duration` metrics and a lifecycle breadcrumb for every status; a Sentry error under `error_domain=subagent` for `failed` and `invalid_output` (fingerprinted by error class) and for launch failures. `budget_exceeded`, `timeout`, `cancelled`, and `skipped` stay metrics-only. Reports carry run metrics, never task text or labels.
+
+## [1.0.0-beta.52]
+
+### Removed
+
+- Remove the subagent `requiredTools` / `required_tools` mechanism: the post-run "every listed tool was invoked" check was a proxy for evidence that never held and failed only after the budget was spent. Callers that want evidence can read `toolCallCounts`.
+
+## [1.0.0-beta.51]
+
+### Fixed
+
+- Drop `requiredTools` from built-in subagent profiles; requiring both `read` and `bash` discarded finished answers from tasks that needed only one of them.
+- Keep a caller's `requiredTools` when the request also names a profile.
+- Stop dropping the retained assistant message when an overflow retry rebuilds context from the store.
+
+### Changed
+
+- Read mikan session metadata through Pi's `session.getValue` in `open`/`inspect`; compare `fstat` fields instead of hashing the file for pending-session materialization.
+
+## [1.0.0-beta.50]
+
+### Fixed
+
+- Tolerate byte-identical duplicate Dream session files while rejecting divergent same-ID files.
+
+## [1.0.0-beta.49]
+
+### Changed
+
+- Configure OpenConnector only at startup with `OPENCONNECTOR_ENDPOINT` and `OPENCONNECTOR_ADMIN_TOKEN`; ignore settings overrides of the reserved server, and reduce the Admin MCP Marketplace to the Metabase preset.
+
+## [1.0.0-beta.48]
+
+### Added
+
+- Add an offline session migration for Pi 0.84-generation v4 JSONL files, with verified atomic replacement and preserved `*.pi-084.bak` originals.
+
+### Changed
+
+- Upgrade `pi-agent-core` and `pi-ai` to 0.85.0 and persist sessions with the current `v: 4`, `storageVersion: 1` schema.
+- Extend `mikan sessions migrate` to convert both legacy mikan v3 and Pi 0.84-generation v4 sessions while the daemon is stopped.
+
+## [1.0.0-beta.47]
+
+### Added
+
+- Integrate OpenConnector as a host-side MCP gateway: Slack Conversation offices receive scoped runtime identities, while provider OAuth connections remain in the gateway and execution audit stays attributable to the originating conversation.
+- Preserve operating guidance supplied during MCP initialization and present it to the agent with explicit system-prompt and user-intent boundaries.
+- Add automatic selection of a sole OpenConnector provider connection when an action omits `connectionName`; retain explicit selection when multiple accounts exist.
+
+### Changed
+
+- Gate MCP tools by the platform trust model and enforce the untrusted package boundary.
+- Make platform shutdown cleanup bounded and strengthen runner/session lifecycle rollback handling.
+
+### Fixed
+
+- Isolate Slack DM and thread E2E context and bound event-delivery waits.
+
+### Tests
+
+- Add coverage for OpenConnector token provisioning, MCP instruction propagation, connection selection, trust gating, lifecycle cleanup, and Slack isolation.
+
+## [1.0.0-beta.46]
+
+### Added
+
+- Add an interactive `mikan onboard` wizard that configures one chat adapter, an LLM provider, and the sandbox, writing private environment and settings files while retaining non-interactive template generation.
+- Derive shared workspace visibility from platform channel privacy: Slack public channels can update shared memory, private channels receive it read-only, and DMs, external channels, unknown kinds, and other platforms stay isolated unless explicitly overridden.
+- Schedule Dream maintenance for Conversation-office memory with durable evidence checkpoints.
+- Add an Admin MCP Marketplace with reviewed GitHub, Context7, Playwright, Sequential Thinking, and Metabase presets; Metabase installations accept an instance endpoint and API key.
+
+### Changed
+
+- Remove the executable extension system and its CLI/chat management surfaces; packages remain the supported path for deploying read-only skills.
+- Remove the harness `auth.json` credential store; configure provider credentials through environment variables, onboarding, or the conversation vault.
+- Remove Gondolin, Firecracker, and GitHub Cloud Build log integrations from the supported runtime surface.
+- Fail closed when a sandbox backend cannot enforce an isolated office or read-only shared workspace memory; use `image:*` or explicitly select a trusted read-write projection.
+- Consolidate runtime, session, adapter, web, and configuration ownership to reduce duplicate lifecycle and parsing rules.
+
+### Fixed
+
+- Preserve streamed UTF-8 output when host sandbox chunks split multi-byte characters.
+- Re-aim migrated session lanes at the nearest surviving ancestor when the newest v3 entry contains facts but no v4 message.
+
+### Tests
+
+- Move CI action runtimes to Node 24 and strengthen runtime, presenter, workspace-projection, MCP marketplace, and session migration coverage.
+
+## [1.0.0-beta.45]
+
+### Fixed
+
+- Session migration now collapses crash-duplicated v3 lines (a retried append writing the same header and entry twice) the way the v3 reader did, instead of failing v4 verification on the duplicate id. Found rehearsing the migration against 5,446 production session files; after the fix all migrate and reopen cleanly.
+
+## [1.0.0-beta.44]
+
+### Added
+
+- Connect MCP (Model Context Protocol) servers via `mcpServers` settings and expose their tools to the agent as `mcp__<server>__<tool>`; stdio and streamable-HTTP transports, per-server failures isolated, credentials held host-side in server config out of the model's reach.
+- Manage MCP servers from the admin portal: per-conversation and global panels with add, enable/disable, and remove; credential values are redacted to key names in the UI.
+- Migrate sessions to pi's v4 format with a `mikan sessions migrate` CLI; pi upgraded to 0.84.3.
+- Extensions can declare required host capabilities in `package.json` (`mikan.requires`); activation checks them before importing the module and `mikan ext validate` reports them.
+
+### Changed
+
+- Split the agent module into five authority modules (catalog, prompt, runner, subagent-runner, types); the runtime now owns session rotation decisions and per-event chat-history sync.
+- Derive all platform command registration and routing from the single command manifest.
+- Adopt pi-ai's retryable-error classifier instead of a local copy.
+- Conversation runtimes are keyed by office key, fixing cross-conversation runner reuse after ID changes.
+
+### Fixed
+
+- Session files enforce single-writer ownership, surviving inode reuse and stale writer claims.
+- Failed extension activations roll back cleanly; duplicate tool names are rejected.
+- Slack slash commands in threads carry the thread session key instead of falling back to the top-level session.
+- GitHub first-contact stop no longer creates participation state.
+- Subagent deadlines are enforced by a single wall-clock timer; `before_agent_start` hooks run before auth and pre-turn compaction.
+- Sandbox container removal failures no longer clear ownership, preventing orphaned containers.
+- Run outcomes settle from the final message and run state is released on throw.
+
+## [1.0.0-beta.43]
+
+### Added
+
+- Add an optional authenticated GitHub webhook endpoint that wakes polling immediately for lower-latency issue and pull-request handling.
+- Add a machine-readable architecture index and generated system architecture documentation for repository-wide module boundaries and flows.
+
+### Changed
+
+- Run manual and automatic Session Dreams in the background while preserving session rotation and conversation maintenance boundaries.
+
+### Fixed
+
+- Wait for final Slack thread responses in isolation coverage instead of accepting provisional native-stream text.
+
+### Tests
+
+- Add regression coverage for GitHub webhook authentication and dispatch, background Session Dream lifecycle behavior, and final Slack stream settlement.
+
+## [1.0.0-beta.42]
+
+### Changed
+
+- Dispatch Slack extension commands when users type the command name without a leading slash, so documented Agent Project Manager commands work in ordinary messages.
+- Update `@earendil-works/pi-agent-core` and `@earendil-works/pi-ai` to 0.83.0.
+- Clarify Agent Project Manager onboarding, initial behavior, and the distinction between commands and natural-language tasks across all translated guides.
+
+### Fixed
+
+- Stabilize Slack end-to-end coverage for extension command dispatch, Agent Project Manager, and long-message threads.
+
+### Tests
+
+- Add regression coverage for slashless extension command routing and conversation runtime dispatch.
+
+## [1.0.0-beta.41]
+
+### Added
+
+- Add Slack App and Agent manifests plus support for `assistant_view` and `agent_view` lifecycle events, including thread-aware assistant context and optional socket-event tracing.
+- Add Discord Components V2 responses with native sections, separators, containers, and markdown-table rendering suited to Discord's width model.
+- Add rich Telegram responses through platform-native formatting.
+- Show the current activity of running subagents in progress dashboards.
+- Add an end-user Agent Project Manager guide in English, Japanese, Simplified Chinese, and Traditional Chinese.
+
+### Changed
+
+- Pace progressive redraws by elapsed time instead of response volume, and edit overflow messages rather than repeatedly posting replacements.
+- Split Slack streamed text at the 12,000-character API limit, decline unsupported native streams before starting them, and hand off a truncated final tail exactly once.
+- Report package-installed extensions in `/extensions` and return a clear compatibility error when an extension requires a newer mikan version.
+
+### Fixed
+
+- Preserve final-source preparation during progressive replacement and cut truncated Slack messages at line boundaries.
+- Distinguish Slack length-limit failures from other send errors instead of treating every failure as oversized content.
+- Prevent desktop automation helpers from sending into a Slack thread's main composer.
+
+### Tests
+
+- Add coverage for Slack assistant lifecycle and stream limits, Discord Components V2 and table formatting, progressive overflow editing, rich Telegram context, subagent activity reporting, and extension compatibility reporting.
+
+## [1.0.0-beta.40]
+
+### Added
+
+- Add deterministic extension callback schedules that run host-side without an agent run, model call, or token spend; schedules persist across restarts and use host-authoritative storage.
+- Add extension APIs for reading conversation or thread history, listing active platform users, opening direct-message conversations, and posting threaded notifications.
+- Add declarative extension secrets with activation-time validation, CLI visibility, admin portal provisioning, and purge support.
+- Add a production-ready agent project manager example built as an Event → Workflow → Task pipeline with SQLite persistence, scheduled heartbeats, threaded polling, delivery tracking, and Slack end-to-end coverage.
+
+### Changed
+
+- Make proactive extension messaging default to the conversation's platform, removing ambiguity in multi-platform deployments.
+- Make `api.notify` return the posted message ID and allow `api.fetchHistory` to read replies beneath that message, enabling poll-only follow-up workflows without webhooks.
+- Make `mikan ext remove --purge` sweep an extension's schedules, secrets, data directories, and optional workspace event files while reporting leftovers for non-purge removals.
+- Enable stricter TypeScript and lint enforcement for indexed access, type-only imports, Node.js import protocols, dependency cycles, explicit `any`, nesting depth, function size, and parameter count.
+- Consolidate duplicated authorities and thin wrappers into their owning modules, and refresh repository documentation for the office architecture.
+
+### Tests
+
+- Add coverage for callback schedule persistence and dispatch, extension secrets, platform reads, threaded notifications, purge behavior, and the agent project manager pipeline.
+
+## [1.0.0-beta.39]
+
+### Fixed
+
+- Slack mentions now actually notify people: the adapter resolves response-source `<@userName>` (and display-name) mentions to Slack's native `<@U…>` id form on every outgoing path, including streamed responses. Previously mentions rendered as literal text and never pinged anyone; scheduled-event texts that hard-require raw user ids as a workaround can go back to plain `<@userName>`. The system prompt now also names the Users table as the one source of mention handles and forbids borrowing handles from other platforms (a GitHub username is not a Slack mention).
+- Discord slash commands register again: the `/sandbox` option description had grown past Discord's 100-character limit, which made Discord reject the whole registration batch at startup. A manifest test now enforces the budget for every command, argument, and Telegram menu description.
+- Fix `generate_image` losing its generated file at the upload step (`sh: … cannot open /workspace/<file>: No such file`): the tool wrote the image host-side into the workspace base and then handed a bare filename to the attach upload path, which reads through the sandbox — where the base is no longer mounted since the office layout migration. The image is now written into the conversation's own office directory (guest-visible) and uploaded directly by host path, with no sandbox round-trip, under every door policy. Image-generation provider errors now also name the model id that was sent.
+- The Slack e2e workflow works again after the door-policy and office-key changes: the runner's settings opt into the trusted door policy explicitly (host mode is refused under the isolated default by design), local-delivery verification reads the office-key log path, and one recall prompt was disambiguated.
+
+### Changed
+
+- The Conversation office is now a first-class module: `src/office/` owns identity, the Workspace/Office layout values, the registry journal, and the boot migration. Option bags across the runtime carry one `office` value instead of parallel address/directory fields, the attachment convention has a single owner on the shared adapter surface, and `ChannelStore` is gone. No behavior or on-disk layout change.
+- Embedders can now construct the runtime from the public surface: `createWorkspace`, `createOfficeAddress`, and `officeKey` (plus the `Office`/`Workspace` types) are exported, and `createConversationRuntime` takes a `workspace` value in place of the `workingDir` string.
+- Repository layout for contributors: run-it assets live under `deploy/` (pm2, docker, examples), the test suite lives at `src/test/`, and tool configs live in `.config/` (root keeps `package.json` and `tsconfig.json`). The build config moved to `src/tsconfig.build.json`.
+
+## [1.0.0-beta.38]
+
+### Fixed
+
+- Align the conversation-skill symlink guard with what the host actually reads: symlinked entries are skipped per skill — with the skipped paths named in the host log and surfaced to the agent in its prompt — instead of one symlink anywhere disqualifying the whole tree, and symlinks inside vendored `node_modules` or dot directories (which the loader never reads) no longer disqualify anything. Offices whose skills vanished because a skill vendored npm dependencies (`.bin` symlinks) get them back.
+
+## [1.0.0-beta.37]
+
+### Fixed
+
+- Stop discarding preserved container contents on mount drift: a drifted managed container is now committed and re-created from its snapshot with the desired mounts — writable layer intact — instead of being rebuilt from the base image. This closes the gap that recreated layout-migrated containers from scratch on their first message after upgrade (stored mount signatures went stale as shared sources changed overnight). `MIKAN_SKIP_CONTAINER_PRESERVATION=1` restores plain recreation.
+- Stop treating ordinary directory activity as mount drift: directory mount sources are now fingerprinted by identity (a replacement directory is drift) instead of size and mtime, so event-file churn and children being created no longer force container rebuilds. File sources keep content fingerprints — atomic replacement leaves a stale inode in the container and must recreate it.
+- Door-policy changes now preserve container contents through the rebuild; the portal and `/pi-sandbox door` copy no longer warn about a reset.
+
+## [1.0.0-beta.36]
+
+### Added
+
+- Make the office door policy configurable: the Admin portal gains a per-office selector (global default / isolated / trusted shared-support / trusted full) plus a global-default selector, and the existing `/pi-sandbox` command gains `door <default|isolated|shared|full>` — both write the explicit `sandbox.workspace` settings and retire the legacy `image.workspaceMount` key on save.
+- Door-policy changes follow the same clear-or-refuse contract as model changes (the system prompt bakes the workspace projection), and the sandbox container is rebuilt with the new mounts on the office's next message.
+
+## [1.0.0-beta.35]
+
+Completes the office storage migration introduced in 1.0.0-beta.34: sandbox containers now survive it with everything installed inside them intact. Upgrading directly from 1.0.0-beta.33 or earlier to this release keeps container contents; deployments that already booted 1.0.0-beta.34 had their containers recreated by that release.
+
+### Added
+
+- Preserve managed sandbox containers through the office layout migration: each container still mounting legacy paths is committed to a snapshot and re-created with translated workspace, state, and vault mounts, keeping its writable layer — software installed inside survives the upgrade.
+- Migrate containers off the boot path: on demand before a conversation's next message and via a background sweep after the platforms start, so boot stays fast and nothing blocks on the one-time cost.
+- Resume interrupted container migrations safely: the pre-removal mounts ride on the snapshot image, a crash at any point resumes without data loss, and snapshots are reclaimed once a container naturally returns to the base image.
+- Add the `MIKAN_SKIP_CONTAINER_PRESERVATION` escape hatch to fall back to plain container removal.
+
+### Tests
+
+- Cover translate, no-op, resume, orphan-resume, snapshot reclamation, and disarmed paths on a stateful docker mock, plus bind-translator unit tests; rehearsed against real docker including the crash-resume path.
+
+## [1.0.0-beta.34]
+
+**One-way storage migration.** On first boot this release renames every conversation's workspace directory, credential vault, and host state tree to platform-scoped office keys, journaled with crash recovery. Back up the state dir and workspace before upgrading; earlier versions cannot read the migrated layout, so there is no downgrade. Managed sandbox containers for migrated conversations are recreated, which resets software installed inside them once (a preservation path is planned for a follow-up release).
+
+### Added
+
+- Isolate every conversation as an office keyed by platform and conversation id, ending all cross-platform collisions on shared raw ids: runtime state, workspace files, chat logs, attachments, credential vaults, settings, extension data, and scheduled-event scoping are now platform-scoped.
+- Migrate legacy directories automatically at boot: ownership is verified against each enabled platform's id format, ambiguous or unrecognized directories fail closed as needs-owner, and repositories or build output sitting in a trusted workspace root are skipped in place.
+- Add the `mikan office` CLI: `list` shows the office inventory and pending migrations; `claim` assigns an owner platform to a legacy directory the format check cannot decide.
+- Record every office in a host-only registry at creation, giving Admin and CLI surfaces a durable raw-id ↔ office mapping.
+
+### Changed
+
+- Scope the Admin portal by office: conversation lists show platforms, cross-platform targets name theirs explicitly, and all paths, settings, projections, and vault links resolve from the full office address.
+- Show office-key paths (`/workspace/v1-slack-…`) in agent prompts and workspace listings; transcripts from before the upgrade may reference old paths until the agent re-lists.
+- Breaking for embedders: `createRunner`, `MessagingEventHandler`, settings, package, and extension APIs now carry an `OfficeAddress`.
+
+### Fixed
+
+- Preserve Session Dream memory writes after the migration; the write grant previously derived the memory path from the raw conversation id and would have refused every dream.
+- Stop `mikan ext` from resolving conversation state against the wrong state dir when `--state-dir` differs from the environment default.
+- Keep thread sessions anchored to their main-session lineage via `parentSessionId`.
+
+### Tests
+
+- Add migration-engine coverage for claiming, crash recovery, ambiguity, reappeared directories, vault and state-tree moves, and format verification; rehearsed end-to-end against a production-shaped 327-entry workspace (285 offices migrated in ~2.4s, zero manual claims, checksums identical).
+- Keep state-writing tests out of the developer's real `~/.mikan` with a suite-wide temporary state dir.
+
+## [1.0.0-beta.33]
+
+### Changed
+
+- Give every built-in subagent profile a 100,000-token allowance and honor larger token budgets requested by the parent model.
+
+### Fixed
+
+- Disable Sentry's faulty OpenAI integration to prevent instrumentation failures in model-provider requests.
+
+### Tests
+
+- Add regression coverage for subagent profile token defaults, model-requested increases, tool schema behavior, and disabled OpenAI instrumentation.
+
+## [1.0.0-beta.32]
+
+### Changed
+
+- Raise the autonomous event and trigger run cost stop-loss from $2 to $10 while retaining the 10-minute and 50-call limits.
+- Allow session memory dreams to make up to 10 LLM calls and remove their fixed cost cap while retaining the two-minute limit.
+
+### Fixed
+
+- Prevent large conversations from becoming permanently unable to reset or rotate when preserving memory necessarily exceeds a fixed cost threshold.
+
+## [1.0.0-beta.31]
+
+### Changed
+
+- Allow attachments to use each sandbox executor's standard file reader while retaining workspace path containment.
+
+### Fixed
+
+- Restore HTML, image, and document uploads from managed sandboxes that cannot provide atomic symlink-free traversal.
+
+### Tests
+
+- Add end-to-end regression coverage for staging and uploading workspace files through the regular executor transport.
+
+## [1.0.0-beta.30]
+
+### Added
+
+- Add role-based subagent profiles for software engineering, DevOps, data science, account management, business development, creative production, advertising operations, and bounded general work.
+- Add a generated cross-module hardening report covering module boundaries, coupling, and verification evidence.
+
+### Changed
+
+- Stabilize exported module interfaces and route executor-dependent file staging through the active execution transport.
+- Deepen progressive response rendering and keep Slack E2E turns bound to the runner lifecycle.
+
+### Fixed
+
+- Prevent extension packages, attachment bridges, vault keys, sandbox paths, and event inputs from escaping their intended boundaries.
+- Close runner construction, cached-runner invalidation, Gondolin projection, and automatic Session Dream settlement races.
+- Validate model identifiers, event timezones, package refreshes, and shared-history watermarks consistently.
+- Keep reset history bounded by reset time and exclude queued future turns from session history.
+- Prevent Slack from posting bare working-indicator updates.
+
+### Security
+
+- Harden Git package materialization, extension subpaths, filesystem bridges, and sandbox path validation against traversal and symlink escapes.
+
+### Tests
+
+- Add regression coverage for declaration surfaces, session history boundaries, runtime races, event validation, package materialization, and Slack runner integration.
+
+## [1.0.0-beta.29]
+
+### Added
+
+- Add Git-sourced extension packages with global and conversation scopes, package mount resolution, CLI inspection, and admin portal management.
+- Add native Slack markdown-block responses and the `slack_blockkit` tool for interactive Block Kit messages.
+- Add interactive Block Kit APIs for extensions, with a poll extension example.
+- Add named subagent profiles, built-in workflow specialists, per-profile tool grants, and a bounded Slack progress dashboard.
+- Preserve durable memory with Session Dream before biweekly shared-channel session rotation, using the same conversation-scoped maintenance path as `/new`.
+
+### Changed
+
+- Run Gondolin runtimes inside the mikan process instead of detached workers. Restarts now boot fresh VMs on demand, and shutdown closes every VM so projected files sync back first.
+- Remove Gondolin runtime inventories, worker heartbeats, and the `stateDir` argument from `configureGondolinRuntime`.
+- Render standard GFM response prose as native Slack markdown blocks while keeping progressive response updates behind a single lifecycle.
+
+### Fixed
+
+- Keep the current session active and preserve saved memory when Session Dream cannot finish.
+- Bound subagent cancellation, invocation modes, profile labels, and Block Kit payloads; clamp long labels with an ellipsis instead of rejecting calls.
+- Show the selected subagent profile and its tool grant consistently in progress output.
+- Render the Slack subagent dashboard as a response source rather than escaped mrkdwn.
+- Isolate Git test fixtures from an ambient `GIT_DIR`.
+
+### Tests
+
+- Add coverage for extension packages, extension Block Kit APIs, native Slack rendering, subagent profiles and progress, Session Dream rotation, and in-process Gondolin lifecycle behavior.
+
+## [1.0.0-beta.28]
+
+### Removed
+
+- Remove Gondolin remote-worker and fleet support. `sandbox.gondolin.remote`, `gondolin:remote`, and `--worker-token` are no longer supported; use the local `gondolin:default` sandbox instead.
+
+### Fixed
+
+- Preserve Slack mrkdwn links whose labels contain spaces when rendering Block Kit responses.
+- Reuse the existing Slack progress message when streaming the final response, preventing duplicate or partially completed bot messages.
+
+## [1.0.0-beta.27]
+
+### Added
+
+- Preserve concrete long-term memory before `/new` creates a fresh DM session, while keeping transient context and pre-reset platform history out of the new model context.
+
+### Changed
+
+- Serialize workspace-mutating tools and memory-maintenance runs so file updates, resets, and incoming messages have deterministic ordering.
+- Align extension context and message hooks with the active agent lifecycle, including per-run system prompt rewrites that preserve dynamically rebuilt memory, skills, and sandbox context.
+
+### Fixed
+
+- Keep extension-rewritten messages consistent across tool execution, persistence, provider context, and lifecycle events.
+- Account for compaction model usage in run budgets and reject corrupted session trees instead of silently accepting broken history.
+- Wait for active runs before resetting sessions, and prevent old runs from writing after `/new`.
+- Keep long Slack continuations in their thread and preserve mrkdwn links when rendering Block Kit text.
+
+### Tests
+
+- Add real Slack coverage for memory-preserving `/pi-new`, long threaded responses, and Block Kit markdown links.
+- Add regression coverage for harness message identity, dynamic prompts, compaction budgets, session integrity, runtime settlement, and mutation-tool ordering.
+
+## [1.0.0-beta.26]
+
+### Fixed
+
+- Make the subagent tool schema compatible with OpenAI by exposing an object at the function parameter root.
+
+### Tests
+
+- Add regression coverage for OpenAI-compatible subagent function schemas.
+
+## [1.0.0-beta.25]
+
+### Changed
+
+- Temporarily remove the Agent Sandbox runtime, SDK, Kubernetes client, Helm deployment, runtime images, and related release workflow from the npm release.
+- Restore the Gondolin, Gondolin remote-worker, and Firecracker sandbox implementations while Agent Sandbox packaging is redesigned separately.
+
+### Fixed
+
+- Restore global npm installation and CLI startup after the broken Agent Sandbox dependencies in `1.0.0-beta.23` and `1.0.0-beta.24`.
+
+### Tests
+
+- Add a real `npm install -g --prefix` smoke test for the packed tarball, enforce a 2 MiB size ceiling, and gate CI and npm publishing on the result.
+
+## [1.0.0-beta.24]
+
+### Fixed
+
+- Bundle the vendored Agent Sandbox SDK in the npm package so global installs no longer fail on a missing repository-local tarball.
+- Reuse mikan's direct Kubernetes client dependency as an SDK peer instead of recursively bundling a duplicate dependency tree, keeping the published tarball under 1 MiB.
+
+### Tests
+
+- Add a pack-install smoke test that imports the bundled SDK, runs the packed CLI, enforces a 2 MiB size ceiling, and gates both CI and npm publishing.
+
+## [1.0.0-beta.23]
+
+### Added
+
+- Add Kubernetes Agent Sandbox execution with mandatory `kata-qemu` isolation, a pinned TypeScript client, managed idle cleanup, and shared workspace support.
+- Add a Helm chart with GKE Standard, Linux k3s, Colima, and router-only profiles; GKE supports Filestore CSI on an explicitly configured VPC.
+- Publish mikan, the Agent Sandbox runtime, and the pinned router source build to GHCR through a release-aware image workflow.
+- Expose detailed subagent input, output, cache, reasoning, and cost usage while retaining the existing summary aliases.
+
+### Changed
+
+- Replace Gondolin and Firecracker sandbox modes with `agent-sandbox:<warm-pool>`.
+- Make Helm the supported Kubernetes deployment interface; the default and Colima profiles use host execution, while GKE and k3s profiles require Kata and RWX storage.
+- Include delegated subagent usage in parent run statistics and budget accounting.
+
+### Removed
+
+- Remove the standalone `mikan-worker`, remote worker fleet, dial-home gateway, Gondolin runtime, Firecracker executor, worker CI, and worker release binaries. Existing Gondolin deployments must move to the Agent Sandbox Helm deployment; no automatic deployment or state migration is provided.
+
+### Security
+
+- Require Kata rather than silently falling back to runc, restrict the optional router to the configured mikan namespace with a NetworkPolicy, and keep generated PVCs by default on Helm uninstall.
+- Update transitive `js-yaml` to 4.3.0 to address the merge-key chain denial-of-service advisory.
+
+### Tests
+
+- Add Agent Sandbox unit coverage, Helm profile assertions, pinned router image builds, and full GKE validation covering Kata, Filestore RWX, browser recording, aborts, recovery, Slack, and LLM tool execution.
+- Add coverage for detailed subagent usage, compatibility aliases, failure paths, extension results, and parent budget accounting.
+
+## [1.0.0-beta.22]
+
+### Added
+
+- Let subagents opt into a normalized reference snapshot of the active parent conversation with `parentContext`, while keeping fresh isolated context as the default.
+
+### Changed
+
+- Raise default subagent limits from 8 to 100 turns, $0.50 to $10, and 2 to 10 minutes; return concrete budget or timeout reasons.
+- Apply the process-wide subagent concurrency ceiling to both tool- and extension-initiated runs, with cancellation while queued and usage attribution only to the active parent run.
+- Use collision-safe hashed keys for credential authorization and runtime resources. Exact legacy host and shared-container credentials remain readable, but users of ambiguous legacy managed-sandbox keys may need to run `/login` again.
+- Reject unsupported vault file mounts and mounts that overlap workspace or other credential targets.
+- Extract workspace projection and session lifecycle responsibilities into focused modules without intended runtime behavior changes.
+
+### Fixed
+
+- Reject session keys belonging to another conversation and unsafe conversation or thread identifiers.
+- Prevent session pointers and thread files from escaping their owning directory or resolving through symlinks.
+- Process Slack messages posted by known human users through user tokens even when Slack includes the posting app's `bot_id`; bot-authored messages remain ignored.
+- Clearly report subagent budget exhaustion instead of returning a generic incomplete status.
+
+### Tests
+
+- Add Slack E2E coverage for DMs, idle stop, thread isolation, busy queues, images, and multi-file uploads.
+- Add unit coverage for session identity and path safety, collision-safe sandbox identities, vault mount policy, session lifecycle, normalized subagent context, shared slots, cancellation, and budget reporting.
+
+## [1.0.0-beta.21]
+
+### Added
+
+- Fold each subagent's tokens and cost into the parent run's tally (`MikanAgentSession.recordExternalUsage`), so delegated spend counts against the parent run's budget instead of staying invisible to it.
+- Add a process-wide subagent fan-out ceiling shared across conversations.
+- Add `mikan --help` and a generated `mikan env` inventory from the daemon environment manifest.
+- Make the working-directory argument optional, defaulting to `<state-dir>/workspace`.
+- Add a public Gondolin runtime bootstrap seam for embedders.
+
+### Changed
+
+- Subagent runs never reject: request validation failures (unknown tools, invalid budgets, empty tasks, nested runs) now resolve to `failed` results, so one bad request in a `tasks`/`dag` batch can no longer orphan in-flight sibling subagents.
+- Cap parallel `tasks[]` batches at 4 concurrent subagents (the same limit as DAG mode) and run DAG waves through a slot pool instead of chunk barriers.
+- Report a subagent final response with no text as `failed` instead of `completed` with empty output.
+- Enforce parent budgets immediately when subagent usage is folded into the parent run.
+- Apply one state-directory precedence rule across boot, extensions, Sentry, and runtime readers.
+- Refuse model and sandbox settings updates while a conversation is busy, and invalidate affected cached runners consistently.
+- Drive PM2 environment configuration from `~/.mikan/mikan.env` instead of inline secrets.
+
+### Fixed
+
+- Harden Gondolin dial-home reconnects after transport failures and stale sessions.
+- Reject invalid one-shot event timestamps consistently across all event writers.
+- Apply global model settings to idle conversations and report busy conversations as stale.
+
+### Security
+
+- Keep PM2 secrets in an owner-only file outside repository trees and make the PM2 template supervision-only.
+
+### Tests
+
+- Add coverage for subagent accounting and concurrency, CLI and environment manifests, settings mutation, Gondolin reconnects and contracts, event formatting, and worker state layout.
+
+## [1.0.0-beta.20]
+
+### Fixed
+
+- Validate subagent `outputSchema` correctly when it arrives as plain JSON Schema (the only form tool calls can carry), instead of throwing `ValueCheckUnknownTypeError` because it lacks TypeBox's `Kind` metadata.
+
+### Tests
+
+- Add coverage for plain JSON Schema hydration, nested objects, arrays, unions, and validation failures.
+
+## [1.0.0-beta.19]
+
+### Added
+
+- Add fresh in-memory subagents for the main agent and extensions, with explicit tools, budgets, structured output, parallel batches, and bounded DAG orchestration.
+- Stream debounced subagent node progress through the shared Slack, Discord, and Telegram response lifecycle.
+
+### Changed
+
+- Let final responses at the LLM-call cap complete without tripping the run budget when no continuation is required.
+
+### Fixed
+
+- Install worker binaries from the newest GitHub release that contains a matching asset, including prereleases.
+- Restore generic Google Workspace CLI credential mounts in sandbox vaults.
+
+### Tests
+
+- Add coverage for subagent isolation, recursion guards, budgets, structured output, parallel execution, DAG validation and dependency flow, and platform-neutral progress rendering.
+
+## [1.0.0-beta.18]
+
+### Added
+
+- Add an idempotent Debian and Ubuntu worker-host initialization script.
+- Add persistent `mikan-worker` installation as a delegated systemd service.
+- Add NFS export detection with OS-specific setup guidance for `gondolin:remote` workspaces.
+- Ship host-side vault credential files securely to remote workers without placing them in the shared workspace.
+- Add bounded shared-workspace health probes and worker degradation reporting.
+
+### Changed
+
+- Require each Gondolin remote gateway and static worker to declare its shared `workspaceRoot`.
+- Exclude workers with unhealthy shared workspaces from new placements and restore them after a healthy heartbeat.
+
+### Fixed
+
+- Fail remote execution with actionable diagnostics instead of hanging on dead shared-workspace mounts.
+- Create runtime cgroups beneath the worker's delegated cgroup and report missing `Delegate=yes` configuration.
+- Verify downloaded worker binaries against the matching release checksum filename.
+- Validate `gondolin:remote` only after gateway and worker transports are configured.
+
+### Security
+
+- Materialize remote credential files as owner-only, read-only runtime files outside shared workspaces.
+
+### Tests
+
+- Add coverage for worker host services, cgroup delegation, workspace health, credential delivery, NFS advice, remote validation, and idle execution deadlines.
+
+## [1.0.0-beta.17]
+
+### Added
+
+- Add `gondolin:remote` for scheduling sandbox runtimes across a fleet of Linux/KVM workers.
+- Add a standalone `mikan-worker` daemon with mutual TLS, fenced leases, crash recovery, capacity-aware placement, draining, and sticky conversation assignment.
+- Add dial-home worker enrollment through one-time join tokens and a mikan-hosted gateway.
+- Add private workspace projection, vault injection, resource limits, lifecycle reconciliation, and drift recovery to Gondolin runtimes.
+- Add worker installation, enrollment, operations, and remote quickstart documentation with a one-command end-to-end smoke test.
+- Publish `mikan-worker` binaries and checksums with GitHub releases.
+
+### Changed
+
+- Rename the preview sandbox mode from `microvm:default` to `gondolin:default` and the image build command to `npm run gondolin:image:build`.
+
+### Fixed
+
+- Project mounted files correctly into Gondolin guests.
+- Refresh rotated credentials when Gondolin runtimes are recreated.
+
+### Security
+
+- Authenticate remote workers with mutual TLS and fence stale workers through expiring leases.
+- Keep enrollment tokens one-time and store worker credentials privately.
+
+### Tests
+
+- Add coverage for Gondolin lifecycle, workspace isolation, vaults, resource controls, fleet scheduling, gateways, enrollment, workers, leases, and remote execution.
+
+## [1.0.0-beta.16]
+
+### Added
+
+- Add a preview `gondolin:default` sandbox backed by Gondolin and QEMU.
+- Add a curated microVM guest image build with Node.js, Python, uv, Git, ripgrep, fd, jq, SSH, and build tools.
+- Manage one process-local microVM per conversation with idle shutdown and recreation on demand.
+
+### Changed
+
+- Broaden the coverage gate across all source modules.
+
+### Fixed
+
+- Keep top-level Slack file uploads out of threads.
+
+### Tests
+
+- Add coverage for microVM execution and lifecycle, events, logging, disabled vaults, channel storage, and core file and shell tools.
+
+## [1.0.0-beta.15]
+
+### Added
+
+- Add native image generation with automatic upload through the active model provider.
+- Add extension chat commands via `api.registerCommand`: deterministic `/name` dispatch with no model call; built-ins and first registrations win.
+- Add an extension disposal lifecycle (`api.onDispose` or an `activate` return value), run when a harness instance is discarded (`/pi-new`, idle eviction, session rotation).
+- Add `api.triggerRun(text)` to fire an immediate autonomous agent run, `api.uploadFile(path, title)` for proactive file uploads, and an explicit `conversationId` option on `api.notify` for cross-conversation posting.
+- Add `agent_error` and `budget_exceeded` extension hooks so monitoring extensions see failed turns and tripped run budgets.
+- Pass a `RunOrigin` (platform, triggering message id, user identity, attachments) to extension hook events, making `api.react` and per-user extension policy usable.
+- Let `before_agent_start` extensions rewrite the user prompt or block the turn before the model runs; blocked turns leave no trace in the transcript or session store.
+- Let `tool_result` extensions rewrite tool output (content and error flag) before the model and the session store see it, enabling secret redaction and output truncation.
+
+### Changed
+
+- Dispatch `before_agent_start` and `tool_result` hooks with chaining semantics (each handler sees earlier handlers' rewrites; any `block` wins) instead of first-result-wins.
+
+### Fixed
+
+- Dispose cached runners when models switch or environment credentials refresh.
+
+### Tests
+
+- Add coverage for image generation, extension lifecycle and hook rewrites, and runner disposal.
+
+## [1.0.0-beta.14]
+
+### Added
+
+- Add GitHub inline review-thread intake and a `github_review_reply` tool.
+- Add `github_sync`, `github_read`, and `github_issue` tools for repository refresh and issue or pull request operations.
+- Add host-side Cloud Build log retrieval using GCP ADC or Workload Identity Federation.
+- Add a minimal embedder example that runs without portal services.
+
+### Changed
+
+- Update eligible GitHub pull request head branches in place instead of opening duplicate pull requests.
+- Drive platform command registration and routing from a shared command manifest.
+- Use one cross-platform stop grammar, including `/stop` in GitHub conversations.
+- Route sandbox file reads and writes through executors with staged, shell-safe transport.
+- Keep sandbox settings nested through configuration resolution and updates.
+
+### Fixed
+
+- Preserve raw session keys when using Slack's Force Stop button.
+- Spill large bash output into the runtime workspace so sandboxed agents can read it.
+- Keep malformed event files visible in the admin portal for deletion.
+- Unify platform formatting guidance across adapter and conversation contexts.
+
+### Security
+
+- Keep Cloud Build credentials host-side and outside agent sandboxes.
+- Centralize runtime identity and sandbox path sanitization.
+
+### Tests
+
+- Add coverage for GitHub tool operations, review threads, Cloud Build logs, executor file transport, command manifests, runtime embedding, and session serialization.
+
+## [1.0.0-beta.13]
+
+### Added
+
+- Add the `max` thinking level to commands, configuration, and the admin portal.
+- Add quickstart and extension development guides across all supported locales.
+
+### Changed
+
+- Update pi agent dependencies to 0.80.6.
+- Load platform-specific tool packs only for their configured adapters.
+- Improve `github_checks` output and guidance for external CI providers.
+- Synchronize configuration, platform, sandbox, session, skill, event, portal, and deployment documentation across locales.
+
+### Fixed
+
+- Fix broken CLI tables and dead documentation links across locales.
+
+### Security
+
+- Derive ambient shared-vault access from each platform's declared trust model and sandbox topology.
+
+### Tests
+
+- Add coverage for platform tool-pack isolation, external CI checks, and vault trust policy.
+
+## [1.0.0-beta.12]
+
+### Added
+
+- Let `github_checks` fetch the log tail for a failing GitHub Actions job by job ID.
+
+### Changed
+
+- Require GitHub App Actions read permission for job log inspection.
+
+### Fixed
+
+- Treat skipped and neutral GitHub checks separately from failures in check summaries.
+
+### Tests
+
+- Add coverage for job log retrieval and check conclusion classification.
+- Use collision-resistant temporary directories across parallel tests.
+
+## [1.0.0-beta.11]
+
+### Added
+
+- Add a read-only `github_checks` tool for inspecting branch and pull request check runs.
+
+### Changed
+
+- Make `github_pr` idempotent so pushing an existing branch updates its open pull request.
+- Teach the GitHub agent workflow to inspect CI, fix failures, and push updates.
+- Require GitHub App Checks read permission for CI inspection.
+
+### Tests
+
+- Add coverage for GitHub check summaries and existing pull request updates.
+
+## [1.0.0-beta.10]
+
+### Fixed
+
+- Retry cloning a GitHub repository on later triggers when the conversation clone is missing.
+
+### Security
+
+- Stop applying the ambient default shared vault to GitHub conversations while preserving explicit conversation vault grants.
+- Document the platform, shared machine, and personal credential trust boundaries.
+
+### Tests
+
+- Add coverage for GitHub clone retries and platform-gated default vault resolution.
+
+## [1.0.0-beta.9]
+
+### Added
+
+- Clone GitHub repositories into conversation workspaces and check out pull request heads.
+- Add a `github_pr` tool that pushes agent changes from `pi/*` branches and opens pull requests.
+
+### Changed
+
+- Require GitHub App Contents read and write permission for repository automation.
+- Post completed GitHub responses as single comments instead of streaming edits.
+
+### Fixed
+
+- Keep GitHub issue context inside the history recency window.
+
+### Security
+
+- Require commenters to have repository write permission or higher before triggering the agent.
+- Keep installation tokens out of sandboxes and restrict agent pushes to non-force `pi/*` branches.
+
+### Tests
+
+- Add coverage for GitHub repository checkout, permission gating, pull request creation, and branch restrictions.
+
 ## [1.0.0-beta.8]
 
 ### Added