chore(main): release 0.3.1

[rigelbuild-compass-ci]

🤖 I have created a release beep boop

0.3.1 (2026-10-15)

Features

• agent-image: authenticate git and jj-vine with the materialized gh token (RIG-4724) (#2009) (7b05922)
• agent-image: ship jj and jj-vine in the agent image (RIG-4723) (#1800) (47e37c7)
• agent: batch inbound items in an idle window behind COMPASS_AGENT_BATCHING (RIG-5070) (#2084) (a684695)
• agent: port portable operating guidance and survival kernel (RIG-3903) (#1491) (9ec4eb5)
• agent: range-encode ControlAck applied_above (RIG-1466) (#1813) (403f672)
• agent: Reload continues the session transcript under the new config (RIG-4418) (#1704) (5af811b)
• agent: report runner enrollment in agent status (RIG-3343) (#1594) (1d63b7e)
• agent: route start_now to end the idle batching window (RIG-5073) (#2099) (ae7a74c)
• agent: upload inline-image blobs from committed session lines (RIG-1582) (#1998) (9ecd75f)
• api: expose issue search RPC (RIG-4278) (#1540) (2b8034c)
• appconfig: add the no-config signal, URL normalizer, and app.toml writer (#1740) (092d7c6)
• auth: mint and verify per-agent gateway tokens (RIG-2864) (#1752) (aa3b206)
• auth: verify Kubernetes projected tokens for Runners (RIG-4998) (#2057) (7bc5d53)
• auto-link issue and PR refs via GetRefLinkRules (RIG-5178) (#2192) (39bf0ac)
• board: agent board RPCs, roster summary and board events (RIG-5172) (#2285) (12489a0)
• board: derive board refs, PR gates and stacks from stored rows (RIG-5171) (#2231) (56d6a61)
• board: show linked pull requests on board issues (RIG-4034) (#1917) (9343ecb)
• cli: add compass agent spawn to bring an agent online (RIG-3345) (#1794) (531e770)
• cli: compass agent repo add, remove and list (RIG-5015) (#2108) (ea1a1c4)
• comms: agent comms_list_topics tool and topic filter (RIG-1706) (#2082) (173137b)
• comms: agent tools name channel groups by leaf or slash path (#1705) (b071662)
• comms: carry an optional issue or PR ref on asks (RIG-5173) (#2228) (b8b15ef)
• comms: carry the agent turn sequence to the stored message and the settle sink (RIG-4323) (#1602) (5f21a39)
• comms: carry the agent turn sequence to the stored message and the settle sink (RIG-4323) (#1617) (6ec1ded)
• comms: carry the channel id on SearchMessages hits (RIG-4295) (#1612) (e260f49)
• comms: let peered owners address each other's agents (RIG-4363) (#1761) (96d6f8f)
• comms: require a taxonomy role on CreateAgent (RIG-3097) (#1733) (10f50c3)
• comms: set role and persona at CreateAgent; require --role on agent spawn (RIG-4712) (#1803) (d347a3a)
• comms: wire ReparentChannel and attached CreateChannel (RIG-4190) (#1779) (d1f381f)
• compass-agent: add channel, group, and membership comms tools (RIG-2726) (#1809) (51d2290)
• compass-agent: let forge_subscribe take a container scope (RIG-2732) (#2006) (76fd746)
• compass-app: connect with a first-run server choice (#1928) (cb249b5)
• compass-app: open the first-run chooser when app.toml is absent (#1930) (df680bc)
• compass-stack: backend-aware preflight; microVM checks advisory off the microvm tier (RIG-3272) (#2165) (ca930f0)
• config: add the config-import review skill (RIG-3512) (#2276) (b73be64)
• dashboards: ship Grafana dashboard JSON for agent obs signals (RIG-2826) (#670) (7d17aba)
• delivery: fire held messages only up to the settled turn (RIG-4325) (#1603) (87091b6)
• delivery: gate delivery reads on owner reach (RIG-4362) (#1688) (1d651ae)
• delivery: route owner-qualified mentions within the channel (RIG-4364) (#1751) (e691058)
• design-ledger-gate: require counter-claimed DL ids on PR runs (#2249) (04e9b14)
• design-ledger: split the compass ledger into per-area decision files (RIG-4849) (#2005) (db0b043)
• e2e: refuse a stale local compass-agent image by source fingerprint (RIG-3667) (#1768) (69233e5)
• fabric: report each durable consumer backlog as an OTel gauge (RIG-4299) (#1585) (f890817)
• forge: carry PR head SHA, mergeable state and review commit id (RIG-5182) (#2194) (ce09ae6)
• forge: comment edit, delete, list-since, and create client id (RIG-5181) (#2185) (e5f53d0)
• forge: link a created pull request to its issue (RIG-4034) (#1926) (e4d8b81)
• forge: merge-queue provider with Trunk and a queue sweep (RIG-5183) (#2210) (a7a709e)
• forge: read PR timestamps, closing refs and PR list rows (RIG-4034) (#1914) (7016716)
• gateway-image: build and smoke the gateway image from the fork pin (RIG-4341) (#2190) (bd9a75d)
• gateway-image: lane scaffold and pure core (RIG-4340) (#1587) (bb0ae15)
• gatewaycred: clear named OAuth metadata fields on update (RIG-5084) (#2130) (d389a1d)
• gatewaycred: skip an unreadable row in the pool read (RIG-4783) (#1937) (03bf169)
• go: give every background goroutine a span class (RIG-5315) (#2265) (172acb8)
• guest-image: pin the agent image as a multi-arch index (#2132) (1737f89)
• ingest: hydrate pull requests onto the board (RIG-4034) (#1927) (006cc8c)
• ingest: retry PR hydrates held by a budget pause (RIG-4826) (#1971) (2442f58)
• linear: link sessions through a click-time /l/session redirect (RIG-2794) (#1717) (dbb0751)
• linear: record the issue identifier on the agent-session association (RIG-4043) (#1709) (526324a)
• mirror: mirror asks and topics to forge issues and PRs (RIG-5181) (#2275) (be42af4)
• otel: stamp trace ids on log lines and gate ctx-less roots (RIG-5311) (#2246) (58a4bad)
• proto: add session blob RPCs (RIG-1582) (#1995) (3d1adb7)
• proto: add status board messages and PR/tracker fields (RIG-5169) (#2181) (5cbd5be)
• proto: add the channel attach edge, membership mode, and ReparentChannel (RIG-4185) (#1590) (8232d08)
• proto: add the GatewayCredentials service for the LLM gateway (RIG-2863) (#1611) (9fee8fd)
• refs: parse and scan tracker and forge refs (#2184) (097a1f8)
• release: bump the homebrew-tap compass-cli formula on semver releases (#2118) (bd236d2)
• renovate: fail rollup on a half-relocked devenv lock (#1936) (89788ea)
• renovate: manage the Go analysis battery pins (RIG-3306) (#1742) (0a000af)
• renovate: refresh the UI node_modules FOD pin on bun and flake bumps (#1647) (bc3da6f)
• runner: bind a resume lifetime on the Runner after accept (RIG-4297) (#1707) (c421fb1)
• runner: forward agent session blobs to the Server (RIG-1582) (#1999) (e9b6983)
• runnerhub: accept projected tokens on the Runner door (RIG-4999) (#2058) (599af8e)
• runnerhub: relay and fetch session blobs for Runners (RIG-1582) (#1997) (5d31dc0)
• runnerhub: signal one account's secrets version (RIG-5015) (#2105) (257bbf0)
• runner: pass --agent-batching to agents as COMPASS_AGENT_BATCHING (RIG-5072) (#2098) (0fb791b)
• runner: read projected tokens from a file and adopt the Server-assigned id (RIG-5000) (#2060) (14b108f)
• runner: render projected-token identity and its admission policy (RIG-5001) (#2061) (5f4b787)
• runner: render the Runner DaemonSet and KVM device request (#1773) (4cec371)
• runner: restore session blobs on resume (RIG-1582) (#2000) (ecfc1ae)
• runner: span AgentGateway RPCs and strip stream spans (RIG-5313) (#2259) (dc6ddd4)
• runner: span every Sessions command under the server trace (RIG-5316) (#2267) (edd6ac6)
• runtime: WorkspaceSource variant; Mounts carries the writable session volume (RIG-3281) (#2119) (0bf231a)
• search: add message search provider (RIG-4280) (#1555) (8abd1e6)
• server: accept an operator-supplied admin token file (RIG-2668) (#2263) (f9ed6db)
• server: add admin-only RenameAccount RPC (RIG-5151) (#2226) (f626f86)
• server: add forge scope storage (RIG-4434) (#1654) (e09539d)
• server: add owner peering approvals, RPCs and CLI (RIG-4361) (#1678) (3db225b)
• server: add SkipBatchWindow and the StartNowControl agent control (RIG-5071) (#2087) (eb409a2)
• server: AgentRepositoryService for agent workstream repositories (RIG-5015) (#2107) (6738c0b)
• server: broker a repo-scoped GitHub App token into agent containers (RIG-4724) (#2008) (fa4bb28)
• server: broker owner-grants fallback and typed mint errors (RIG-5022) (#2103) (07f9020)
• server: configure forge scope enforcement and boot grants (RIG-4434) (#1656) (9bbb94e)
• server: enforce forge write scopes by default (RIG-4950) (#2056) (f71f2ba)
• server: gate forge writes on account scope grants (RIG-4434) (#1655) (4637391)
• server: gateway credential door takes the agent token (RIG-5204) (#2204) (84ced89)
• server: owner-qualify agent author handles (RIG-4026) (#1720) (1e42084)
• server: per-account first-run tour state (RIG-4505) (#1687) (2c16dd0)
• server: rate-limit GitHub credential mints with backoff (RIG-4435) (#2302) (073abf9)
• server: report build git rev via GetServerInfo (RIG-2039) (#1760) (470dde8)
• server: report Runner attachment as compass.runner health (RIG-5352) (#2282) (cdfee2c)
• server: revoke the old GitHub credential on grant removal (RIG-4435) (#2303) (da36275)
• server: serve an agent’s last credential on a transient mint failure (RIG-5015) (#2106) (9553cc7)
• server: serve gateway credentials from a sealed store (RIG-4746) (#1859) (5c56bb5)
• server: serve GatewayAuth on the network door (RIG-5082) (#2117) (8b0d072)
• server: serve health on every door and mark NOT_SERVING on drain (RIG-5351) (#2279) (b3b2060)
• server: serve the model registry to the LLM gateway (RIG-3980) (#2088) (b12166c)
• server: span every handler mount and strip stream spans from work (RIG-5312) (#2255) (8d6f1aa)
• sql-migration-gate: fail CI when a PR edits a migration on the base branch (RIG-3338) (#1624) (8f94503)
• stack: add the microVM guest configuration seam (RIG-3789) (#1281) (c2e91f4)
• stack: configurable host ports for bundled NATS and collector (#1690) (b36c78f)
• stack: default the host tier's server to the keyring provider (RIG-3512) (#2280) (33db616)
• stack: materialize digest-pinned guest artifacts (RIG-3789) (#1282) (64dd436)
• stack: supervise the LLM gateway as a container child (RIG-2862) (#1382) (3f07cba)
• stack: wait for the started Runner to enroll before ready (RIG-4514) (#1703) (e9aca7b)
• store: add issue search query (RIG-4277) (#1539) (c5249a1)
• store: agent forge scope revoke, list and parent copy (RIG-5015) (#2104) (91b0b16)
• store: attach channels to agents with tree or explicit membership (RIG-4186) (#1762) (5d7f1af)
• store: authorize channel writes and reads by tree participation (RIG-4187) (#1764) (5fdec0d)
• store: index issue search text (RIG-4276) (#1538) (194254a)
• store: index session blobs and store them by content hash (RIG-1582) (#1996) (6c2e829)
• store: let agent accounts own forge scope rows (RIG-5022) (#2101) (39f21f3)
• store: move the transcript archive flush off the commit path (RIG-5158) (#2223) (b7ea071)
• store: owner-set visibility and derived TREE members on channel reads (RIG-4188) (#1772) (2bb1497)
• store: refuse to serve an applied migration edited after it ran (RIG-3338) (#1623) (0f28925)
• store: status board tables, patch merge and board reads (RIG-5170) (#2212) (2ea6f4a)
• store: store pull requests and their issue links (RIG-4034) (#1900) (58b374a)
• store: TREE subscriptions and delivery over derived participants (RIG-4189) (#1778) (4eabb2d)
• store: unique sibling channel-group names with a repairing migration (RIG-3030) (#1595) (45b71ef)
• ui: add Start now to the observation pane (RIG-5074) (#2125) (a51caa6)
• ui: add the top-bar search shell (RIG-4279) (#1544) (bf164d1)
• ui: Appearance settings section with a reduce-motion override (RIG-4972) (#2066) (b7f3d15)
• ui: Backlog and Done as Bridge segments (RIG-4968) (#2053) (afe8748)
• ui: chrome on night with selection pane edges (RIG-4966) (#2050) (8fef455)
• ui: first-run setup screen and server connect form (#1757) (1f70448)
• ui: first-run tour overlay with spotlight and anchors (#1744) (d05fa8c)
• ui: General settings section (RIG-4971) (#2063) (1e73c2f)
• ui: lift the channel attach fields in the live adapter (RIG-4192) (#1596) (fed476a)
• ui: message anatomy from the site (RIG-4963) (#2043) (523a1c2)
• ui: New tab always opens a new tab (RIG-4676) (#1798) (3069ccb)
• ui: project agent lifecycle from session status (RIG-4969) (#2044) (80d10f0)
• ui: remove the client-side tracker editor from Settings (RIG-4973) (#2067) (131ec21)
• ui: render channels in the one sidebar agent tree (RIG-4191) (#1552) (d3a4499)
• ui: search all issues and PRs from the palette and top bar (RIG-4281) (#1613) (14537fb)
• ui: Settings shell with a route per section (RIG-4970) (#2059) (62a692c)
• ui: ship the brand faces with the app (RIG-4959) (#2036) (b90f2ca)
• ui: site glyph cells and a 2x state dot (RIG-4962) (#2040) (5c08fb3)
• ui: site greens and hierarchy by color (RIG-4961) (#2039) (d931ca4)
• ui: square corners everywhere (RIG-4960) (#2037) (51eb7c3)
• ui: stack the agent log panel in narrow panes (RIG-4682) (#1787) (f3ee331)
• ui: text entry uses the input and button primitives (RIG-4964) (#2047) (433d4a7)
• ui: the agent tree view at /agents (RIG-4967) (#2052) (9a52094)
• ui: the needle mark alone in the top bar (RIG-4965) (#2048) (ee74e79)
• ui: tour overlay, spotlight and anchors (RIG-4507) (#1782) (c5e4bbb)
• ui: tour state, demo data seam and store.tour controller (RIG-4506) (#1734) (ed785b9)
• ui: tour.start palette command and idle-deferred first-run start (RIG-4509) (#1784) (7e9a3f6)
• ui: two-pane split with a resizable splitter (RIG-4446) (#1780) (9fa2751)
• ui: view tab strip with keep-alive and open-in-tab links (RIG-4444) (#1755) (04278b6)
• ui: W leader chords and palette commands for tabs and panes (RIG-4445) (#1770) (2afaa08)
• ui: window layout model, hash sync and session persistence (RIG-4443) (#1743) (26f50c3)
• usage: add the GetUsageSeries read RPC over token-usage rollups (RIG-2865) (#1370) (3cf8027)
• usage: derive compute-usage rollups and prune the raw compute log (RIG-2872) (#1513) (c144385)
• usage: record compute-usage intervals with the session binding (RIG-2872) (#1509) (d0cffd2)
• vfs: put Stamp and ReconcileOrphans on VolumeManager (RIG-3309) (#1939) (dd8b65a)
• vfs: snapshot store with reflink probe, copy fallback and (account, repo) index (RIG-3279) (#2094) (79550f3)
• vfs: VirtualFS seam with checkout/snapshot/customer-mount backend (RIG-3280) (#2115) (56a05b6)

Bug Fixes

• agent-image: build the agent with the pinned bun (#2001) (a295957)
• agent-image: read the lock's per-platform manifest key in the prune (RIG-1750) (#2198) (a2e9391)
• auth: scope bearer callers to their token's tenant (RIG-4066) (#1375) (dc0a9f4)
• bridge: never follow redirects from the TLS target (#1963) (1dd01e0)
• build: ship the pinned secretspec CLI with compass-server (RIG-4583) (#1758) (1024cd5)
• ci: run design-ledger touch-coupling on PRs, fail if unwired (RIG-3924) (#1799) (e9aea23)
• ci: save the e2e Go cache only from main push/schedule (RIG-4384) (#1629) (ce258fd)
• ci: take PR changed paths from the merge ref's first parent (RIG-5229) (#2207) (bf3c04c)
• cli: close the enrollment CLI review nits (RIG-1380) (#2229) (da93b73)
• comms: resolve update_members channel by name for agent tools (RIG-3030) (#1588) (8c851ed)
• comms: trim a departing member's final ChannelChanged to the channel id (RIG-1325) (#1745) (50b3224)
• compass-agent: anchor abort mutants on code, not comment text (RIG-3778) (#2258) (042f9f0)
• compass-agent: mark a full forge_list_issues page as possibly having more (RIG-4121) (#1511) (acf0a86)
• compass-app: ask before restarting a version-mismatched embedded stack (RIG-5102) (#2133) (c8633a2)
• deps: clear the lockfile's known advisories (RIG-5013) (#2186) (4edeba7)
• design-ledger-gate: exempt automation branches only for their bot (RIG-4823) (#2076) (89a42f0)
• design-ledger-gate: exempt Trunk merge-queue PRs from touch-coupling (RIG-4821) (#1922) (b698561)
• design-ledger-gate: govern every record under a governed root (RIG-3417) (#1982) (32b0959)
• devenv: default GOLANGCI_LINT_CACHE to the per-clone lint cache (RIG-1465) (#1792) (56feb99)
• devenv: refuse a NUL or UTF-16 version.txt before stamping (RIG-3439) (#1789) (5b23d08)
• dl-reconcile: reject unrendered ledger rows (RIG-3941) (#1489) (fc2c80d)
• e2e: carry the shared stand-up failure text into every leg (RIG-4613) (#1759) (e388948)
• fabric: detect a consumer reaped while no pull was waiting (RIG-3448) (#1876) (4124a94)
• fabric: give the max-deliveries advisory fetch its own deadline (RIG-4786) (#1875) (04a16d2)
• fabric: park an event once when a late Term races the advisory (RIG-4494) (#1683) (6e9a113)
• fabric: reap abandoned durable consumers after 2x MaxAge (RIG-3448) (#1807) (1ddda30)
• forge: leave a PR's checks unset when no roll-up was fetched (#1680) (ca5a14e)
• forge: reuse the CreateIssue node id for follow-up writes (RIG-4859) (#2035) (5a59515)
• gateway: refuse a steer or deliver control without its message (RIG-2464) (#2208) (7cc9bdc)
• go: serialize concurrent golangci-lint runs (RIG-4813) (#1889) (419f3ad)
• guest-image: read the agent image anonymously in the relock (#2074) (4374f4c)
• hooks: bound the pre-push moon ci concurrency to 4 (#1682) (4fae441)
• ingest: skip check_suite events whose head sha has no pull request at debug level (RIG-4205) (#1507) (895c7be)
• linearagent: route Linear comment events by issue identifier when number is absent (RIG-4205) (#1502) (ab1e45b)
• linearagent: skip Linear emits for a replayed delivery (RIG-4133) (#1781) (5c58c64)
• macos-bundle: bound the pre-create hdiutil calls (RIG-3939) (#1484) (fbc9c56)
• macos-bundle: inject the pre-create flush so tests never run a real sync (RIG-4476) (#1671) (7d7f1a9)
• macos-bundle: retry hdiutil create when the image is busy (RIG-3939) (#1483) (5137d11)
• make main green again (RIG-4878) (#1990) (ea5c036)
• microvm: bound Shutdown reap grace by its ctx (RIG-3240) (#2073) (e9faac3)
• microvm: stop passt mapping the guest gateway to the host (RIG-3428) (#1984) (ce232e8)
• microvm: translate virtiofsd ids instead of mapping namespace-root (RIG-3330) (#1941) (768d71a)
• release: republish guest and runner images on devenv.lock changes (#1689) (9a39795)
• renovate: accept = and ? in package-diff artifact versions (#2298) (93d7f84)
• renovate: drop the Meissa rule's schedule window (RIG-4852) (#2019) (fbf679d)
• renovate: let the daily cron alone set the cadence (RIG-4852) (#1983) (2b42dcc)
• renovate: lift the hourly PR cap that starves daily runs (RIG-4935) (#2075) (b08ac5d)
• renovate: read devenv build JSON in the package-diff collector (#2295) (dc6b2e3)
• renovate: refresh the entrypoint FOD through its agent-image vehicle (#2030) (9da4903)
• repo: exempt release CHANGELOG from MD050 (RIG-1746) (#1650) (f89fa83)
• runner,server: report ERRORED after in-flight frames and reject spawn on an errored agent (RIG-4097) (#1634) (5dd4cc0)
• runner: bound ControlAck size before decode (RIG-4777) (#1849) (31f37bd)
• runner: handle a container removed outside Compass on podman (RIG-4401) (#1639) (0100ae8)
• runnerhub: cap inbound RunnerService messages (RIG-3586) (#1676) (f1c3291)
• runnerhub: ERRORED cleanup releases only the binding it saw (RIG-4742) (#1810) (933a535)
• runnerhub: fail enrollment when the durable reap fails (RIG-3691) (#1700) (c7a9a5f)
• runnerhub: ignore lifecycle frames that arrive after ERRORED (RIG-4452) (#1774) (1ee489e)
• runnerhub: one distinct code for an unbound caller session on every relay leg (RIG-5124) (#2214) (48c24fd)
• runnerhub: reap a Runner's session bindings in every tenant on enroll (RIG-4296) (#1606) (2059ba7)
• runnerhub: reap a Runner's session bindings on every enroll (RIG-4223) (#1515) (17e3f8f)
• runnerhub: report a token-store fault as Unavailable, not Unauthenticated (RIG-4529) (#1711) (056c388)
• runnerhub: resolve fetched secrets under the agent tenant (RIG-4912) (#2121) (af24e74)
• runnerhub: rotate a runner token file registered to another subject (RIG-3343) (#1548) (2040628)
• runnerhub: run Runner relays under the session tenant (RIG-5110) (#2123) (dbb08fc)
• runnerhub: scope the faulted-reap read-through refusal per Runner (RIG-3691) (#1681) (7e8faf5)
• runnerhub: serialize enroll reaps with session promotion (#1756) (77a78f5)
• runnerhub: treat a Runner-reported ERRORED as the lost-session edge (RIG-4221) (#1570) (541031f)
• runner: re-Provision replaces a registered workload that is not running (RIG-4199) (#1609) (5ebcb61)
• runner: read the stream outcome when the bootstrap Send hits EOF (RIG-4359) (#1605) (69c7a19)
• runner: retry enrollment with bounded backoff (RIG-3691) (#1699) (3058dcb)
• runner: run the startup preflight under the signal ctx (RIG-3218) (#1790) (ba07785)
• runner: sweep detached exec sessions when an agent stops (RIG-4708) (#1805) (4be37e2)
• runtime: don't cancel podman start/run mid netns setup (RIG-5334) (#2305) (1371ecf)
• runtime: kill the in-container process group when a CLI exec client dies (RIG-4181) (#1791) (9b77e93)
• runtime: refuse to start when containers.conf opens a pasta forward (RIG-5249) (#2235) (19ab097)
• runtime: report unstartable exec programs as exit 127/126 on every backend (RIG-5121) (#2225) (34863c1)
• server: apply review fixes to agent workstream repositories (RIG-5015) (#2266) (c683c98)
• server: cancel and join the runner-ready seed in Serve's drain (RIG-1953) (#2176) (48b3407)
• server: carry subscription scope and prove forge_subscribe over the wire (RIG-2732) (#2007) (72b3af3)
• server: close doors when the shutdown drain overruns (RIG-1252) (#1785) (231a8be)
• server: match the whole socket identity before cleanup removes it (RIG-4696) (#1786) (72ad0c1)
• server: never deliver or accept a user GitHub secret (RIG-4949) (#2055) (9d54866)
• server: reject forge coordinates registered with an empty host (RIG-3870) (#1667) (e9e698f)
• server: reuse a still-valid bootstrap admin token on restart (#1808) (d88cc15)
• server: wake checks liveness from the hub cache only (RIG-4223) (#1516) (8300131)
• server: warn when the admin-token state dir is shared (#1801) (cd1c445)
• sql-migration-gate: fail closed on a shallow clone instead of deepening it (RIG-4889) (#2149) (645355f)
• stack: answer the registry bearer challenge when materialising the guest (RIG-3789) (#1604) (ddece0a)
• stack: authenticate cached guest image reuse (RIG-3906) (#1401) (49d1d47)
• stack: bound container teardown by ctx and never block Phase A (RIG-4571) (#1748) (3a26d4b)
• stack: confirm cross-process teardown by group exit, not socket alone (RIG-3937) (#1657) (94067d9)
• stack: default the microVM runner run root to the runtime dir (RIG-4514) (#1693) (f3beee1)
• stack: hand compass-server a stack-bound network-door listener (#1806) (2145218)
• store: a nested channel group takes its parent visibility (RIG-4750) (#1940) (dc9dc82)
• store: cap the pgx pool at 10 unless the DSN sets pool_max_conns (RIG-2300) (#2137) (c6c0f48)
• store: check model-level headers at the models.yml door (RIG-5287) (#2227) (b86a40e)
• store: refuse a reserved group as a channel-group parent (RIG-4358) (#1610) (1aad54b)
• store: refuse a session binding for another tenant's agent (#1702) (f966054)
• store: refuse non-string models.yml header values at the door (RIG-3134) (#2224) (be9a90e)
• store: refuse URL-embedded credentials at the models.yml door (RIG-5292) (#2245) (5278ccd)
• store: reserve the linear group name at top level (RIG-4045) (#1521) (36cdb36)
• store: scope MessageAskIDs to the author's edit authz (RIG-1552) (#1753) (6f32ae5)
• ui: add topbar search accessibility (RIG-4282) (#1556) (4a718ab)
• ui: chrome cleanup: drop ADE and usage bar, Session Log naming, pane edges, row re-measure (RIG-4771) (#1811) (a6742db)
• ui: give each Playwright run its own Vite optimizer cache (#2068) (357d418)
• ui: keep the Bridge Issues/PRs toggle in place (RIG-4773) (#1812) (088b5a2)
• ui: live Session Log tails SubscribeAgentSession for the open agent (RIG-4772) (#1814) (173c723)
• ui: route message search hits on the wire channel id (RIG-4295) (#1646) (496cb68)
• ui: scope the pinned e2e fontconfig to the Playwright browser (RIG-4210) (#1608) (ca7c412)
• ui: stop Playwright's git capture shallowing the CI checkout (RIG-4889) (#2148) (d12dda6)
• vfs: move volume metadata out of the agent-owned root (RIG-3311) (#1938) (d18da2c)

Performance Improvements

• forge: stop listing issue pages at the requested limit (RIG-4123) (#1666) (5b7e6e4)
• runtime: run agent containers under an init so stop is prompt (#2260) (330abab)
• store: walk a PutAgentConfig bundle once for both profile lints (RIG-3220) (#1797) (fdf6220)

---

This PR was generated with Release Please. See documentation.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

Compass engineering docs preview: https://release-please--branches--ma.compass-eng-docs.pages.dev

Deployed from release-please--branches--main at a2b41e1.

Changed pages:

• CHANGELOG.md