Release notes are the marketing.

nodes seeded by sha256(release tag) · deterministic render · current node pulses ten cycles, then rests

1. v0.72.47 · 2026-09-26

   Sessions with receipts

   August 28 to September 26, 2026 · 48 releases. An interrupted session needs to leave evidence for recovery, and a new session needs to prove which tools it can use. This retrospective follows both paths across v0.72.0 through v0.72.47.

   The daemon now isolates a transient session-shim failure, recovers a failed carrier activation, and retains unpublished interactive workareas for later inspection. Execution preflight can bind capabilities to observed tool artifacts and carry applied evidence in its receipts.

   Local checks also say when evidence is missing: arch assess --require-diff refuses an incomplete PR diff, while named Codex failures retain bounded diagnostics. Pi routes gateway-backed models by their serving host.

   Thanks to Gabriela Kropf for co-authoring the worktree-root fix. The complete comparison has every merged change in this release range.

   rec v0.72.47 ▸ seed sha256:0113…8d4a ▸ release notes ↗

2. v0.52.1 · 2026-07-15

   Interactive-attach viewer test harness

   A viewer and test harness for the interactive-attach path lands, giving the outbound attach client an exercisable end-to-end fixture. No wire change — the versioned attach protocol from v0.52.0 is unchanged.

   rec v0.52.1 ▸ seed sha256:4223…7aba ▸ release notes ↗

3. v0.52.0 · 2026-07-15

   Outbound interactive attach and PTY hosting

   Interactive sessions arrive as a first-class capability: a versioned attach wire, a stateful terminal sanitizer with snapshots, a bounded PTY host, an outbound attach client, and an interactive runner loop. The registry declares Claude Code, Codex, and shell PTY harness modes. All of it stays outbound-only — the OSS daemon gains no inbound listener.

   Fix: PTY children get TERM=xterm-256color and COLORTERM=truecolor deterministically, with per-session overrides authoritative.

   rec v0.52.0 ▸ seed sha256:c14a…5c7d ▸ release notes ↗

4. v0.51.0 · 2026-07-12

   Hard per-session daemon kill

   Heartbeats now apply session.kill by delivering SIGKILL to the daemon-owned worker process group, preserving sibling sessions and reporting applied/failed mutation ACKs on the next heartbeat. Repeated kills are idempotent; unknown session IDs fail closed.

   rec v0.51.0 ▸ seed sha256:464d…135a ▸ release notes ↗

5. v0.50.3 · 2026-07-10

   Explicit project admission

   Daemon config separates the enabled-projects set from repository resources: a project can be admitted before any repo is configured, and multiple repos can belong to one project. Existing configs migrate to the versioned contract, preserving repo credentials and stable project IDs. The intervening patches (v0.50.1, v0.50.2) keep the OSS benchmark repo-agnostic and recover an existing PR URL when gh pr create reports the branch already has one.

   rec v0.50.3 ▸ seed sha256:a0af…b8eb ▸ release notes ↗

6. v0.50.0 · 2026-07-05

   Code-intel MCP delivery (engine v2)

   The code-intelligence engine moves to a Go-authoritative schema v2: real incremental indexing, multi-language PageRank, real-content dedup, native Voyage + Cohere hybrid search, and git-root/--repo-path scoping. A self-referential stdio MCP server, donmai mcp code-intel, exposes six af_code_* tools, delivered by the runner via os.Executable() with an explicit --root and surfaced through a typed work.codeIntel wire block.

   Fix: symlinks resolve in the check-duplicate contentFile confinement.

   rec v0.50.0 ▸ seed sha256:b154…375a ▸ release notes ↗

7. v0.49.4 · 2026-07-02

   Session step-heartbeat

   A best-effort session step-heartbeat emits every 15 seconds using the daemon’s rotating credentials. It closes the stale-detection gap between an alive worker and a wedged run, while construction, delivery, and teardown failures remain non-fatal to the session.

   rec v0.49.4 ▸ seed sha256:c7ae…1483 ▸ release notes ↗

8. v0.49.3 · 2026-07-01

   Host reporting and span wire contract

   Daemon registration reports host IP, OS and version, architecture, CPU, memory, daemon version and start time, plus region; heartbeats carry sampled CPU and memory load.

   A six-kind per-LLM-call span family lands with a sealed-union codec and golden wire fixture. This release defines the span wire contract; emission and ingest remain separate workstreams.

   rec v0.49.3 ▸ seed sha256:13ed…935d ▸ git tag ↗

9. v0.49.2 · 2026-06-22

   Per-session cancellation and idle watchdog

   A resettable 12-minute no-progress watchdog now returns FailureNoProgress when a run stops producing agent events, while non-result work bypasses commit and pull-request steering.

   The daemon gains deterministic per-session cancellation through a local stop route and the lock-refresh wire. Cancellation frees the worker slot atomically, reports FailureOperatorCancelled, and prevents blind redispatch.

   rec v0.49.2 ▸ seed sha256:3371…2a2d ▸ release notes ↗

10. v0.49.1 · 2026-06-22

    Live session prompt routing

    The shared session-prompt and agent-chat command now uses the live public prompt endpoint, keyed by the public session ID, with a friendly not-found error instead of accepting a non-JSON login response.

    rec v0.49.1 ▸ seed sha256:0dde…6e5d ▸ release notes ↗

11. v0.49.0 · 2026-06-19

    Git credential-hardening seam

    An inert-by-default git credential-hardening seam lands in gitexec.

    rec v0.49.0 ▸ seed sha256:df56…dd62 ▸ release notes ↗

12. v0.48.0 · 2026-06-18

    FD-4 registration capabilities

    Registration capabilities serialize over the wire, and the landing serializer is hardened against git hangs.

    rec v0.48.0 ▸ seed sha256:5557…2905 ▸ release notes ↗

13. v0.47.0 · 2026-06-17

    Per-session merge-queue capability

    The daemon derives a per-session merge-queue capability from a coordinator flag.

    rec v0.47.0 ▸ seed sha256:c760…a697 ▸ release notes ↗

14. v0.46.0 · 2026-06-17

    Agent-card tool and skill threading

    The runner threads agent-card allowedTools, mcpServers, and skills through QueuedWork to providers (WS5).

    rec v0.46.0 ▸ seed sha256:45f0…fa51 ▸ release notes ↗

15. v0.45.0 · 2026-06-17

    FD-4 landing-work poll lane

    The FD-4 landingWork[] poll lane comes online across v0.43.0, v0.44.0, and v0.45.0: the worker decodes the lane, the daemon adds additive landing hooks (capabilities, landing-run routing, result bubble-up), and decoded landing work routes to OnWork. All additive — existing poll behavior is unchanged.

    rec v0.45.0 ▸ seed sha256:4e9f…71e7 ▸ release notes ↗

16. v0.42.0 · 2026-06-16

    Harness-native provider selection

    The runner gains additive, backward-compatible harness-native provider selection.

    rec v0.42.0 ▸ seed sha256:e0ac…13b1 ▸ release notes ↗

17. v0.41.0 · 2026-06-15

    Turn-result manifest

    The runner emits a deterministic per-turn outcome manifest (W3).

    rec v0.41.0 ▸ seed sha256:534d…d6bd ▸ release notes ↗

18. v0.40.0 · 2026-06-14

    Host-watch fleet dashboard and vendor kit trust root

    The local-stream fleet dashboard engine is restored and generalized as hostwatch: the daemon now streams live worker-fleet state over a local SSE channel, reviving the in-process fleet monitor with a first-class SessionHandle abstraction that enriches daemon session records with structured lifecycle events.

    Kit trust gains a vendor trust root and a default issuerSet for official signed kits, so the daemon ships a sensible out-of-the-box allowlist for vendor-signed kits without requiring operators to configure one from scratch.

    rec v0.40.0 ▸ seed sha256:39bc…3bea ▸ release notes ↗

19. v0.39.0 · 2026-06-11

    Kit installs default to signed-by-allowlist

    Breaking:the daemon’s kit trust gate no longer defaults to permissive. With no trust block in daemon.yaml, only kits whose signature verifies and whose signer appears in trust.issuerSet install; unsigned or unverified kits are rejected with a remediation message. An empty allowlist fail-closes installs rather than silently accepting any signed kit.

    Operators who knowingly accept the risk can opt out per install with donmai kit install --allow-unsigned (audit-logged) or globally with trust.mode: permissive / DONMAI_KIT_TRUST_MODE=permissive. SAN-only allowlist entries now match correctly, and a verifier-construction failure stays fail-closed instead of downgrading to permissive.

    rec v0.39.0 ▸ seed sha256:c14c…3193 ▸ release notes ↗

20. v0.38.2 · 2026-06-10

    Maintenance patch

    Maintenance patch release; commit-level changelog on GitHub.

    rec v0.38.2 ▸ seed sha256:c5f5…c54e ▸ release notes ↗

21. v0.38.1 · 2026-06-10

    Codex and Antigravity stream fixes

    Codex reasoning output is whitelisted into thought events with item/completed gating, Antigravity result envelopes are suppressed from the assistant text stream, and TUI activity-line clipping is rune-safe.

    rec v0.38.1 ▸ seed sha256:2b72…959f ▸ release notes ↗

22. v0.38.0 · 2026-06-08

    Native architectural drift gate

    donmai arch assess now fetches the PR diff via gh and runs the native diff-reader and drift gate on real PR content; no external binary, npm package, or service required. The legacy exec-shim is demoted to an opt-in, deprecation-warned DONMAI_ARCH_BIN fallback.

    Learned, per-repository baseline analysis remains a hosted-platform capability outside the OSS distribution.

    rec v0.38.0 ▸ seed sha256:2d0d…2148 ▸ release notes ↗

23. v0.37.0 · 2026-06-08

    Daemon registration fix

    The daemon rejects a stale stub JWT cache when configured for real registration, so a cached stub entry can no longer survive a restart and silently stop polling for work while still reporting ready.

    rec v0.37.0 ▸ seed sha256:c601…e535 ▸ release notes ↗

24. v0.36.0 · 2026-06-07

    Drift assessment on the one-shot lane

    Architectural-intelligence drift assessment now runs through the shared one-shot completion lane (agent.Complete with a drift-verdict schema) instead of a direct provider SDK.

    rec v0.36.0 ▸ seed sha256:1161…b787 ▸ release notes ↗

25. v0.35.0 · 2026-06-07

    KG extraction on the one-shot lane

    Knowledge-graph extraction runs its constrained emit through agent.SpawnComplete instead of a hand-rolled spawn-and-drain loop. Behavior preserved; net code deletion.

    rec v0.35.0 ▸ seed sha256:c657…6aae ▸ release notes ↗

26. v0.34.0 · 2026-06-07

    Strict structured output

    agent.Complete resolves the right completion strategy per harness: native-JSON harnesses (Gemini, Ollama) get strict server-side structured output via the new Spec.ResponseSchema; every other harness rides the soft validate-repair-drop lane.

    rec v0.34.0 ▸ seed sha256:34d0…f589 ▸ release notes ↗

27. v0.33.0 · 2026-06-07

    One-shot completion lane

    New schema-constrained, non-interactive completion primitive: OneShotProvider and SpawnComplete give every harness a soft-JSON lane with fail-closed JSON-Schema validation and context-aware draining.

    rec v0.33.0 ▸ seed sha256:b223…71e7 ▸ release notes ↗

28. v0.32.0 · 2026-06-07

    Model-access gate plumbing

    Daemon plumbing for the fail-closed per-machine model-access gate: a policy-only config block, daemon mutation cases, and gate inputs surfaced to OnPreSpawn. Pure plumbing; no enforcement yet.

    rec v0.32.0 ▸ seed sha256:611d…130c ▸ release notes ↗

29. v0.31.0 · 2026-06-07

    Narrow-only access enforcement

    runner/access.ResolveMachineCell intersects a per-machine access config against a closed allow ceiling: intersection-only and fail-closed, it can only restrict, never grant. Verified by 4,000-vector adversarial property tests.

    rec v0.31.0 ▸ seed sha256:485f…f452 ▸ release notes ↗

30. v0.30.0 · 2026-06-06

    provider/harness package split

    Splits the fused provider packages into provider/harness/* and extracts a shared CLI-JSONL driver (Claude and Amp). Pure code organization: zero behavior change, byte-identical capability matrix.

    rec v0.30.0 ▸ seed sha256:cc31…4ac4 ▸ release notes ↗

31. v0.29.0 · 2026-06-06

    Public provider-registry builder

    Exports BuildAgentRunRegistry so embedders build the eight-provider agent-run registry directly instead of forking the previously unexported builder.

    rec v0.29.0 ▸ seed sha256:77ad…a4c9 ▸ release notes ↗

32. v0.28.0 · 2026-06-06

    Two-axis provider contract

    Phase 1 of the two-axis provider architecture: HarnessProvider and company-named ModelEndpointProvider families, per-provider manifests, and a generated capability matrix behind a CI parity gate. Purely additive.

    rec v0.28.0 ▸ seed sha256:cca9…092f ▸ release notes ↗

33. v0.27.1 · 2026-06-06

    JWT cache persistence fix

    The daemon persists a refreshed runtime token to the on-disk JWT cache, so readers of the on-disk token no longer present a stale credential after a refresh.

    rec v0.27.1 ▸ seed sha256:2085…9586 ▸ release notes ↗

34. v0.27.0 · 2026-06-05

    Final wire debrand

    The Codex JSON-RPC handshake now identifies as donmai, and the governor queue migrates to a donmai-prefixed Redis key (legacy key kept as fallback during the transition).

    rec v0.27.0 ▸ seed sha256:345c…fca8 ▸ release notes ↗

35. v0.26.0 · 2026-06-05

    Code intelligence fully native

    Pure-Go Python and Rust extractors, Okapi BM25 search-code, SimHash check-duplicate, find-type-usages, validate-cross-deps, and Merkle-tree incremental diffing: donmai code * no longer needs an external binary.

    donmai arch assess gains a native diff/gate path and no longer hard-fails when the backend binary is absent.

    rec v0.26.0 ▸ seed sha256:b929…3c56 ▸ release notes ↗

36. v0.25.0 · 2026-06-05

    Shared-spawner allowlist union

    A shared daemon process serving several organizations can allowlist the union of base and satellite project sets, and the union survives config reloads race-free. Additive only.

    rec v0.25.0 ▸ seed sha256:ba1d…83cd ▸ release notes ↗

37. v0.24.0 · 2026-06-05

    Multi-org embedding support

    Exports six daemon/poll symbols so an embedder can drive several per-org poll and registration identities in one process. Additive public API only; no behavior change.

    rec v0.24.0 ▸ seed sha256:9698…f758 ▸ release notes ↗

38. v0.23.0 · 2026-06-05

    Native code intelligence

    donmai code get-repo-map and search-symbols now run a native Go implementation with byte-compatible indexes, so existing .donmai/code-index/ data interoperates. The external shim remains as a fallback behind DONMAI_CODE_BIN.

    rec v0.23.0 ▸ seed sha256:2b09…f48f ▸ release notes ↗

39. v0.22.0 · 2026-06-05

    CLI readiness and debrand sweep

    Hard failures now name the fix (not logged in, daemon down, no credentials) and show the correct binary name. A 181-change debrand sweep moves config to ~/.config/donmai and removes legacy env aliases.

    New GET /api/daemon/agents control-API routes; linear check-deployment is reimplemented natively in Go.

    rec v0.22.0 ▸ seed sha256:c23f…9678 ▸ release notes ↗

40. v0.21.0 · 2026-06-05

    Multi-scope enablers

    SessionSpec.ProjectName, multi-project worker registration, and a Daemon.Spawner() accessor for embedders. Fixes: the worker binary lookup tries donmai before the legacy name, and status posts include failure mode and summary.

    rec v0.21.0 ▸ seed sha256:220c…adc8 ▸ release notes ↗

41. v0.20.0 · 2026-06-04

    Codex token-burn fix + structural blocked outcome

    Codex sessions deliver the volatile agent-memory block once via the first turn instead of on every internal turn, saving roughly 20k–150k input tokens per session. A structural blocked outcome surfaces a reasoned decline distinctly instead of as a crash, and prompt templates become brand-injectable.

    rec v0.20.0 ▸ seed sha256:f838…8c96 ▸ release notes ↗

42. v0.19.1 · 2026-06-03

    Codex stream fix

    Drops streaming text/reasoning deltas from Codex sessions, stopping one-token-per-line activity spam; full message text still flows on completion. No wire-protocol change.

    rec v0.19.1 ▸ seed sha256:96ed…f94c ▸ release notes ↗

43. v0.19.0 · 2026-06-03

    Remove gemini-cli provider

    Removes the gemini-cliprovider ahead of the upstream CLI's end of life, fully superseded by the Antigravity provider added in v0.18.0. The API-direct gemini provider is unaffected.

    rec v0.19.0 ▸ seed sha256:fb46…92c3 ▸ release notes ↗

44. v0.18.0 · 2026-06-03

    Antigravity provider

    New agy-cli provider wraps the Antigravity CLI (pty, plain text, best-effort transcript enrichment) for local, subscription-based dispatch: OAuth host session, no key injected.

    rec v0.18.0 ▸ seed sha256:7745…9e80 ▸ release notes ↗

45. v0.17.0 · 2026-06-03

    Credential-injection wire

    Fail-closed OnPreSpawn credential injection with pool forwarding, Gemini provider refinements, a non-interactive knowledge-graph extraction batch handler, and an injectable host-state directory seam.

    rec v0.17.0 ▸ seed sha256:aba6…0702 ▸ release notes ↗

46. v0.16.1 · 2026-06-03

    Codex MCP config fix

    Fixes Codex mcpServersConfig (eliminates args:null, adds HTTP-transport support) and clears CI lint failures.

    rec v0.16.1 ▸ seed sha256:d7b8…4570 ▸ release notes ↗

47. v0.16.0 · 2026-06-02

    Interactive interview runtime

    Non-terminating park-and-inject interview run loop: user and memory injection turns, a two-second heartbeat, batched token-delta streaming, a hardened interview persona, and wall-clock plus idle-grace budgets.

    rec v0.16.0 ▸ seed sha256:b5af…5531 ▸ release notes ↗

48. v0.15.0 · 2026-06-02

    Native Gemini provider

    First-class native Gemini provider.

    rec v0.15.0 ▸ seed sha256:4ea9…3269 ▸ release notes ↗

49. v0.14.0 · 2026-06-02

    Brand-neutral runtime contract

    Drops legacy branded environment variables, endpoints, and paths from the OSS runtime contract, plus wire plumbing for the interactive interview run-mode.

    rec v0.14.0 ▸ seed sha256:dee5…c18b ▸ release notes ↗

50. v0.13.0 · 2026-06-02

    Per-project gated memory inject

    Per-project memory injection is gated upstream only; the MEMORY_INJECT_ENABLED environment gate is removed.

    rec v0.13.0 ▸ seed sha256:2f0b…f93e ▸ release notes ↗

51. v0.12.0 · 2026-06-02

    Agent-memory runtime inject

    Agent memory is injected at runtime and folded at dispatch time; the worker image is renamed donmai-worker.

    rec v0.12.0 ▸ seed sha256:d1db…c1f9 ▸ release notes ↗

52. v0.11.0 · 2026-06-01

    Code-survival scan work-type

    The worker can run a non-agent code-survival scan (git-blame survival plus Go and TypeScript reachability, hot-weighted) in the capacity pool, isolated from the agent-session path.

    rec v0.11.0 ▸ seed sha256:51ac…e940 ▸ release notes ↗

53. v0.10.0 · 2026-05-30

    Maintenance release

    Commit-level changelog on GitHub.

    rec v0.10.0 ▸ seed sha256:74e8…4095 ▸ release notes ↗

54. v0.9.5 · 2026-05-28

    Config-dir rename + machine tokens

    The config directory moves from .agentfactory/ to .donmai/, machine tokens are minted and stored at ~/.donmai/token, and the README rename sweep completes.

    rec v0.9.5 ▸ seed sha256:57b6…991a ▸ release notes ↗

55. v0.9.4 · 2026-05-27

    Tool-restriction wiring fix

    disallowedTools is wired through the poll → session → queued-work pipeline, so per-work-type tool restrictions are honored end-to-end instead of silently no-opping.

    rec v0.9.4 ▸ seed sha256:3f53…e320 ▸ release notes ↗

56. v0.9.3 · 2026-05-27

    System-prompt override fix

    systemPromptOverride is wired through poll → detail → queued work, mirroring the tool-restriction path.

    rec v0.9.3 ▸ seed sha256:528e…0875 ▸ release notes ↗

57. v0.9.2 · 2026-05-26

    Runner tool restrictions

    The runner consumes QueuedWork.DisallowedTools and surfaces a useful error on a non-JSON session-prompt response.

    rec v0.9.2 ▸ seed sha256:1798…4e47 ▸ release notes ↗

58. v0.9.1 · 2026-05-26

    Fail-loud auth fix

    Posting a result with an empty bearer token now fails loudly instead of sending an unauthenticated request.

    rec v0.9.1 ▸ seed sha256:75e7…7447 ▸ release notes ↗

59. v0.9.0 · 2026-05-24

    OSS rename from AgentFactory to Donmai

    The project formerly known as AgentFactory has been renamed to Donmai. The binary command is now donmai and the Homebrew formula is brew install donmai.

    All npm packages have moved to the @donmai/* scope. Configuration paths have moved to ~/.donmai/. The runtime behaviour is unchanged. This release is a naming and distribution cutover only.

    Migration guide: Install docs →

    (today: brew install RenseiAI/homebrew-tap/donmai)

    rec v0.9.0 ▸ seed sha256:8041…9e15 ▸ release notes ↗