Changelog

The first stable release. Every provider turn now runs under processes and permissions the worker owns: OpenCode edits are allowed only when the policy says so, one session can no longer approve another’s request, and cancelled or closed providers are cleaned up. From here on, breaking changes to the public contract require a new major version.

Breaking

• Stop old Codex and Claude live workers and recycle their brokers before upgrading. Live runtimes are scoped per project, so independent projects can reuse runtime IDs; new workers do not adopt legacy processes, and live attach --unscoped reaches old ones.
• Codex live and Codex ACP reject --codex-ignore-user-config instead of silently ignoring it. Use the Codex exec adapter for that isolation.
• Restart OpenCode live workers to get policy enforcement. Each worker now owns its native server; attach with the opencode attach command it reports.

Security

• OpenCode live resets its own instance before every turn, installs restrictive rules that preserve native denies, and reads them back before prompting. Edits are allowed only in acceptEdits, and earlier “always” approvals do not carry over.
• OpenCode permission prompts are answered only for the session that owns them.
• Orchestrator-grant approvals honor their expiry; an expired grant needs a fresh human approval.

Fixed

• Cancelled or closed providers are terminated, including their child processes, instead of overrunning their deadline.
• Malformed agent follow-up actions are rejected instead of half-executed.
• Expired deliveries wait out their retry backoff.
• The TUI stays within the terminal on tiny resizes.
• Replacing an incompatible daemon no longer fails with SQLITE_BUSY.

There is no new schema migration since v0.8.2. The release targets trusted self-hosted teams, not mutually untrusted tenants. For OpenCode live, use the full opencode attach TUI (not --mini), leave --session-id unset, and expect about ten seconds of preparation per turn. Windows Authenticode and Apple notarization are deferred.

Messages and every other project record now carry real timestamps from their signed history, and lists show the newest first, so a recent message can no longer hide behind how its ID sorts. The landing site and docs are refreshed.

Breaking

• Lists are ordered by recent activity, not by ID. message inbox shows the newest posted message first and applies --limit after ordering; scripts should read the new JSON order array instead of assuming ID order.
• Existing projects need a one-time project upgrade (personal mode, after its usual backup), and shared servers need agent-comms-server migrate apply --yes --allow-disruptive. Both replay verified signed history to backfill timestamps; unverifiable history fails rather than guessing, and a shared server will not start until the migration has run.

Added

• created_at and updated_at on messages, tasks, agents, approvals, documents, runtimes, invocations and more, in CLI tables, show, JSON, MCP and the TUI.
• JSON list envelopes include an order array; the new MCP message_inbox tool returns the same order in _meta.order.

Fixed

• The overview reads “1 open task”, not “1 open tasks”.
• Daemon replacement on Windows no longer fails with SQLITE_BUSY.
• Prerelease toolkit versions compare correctly.
• The landing site’s live control room no longer scatters its rows.

Lists remain unpaginated full-state reads, and draft listing has no continuation cursor. Interactive PTY delivery still uses echo heuristics; custom provider identities, hosted project joining, and worker supervision remain deferred.

The terminal control room keeps its panes within the screen, separates inbox messages from runtime presence, and offers bounded repairs for routine health findings. Windows shutdown reliability and the landing site’s dependencies are hardened.

Breaking

• config theme and the TUI theme toggle are removed. The single palette uses the terminal’s background; older theme values are tolerated and ignored.

Added

• doctor --fix repairs fixable project-lifecycle findings and recovers an unavailable local daemon. Confirmation-required or judgment-based repairs remain explicit actions.

Changed

• TUI tables, inspectors, and scrolling views fit the terminal, with aligned sidebar key hints, the complete project ID, and separate messaging and runtime-presence surfaces.
• Source-build instructions now set development version metadata and explain PowerShell builds and the optional agc shim.

Fixed

• Principal display names resolve consistently and ambiguous names are refused.
• Doctor reports blocked or incomplete repairs truthfully after rechecking.
• A local go-winio patch corrects a confirmed Windows named-pipe shutdown deadlock, with deterministic dependency and native shutdown/rebind tests.
• Daemon and delivery test fixtures now preserve logs and handle coordinator reservation races. CI exposes coverage-test failures and includes Windows browser visual baselines.

Security

• Updated Next.js to 16.3.8 to address the reported advisory.

The historical Windows failure where a daemon never creates its named pipe remains under investigation. Interactive PTY delivery still uses echo heuristics; custom provider identities, hosted project joining, and worker supervision remain deferred.

Agents now say which runtime they are. An agent’s ID names its provider — claude, claude-2, codex-reviewer — with a free-form display name you can address them by, and registering one no longer requires inventing an ID. Alongside that: team mode against a shared authority actually works now, drafts can finally be deleted, and approvals honour the expiry they were given.

Breaking

• A new AGENT principal’s ID must name its provider: <provider> or <provider>-<suffix>, lower case, from claude, codex, opencode. Existing principals are unaffected and nothing renames; HUMAN principals keep free-form IDs. The accepted set is fixed at build time; a declarative adapter does not extend it.
• Action-scoped takeover and shared-write approvals now honour a stated expiry, so a lapsed approval that previously still authorized work is refused.

Added

• agent register --provider <name> derives the actor ID, so --id is optional: the first agent of a provider is claude, the next claude-2.
• A principal can be addressed by display name anywhere an actor ID is accepted. Resolution prefers the actor ID and refuses an ambiguous display name rather than guessing; the signed event always records the actor ID.
• draft delete --id removes one local draft and releases the count and storage quota it held. Drafts do not expire, so this is the only way back under a reached cap.

Fixed

• Team mode did not work through the CLI at all: daemon serve never passed the authority token to the daemon it spawned, so every command in a service-mode project failed with 401 authority token is required.
• docker compose up --build, the documented way to stand up a team authority, could not build the image.
• A slow but healthy local daemon is no longer rejected by a 300 ms health probe; startup failures now report the last probe error and elapsed wait.
• approval request --expires-in with a negative value silently produced an approval that never expires.

Security

• .env is git-ignored. compose.yaml requires three secrets, one of them the authority’s signing key.
• Updated the transitive devalue dependency off a denial-of-service advisory.

A follow-up patch to a real bug found the day after 0.7.0 shipped: a stray, non-project directory got mistaken for a real one and crashed update apply. This closes the whole class of it — every session cache now knows to stay out of directories it doesn’t own, and a command run in the wrong place says so plainly instead of leaking a filesystem error — plus two more redundant command names found along the way.

Breaking

• Live-serve session tracking (Claude, Codex, OpenCode) and runtime session bindings no longer write into a project directory at all; all four now share one hashed cache location under the shared config directory.
• update check and update apply are now one command, update, which checks first and then prompts to install.
• project upgrade status is removed; it was byte-for-byte the same code as project upgrade plan.

Fixed

• A command run outside any Agent Comms project (e.g. task list in an empty directory) now fails immediately with a clear NOT_A_PROJECT error and a next step, instead of a raw filesystem error with a misleading hint.

A coherence pass across the whole CLI: live tail’s ad-hoc file-watching is gone in favor of the one supported way to watch a live session, message and document acknowledgment gain a proper retry and read path, and a broad UX audit closes gaps in how the CLI explains its own state — registration, approvals, inbox, and installation all say more than they used to.

Added

• document notify retries a stuck document acknowledgement without duplicating one already sent; message show reads a message’s subject and body directly.
• agc, a short alias for agent-comms, installed alongside the main binary.

Breaking

• Removed agent-comms live tail; live attach --provider claude|codex is the one supported way to watch a live agent session now.
• The managed bootstrap marker file renamed .agents -> .agentcomms; existing projects migrate automatically.
• Removed the session and decision command groups; CLI surface consolidated per RFC 0027.

Fixed

• approval show, message inbox, agent register/status all surface state and context by default that used to be hidden behind --details or missing entirely.
• Empty task list/message inbox/invocation list now distinguish “nothing exists yet” from “your filter matched nothing.”
• TUI document-update edits no longer silently corrupt untouched fields, or misapply keyboard input in the command palette.

A governance and transport-security pass: approvals now bind to the exact operation and expiry a reviewer saw, standalone installers verify against a digest pinned in the release tag instead of mutable release assets, and the shared authority service gets an application-level access token — plus two approval-reuse gaps closed in orchestrator grants and task takeovers.

Security

• Breaking: approvals for contract publication and approval-gated invocations now carry a SHA-256 subject digest and an expiry; existing action-only approvals no longer authorize these operations and must be renewed. See RFC 0025.
• Breaking: production agent-comms-server startup now requires AGENT_COMMS_AUTHORITY_TOKEN, alongside existing TLS and signing-key requirements. See RFC 0026.
• Breaking: standalone installers now require an exact release version, authenticate the downloaded verifier against six platform digests committed in that protected tag, and bind Sigstore verification to the exact requested tag. A separately installed Cosign binary is still not required. See RFC 0025.
• Orchestrator-grant and task-takeover approvals are now ID-scoped and single-use: a matching approval is consumed once used and can no longer be replayed to re-authorize the same grant or takeover indefinitely. See RFC 0023 and RFC 0024.
• Authority SSE streams now use a dedicated bounded connection pool so long-lived stream holders can no longer exhaust health-check or mutation capacity. See RFC 0025.
• Fixes two high-severity CVEs: google.golang.org/grpc (HTTP/2 DATA-frame-fragmentation heap exhaustion) and fast-uri (SSRF/host-confusion via percent-decoding and IDN canonicalization).

Every command’s default human output changes from a raw JSON dump to a readable summary — semantic status, tables, and next-action hints, while --json stays byte-compatible — plus permanent, elevated-key-gated project deletion.

Added

• Breaking: a new --output human|plain|json|jsonl contract replaces printing raw backend JSON to a human terminal by default. human (the interactive default) renders concise summaries, status, and responsive tables; plain is the stable uncolored fallback for redirected/non-interactive output; json keeps the existing versioned Envelope unchanged (--json remains a supported alias); jsonl is a new, versioned one-record-per-line contract for naturally streaming commands (watch, invocation listen), rejected for bounded commands. Human output is intentionally not byte-compatible across versions; scripts that parse text should use plain or --json. See RFC 0022.
• Breaking: agent-comms project delete / the TUI’s Danger Zone form permanently deletes a project — its local runtime always, and its entire remote row set on the shared authority in service mode too. OWNER-only, requires a registered elevated key with no fallback, and is verified independently both locally and server-side. No --yes, no piped-passphrase flag, and refuses outright under --non-interactive or from MCP. No automatic backup; this is unrecoverable by design. See RFC 0020.

Identity resolution can no longer silently misattribute a signed action to the wrong actor — closing a real incident end to end — plus self-service role switching with freeform custom labels, ConPTY-backed interactive-serve on Windows, cosign-free release verification, and a deep TUI interaction audit.

Security

• Breaking: a governed write resolved through the legacy, machine-wide default-actor fallback is now refused outright whenever a project has two or more locally-registered identities to choose between, instead of silently signing under whichever one happens to be active — the exact mechanism behind a real, confirmed incident where one agent’s action was signed under a different agent’s identity. See RFC 0017.
• A provider session (Claude Code, Codex) now resolves its own isolated default actor, instead of inheriting the one shared, machine-wide default every concurrent session and script on the account used to read and write. See RFC 0016.
• Self-registering from a session-less caller no longer claims the shared legacy default-actor slot for every other session-less process on the account.
• The project owner’s role can no longer be changed through any path at all, self-service or administrative — mirroring the existing, absolute protection agent suspend/agent revoke already give the owner.

Added

• Breaking: self-service role switching (agent switch-role / agent_switch_role) — any active principal can relabel its own role at any time, to ORCHESTRATOR or any freeform custom label, with no owner/orchestrator elevation required. Switching to ORCHESTRATOR keeps the full existing human-approval-plus-elevated-key gate. The AGENT/OBSERVER roles are removed. See RFC 0018.
• interactive-serve and --takeover-pid now work on Windows, built on ConPTY in place of creack/pty, a named pipe in place of a unix domain socket, and TerminateProcess in place of POSIX signals. See RFC 0014.
• install.sh/install.ps1 and agent-comms update no longer require a separately installed cosign CLI to verify a release — a new companion binary, agent-comms-verify, performs the identical check with no external process. See RFC 0015.
• The TUI’s command palette now has real mouse support, matching every other surface in the app.
• A new “change role” action in the TUI lets an owner/orchestrator change an already-active agent’s role.

Fixed

• The TUI now resolves ambiguous legacy actors to the project owner instead of refusing outright — the human operating the TUI is never blocked by RFC 0017’s own refusal.
• A deep TUI interaction audit found and fixed seven distinct defects in the command palette, keybindings, and focus indication: the palette could leak keystrokes into whatever row list it was opened over, the spacebar could never be typed into it, its displayed “top match” and what Enter actually ran could silently disagree, it had no mouse support at all, clicking away from an open palette navigated underneath it without closing it, the “change role” action collided with the global refresh keybinding, and there was no visual indicator that a hub tab was actively focused versus merely selected.
• runtime verify-adapter now checks a provider’s subcommand --help output too, not just its top-level one.
• Unknown-flag errors now produce output on every platform instead of failing silently.
• install.ps1’s cosign verification path is fixed.

A TUI you can drive with a mouse from a real-sized terminal, session-pinned interactive delivery that survives a restart, a declarative path for adding new CLI providers without touching Go, and a public marketing/docs site.

Added

• Full native mouse support across the TUI — click, scroll, sidebar and hub-tab navigation, double-click-to-act, and Project settings (the one view that was missing it) — plus dynamic responsive layout, so the TUI no longer requires a desktop-sized terminal.
• --takeover-pid safely migrates a live interactive session, and every migrated/resumed session now pins its exact provider session ID (auto-discovered for claude and opencode) instead of racing each provider CLI’s own “most recent session” guess.
• A declarative JSON adapter specification system: add a new CLI provider by dropping a spec file under .agent-comms/adapters/, no Go changes required.
• runtime.delete, task lock, runtime verify-adapter, and human-readable table output by default for agent/runtime/invocation list commands.
• A public marketing site and docs site.

Fixed

• A long tail of TUI correctness fixes found by making the interface work at real terminal sizes, including two real ANSI/text-wrapping corruption bugs (a truncated escape sequence leaking onto screen; a bordered box that could render wider than the terminal and split its own border mid-line).
• interactive-serve --takeover-pid now refuses outright if the calling process is itself a descendant of the target PID, instead of silently killing its own controlling terminal.
• Stale interactive-serve sockets are cleaned up automatically on startup.

Security

• Removed the agy (Google Antigravity) worker adapter and every agy-specific integration point, over a genuinely unresolved third-party Terms of Service compliance question. This never reached a tagged release, so there is nothing for an existing install to migrate away from. Full research record in the repository’s docs/backlog.md.

A hotfix restoring the Cosign-signed installer bundles that v0.2.0’s CLI release was missing, so install.sh/install.ps1 work again.

Fixed

• The published release was missing the Cosign .bundle file for every primary CLI binary (agent-comms-{os}-{arch}[.exe]) — install.sh and install.ps1 both require that exact file and fail closed without it, so a fresh install of v0.2.0’s CLI never worked. The daemon and server binaries were unaffected (their release-asset wildcards happened to sweep the bundle in); Cosign was already signing the CLI bundles too, they simply were never attached to the release.

A managed-lifecycle and security-hardening release: safer credential handling, a distinct human-approval gate on orchestrator grants, and a truthful interactive-delivery model.

Added

• One-command project upgrades (agent-comms project upgrade) reconcile schema, binary, and daemon state automatically, with automatic backups and full post-upgrade verification.
• Breaking: granting the ORCHESTRATOR role now requires a separate, explicitly human-approved decision — closes a self-escalation gap where an unregistered agent operating over the ambient owner-fallback identity could grant itself the role unattended.
• A passphrase-protected elevated signing key (agent-comms agent elevate-key) now gates the most sensitive actions: granting ORCHESTRATOR, approving a HUMAN-tier approval, revoking another orchestrator or human principal, and deleting a revoked principal.
• Agent identities can be deleted and safely reused; every signed event now carries its signer’s key fingerprint, so a reused ID’s occupants stay distinguishable.
• Interactive delivery is a real, auditable state machine — no connector can falsely report a message as delivered.
• The TUI is a full control center: write actions on every panel, new Artifacts/Drafts/Environment panels, a typo-proof picker for enum fields, and a redesigned Runtimes and delivery-pipeline view.

Fixed

• A duplicate agent register call could silently destroy an existing agent’s credential with no recovery path — now rejected before any credential is generated.
• MCP’s agent_register tool could register or squat an unrelated agent identity — now enforces its documented self-registration invariant.
• Assorted authorization and Postgres reliability fixes.

First tagged release: terminal-native, signed coordination between humans and agents — typed messages, protected work leases, approvals, artifacts, living documents — backed by either a zero-setup local SQLite authority or a shared PostgreSQL team authority, and operated through a full console TUI or a deterministic JSON CLI/MCP surface.

Added

• Terminal-native coordination with signed events, protected work leases, typed messages, approvals, artifacts, living documents, a deterministic JSON CLI, and MCP tools.
• Zero-setup SQLite personal authority with an on-demand per-project daemon.
• PostgreSQL team authority, local caching, resumable streams, and server-signed receipts.
• Operator-console TUI organized around Command, Work, Team, Relay, and Project hubs.
• Visible agent lifecycle controls, runtime management, invocation policies, and a searchable command palette.
• Governed project settings for lease, retention, review, summary, and artifact policy.

Changed

• Automatically replace incompatible local daemons through protocol negotiation.
• Keep .agent-comms/ out of the host repository’s normal Git status.
• Make arrow-key navigation, focus modes, action availability, and signed-change review explicit in the TUI.
• Recover cache gaps, daemon restarts, and lost mutation responses with the original idempotency key and signed command.

Security

• Initialization refuses an existing .agents and publishes a complete runtime atomically.
• Governed mutations revalidate authorization, leases, scopes, and conflicts inside the authoritative transaction.