diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 0913d7921..1c1f3a777 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-	".": "0.3.0"
+	".": "0.3.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d16dc2609..9e0c9d268 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,289 @@
 # Changelog
 
+## [0.3.1](https://github.com/RigelBuild/compass/compare/v0.3.0...v0.3.1) (2026-10-18)
+
+
+### Features
+
+* **agent-image:** authenticate git and jj-vine with the materialized gh token (RIG-4724) ([#2009](https://github.com/RigelBuild/compass/issues/2009)) ([7b05922](https://github.com/RigelBuild/compass/commit/7b05922f90b93d9cec21defdd41ce9ac27ce6ca5))
+* **agent-image:** ship jj and jj-vine in the agent image (RIG-4723) ([#1800](https://github.com/RigelBuild/compass/issues/1800)) ([47e37c7](https://github.com/RigelBuild/compass/commit/47e37c7899c81e10eecd94e97c7ba53cffcdd524))
+* **agent:** batch inbound items in an idle window behind COMPASS_AGENT_BATCHING (RIG-5070) ([#2084](https://github.com/RigelBuild/compass/issues/2084)) ([a684695](https://github.com/RigelBuild/compass/commit/a684695abfb7a435d3cf5c271dbae62cc63c2fba))
+* **agent:** range-encode ControlAck applied_above (RIG-1466) ([#1813](https://github.com/RigelBuild/compass/issues/1813)) ([403f672](https://github.com/RigelBuild/compass/commit/403f67211cb4b01f12493963ca76d2c1aea970e7))
+* **agent:** Reload continues the session transcript under the new config (RIG-4418) ([#1704](https://github.com/RigelBuild/compass/issues/1704)) ([5af811b](https://github.com/RigelBuild/compass/commit/5af811ba883ff0e2f5193cc03fc362a398f5b488))
+* **agent:** report runner enrollment in agent status (RIG-3343) ([#1594](https://github.com/RigelBuild/compass/issues/1594)) ([1d63b7e](https://github.com/RigelBuild/compass/commit/1d63b7e4ffac456a0f893ffe5f3d4e8ad91e5304))
+* **agent:** route start_now to end the idle batching window (RIG-5073) ([#2099](https://github.com/RigelBuild/compass/issues/2099)) ([ae7a74c](https://github.com/RigelBuild/compass/commit/ae7a74c3798b3db745ae8ef70bb44b112021a9e9))
+* **agent:** upload inline-image blobs from committed session lines (RIG-1582) ([#1998](https://github.com/RigelBuild/compass/issues/1998)) ([9ecd75f](https://github.com/RigelBuild/compass/commit/9ecd75fb7d81e6c1332679719b9514a2c5afd35a))
+* **appconfig:** add the no-config signal, URL normalizer, and app.toml writer ([#1740](https://github.com/RigelBuild/compass/issues/1740)) ([092d7c6](https://github.com/RigelBuild/compass/commit/092d7c6bf13b30d76a28b08c14c082779e491555))
+* **auth:** mint and verify per-agent gateway tokens (RIG-2864) ([#1752](https://github.com/RigelBuild/compass/issues/1752)) ([aa3b206](https://github.com/RigelBuild/compass/commit/aa3b206e9da453d6c82037668ffaadd3982813f5))
+* **auth:** verify Kubernetes projected tokens for Runners (RIG-4998) ([#2057](https://github.com/RigelBuild/compass/issues/2057)) ([7bc5d53](https://github.com/RigelBuild/compass/commit/7bc5d536dc273ab3734de1766d475a5fafb9508b))
+* auto-link issue and PR refs via GetRefLinkRules (RIG-5178) ([#2192](https://github.com/RigelBuild/compass/issues/2192)) ([39bf0ac](https://github.com/RigelBuild/compass/commit/39bf0acd721ede470de183e5d1c33c7bb59ad392))
+* **board:** agent board RPCs, roster summary and board events (RIG-5172) ([#2285](https://github.com/RigelBuild/compass/issues/2285)) ([12489a0](https://github.com/RigelBuild/compass/commit/12489a0ced3a5eaf20a732350804255e600535c1))
+* **board:** derive board refs, PR gates and stacks from stored rows (RIG-5171) ([#2231](https://github.com/RigelBuild/compass/issues/2231)) ([56d6a61](https://github.com/RigelBuild/compass/commit/56d6a615d268fdf461ad470e332f6f28eb753202))
+* **board:** drive the Bridge advancing card from a state-change stamp (RIG-2347) ([#2369](https://github.com/RigelBuild/compass/issues/2369)) ([5cebaee](https://github.com/RigelBuild/compass/commit/5cebaee75ba8ccced636c185cc228c6e4e4b40cd))
+* **board:** show asks and their forge mirror state on boards (RIG-5173) ([#2292](https://github.com/RigelBuild/compass/issues/2292)) ([8e52da0](https://github.com/RigelBuild/compass/commit/8e52da096e79789e9c9418a0989662eef86816e3))
+* **board:** show linked pull requests on board issues (RIG-4034) ([#1917](https://github.com/RigelBuild/compass/issues/1917)) ([9343ecb](https://github.com/RigelBuild/compass/commit/9343ecbf9409e58c5bc3d3dc8a4ee44db8d70727))
+* **ci-timing:** measure CI wall, wait and long pole per run class (RIG-5488) ([#2326](https://github.com/RigelBuild/compass/issues/2326)) ([dd99fc1](https://github.com/RigelBuild/compass/commit/dd99fc1f656865a82b42ad8fab9581f5cfea3df2))
+* **ci:** gate pgtest, microvm and e2e on the Go package graph (RIG-5492) ([#2337](https://github.com/RigelBuild/compass/issues/2337)) ([df5703a](https://github.com/RigelBuild/compass/commit/df5703a237879c0e83cc43061af1cb2107077361))
+* **ci:** reject added or edited design records in compass (RIG-4528) ([#2329](https://github.com/RigelBuild/compass/issues/2329)) ([3f088a0](https://github.com/RigelBuild/compass/commit/3f088a0eb5a29196779f574799b73d0325b77500))
+* **ci:** reject added or edited design records in compass (RIG-4528) ([#2332](https://github.com/RigelBuild/compass/issues/2332)) ([a82c38c](https://github.com/RigelBuild/compass/commit/a82c38c83ef3856d677e29a338a9b635679b1b7c))
+* **ci:** route a red full sweep to a ci-backstop issue (RIG-5491) ([#2327](https://github.com/RigelBuild/compass/issues/2327)) ([986c58f](https://github.com/RigelBuild/compass/commit/986c58f181223ebcb60aa14e1aa4b9d2409cb3f1))
+* **ci:** run pgtest and microvm on the selected Go roots only (RIG-5493) ([#2347](https://github.com/RigelBuild/compass/issues/2347)) ([4d5d08a](https://github.com/RigelBuild/compass/commit/4d5d08a064ce465cbbb9ba58da015d66ce9b7818))
+* **cli:** add compass agent spawn to bring an agent online (RIG-3345) ([#1794](https://github.com/RigelBuild/compass/issues/1794)) ([531e770](https://github.com/RigelBuild/compass/commit/531e770f034bfb0ded6dd6cada1952205c1ed60b))
+* **cli:** compass agent repo add, remove and list (RIG-5015) ([#2108](https://github.com/RigelBuild/compass/issues/2108)) ([ea1a1c4](https://github.com/RigelBuild/compass/commit/ea1a1c4e5614fcde3035b0fdfe29ad8fa53bc13b))
+* **comms:** agent comms_list_topics tool and topic filter (RIG-1706) ([#2082](https://github.com/RigelBuild/compass/issues/2082)) ([173137b](https://github.com/RigelBuild/compass/commit/173137bdee86c5daafd7bbc23802cd0338be4b99))
+* **comms:** agent tools name channel groups by leaf or slash path ([#1705](https://github.com/RigelBuild/compass/issues/1705)) ([b071662](https://github.com/RigelBuild/compass/commit/b071662c6a8b8457cfc7a1737b8643e695b23827))
+* **comms:** carry an optional issue or PR ref on asks (RIG-5173) ([#2228](https://github.com/RigelBuild/compass/issues/2228)) ([b8b15ef](https://github.com/RigelBuild/compass/commit/b8b15ef1575ba337f34c206140e4150db88d99b3))
+* **comms:** carry the agent turn sequence to the stored message and the settle sink (RIG-4323) ([#1602](https://github.com/RigelBuild/compass/issues/1602)) ([5f21a39](https://github.com/RigelBuild/compass/commit/5f21a39535582d7bce65a2acd88d879e8eb13a1b))
+* **comms:** carry the agent turn sequence to the stored message and the settle sink (RIG-4323) ([#1617](https://github.com/RigelBuild/compass/issues/1617)) ([6ec1ded](https://github.com/RigelBuild/compass/commit/6ec1ded355947e00eb8bf6e59d84adafd5d9607a))
+* **comms:** let peered owners address each other's agents (RIG-4363) ([#1761](https://github.com/RigelBuild/compass/issues/1761)) ([96d6f8f](https://github.com/RigelBuild/compass/commit/96d6f8fb30bd6d4e78512830ff20d1825c8c2192))
+* **comms:** require a taxonomy role on CreateAgent (RIG-3097) ([#1733](https://github.com/RigelBuild/compass/issues/1733)) ([10f50c3](https://github.com/RigelBuild/compass/commit/10f50c375ca18c71b18c7131f41dc5c2b5939db3))
+* **comms:** set role and persona at CreateAgent; require --role on agent spawn (RIG-4712) ([#1803](https://github.com/RigelBuild/compass/issues/1803)) ([d347a3a](https://github.com/RigelBuild/compass/commit/d347a3a4472812a2b4a251d9581c236330062544))
+* **comms:** wire ReparentChannel and attached CreateChannel (RIG-4190) ([#1779](https://github.com/RigelBuild/compass/issues/1779)) ([d1f381f](https://github.com/RigelBuild/compass/commit/d1f381fa82092e39819c51f9347f783b81559eb4))
+* **compass-agent:** add channel, group, and membership comms tools (RIG-2726) ([#1809](https://github.com/RigelBuild/compass/issues/1809)) ([51d2290](https://github.com/RigelBuild/compass/commit/51d22902ec90e940e22fc44d0b3fe78242161a44))
+* **compass-agent:** let forge_subscribe take a container scope (RIG-2732) ([#2006](https://github.com/RigelBuild/compass/issues/2006)) ([76fd746](https://github.com/RigelBuild/compass/commit/76fd746b4f1b1eeefc460513bba731ab1cc5c79e))
+* **compass-app:** connect with a first-run server choice ([#1928](https://github.com/RigelBuild/compass/issues/1928)) ([cb249b5](https://github.com/RigelBuild/compass/commit/cb249b5d8638d8c88da2a680fd9d924fa365893d))
+* **compass-app:** open the first-run chooser when app.toml is absent ([#1930](https://github.com/RigelBuild/compass/issues/1930)) ([df680bc](https://github.com/RigelBuild/compass/commit/df680bcd4f0244954c03c7d0ce483266694b1ddf))
+* **compass-go:** move to connect-go v2 (RIG-5471) ([#2354](https://github.com/RigelBuild/compass/issues/2354)) ([c3efe7a](https://github.com/RigelBuild/compass/commit/c3efe7a51eab33a9f2db8fb50118d02550cefc1e))
+* **compass-stack:** backend-aware preflight; microVM checks advisory off the microvm tier (RIG-3272) ([#2165](https://github.com/RigelBuild/compass/issues/2165)) ([ca930f0](https://github.com/RigelBuild/compass/commit/ca930f003d908007a928825eb836c7ece7e79c64))
+* **config:** add the config-import review skill (RIG-3512) ([#2276](https://github.com/RigelBuild/compass/issues/2276)) ([b73be64](https://github.com/RigelBuild/compass/commit/b73be644a76e42072313b794285256caebd12a6b))
+* **dashboards:** ship Grafana dashboard JSON for agent obs signals (RIG-2826) ([#670](https://github.com/RigelBuild/compass/issues/670)) ([7d17aba](https://github.com/RigelBuild/compass/commit/7d17aba3e90a7bc7f905c0296f89e2a775dc824c))
+* **delivery:** fire held messages only up to the settled turn (RIG-4325) ([#1603](https://github.com/RigelBuild/compass/issues/1603)) ([87091b6](https://github.com/RigelBuild/compass/commit/87091b68d1716433143a918c370cf4b934ad3dbd))
+* **delivery:** gate delivery reads on owner reach (RIG-4362) ([#1688](https://github.com/RigelBuild/compass/issues/1688)) ([1d651ae](https://github.com/RigelBuild/compass/commit/1d651ae0fcd7830faee4585e37d626b4111d09a2))
+* **delivery:** route owner-qualified mentions within the channel (RIG-4364) ([#1751](https://github.com/RigelBuild/compass/issues/1751)) ([e691058](https://github.com/RigelBuild/compass/commit/e691058ac8de45bdcd8fbd3f5b3f2fa2b3f24a42))
+* **design-ledger-gate:** require counter-claimed DL ids on PR runs ([#2249](https://github.com/RigelBuild/compass/issues/2249)) ([04e9b14](https://github.com/RigelBuild/compass/commit/04e9b1449c8ba7d039c9ae2cbc35ce65b4554e44))
+* **design-ledger:** split the compass ledger into per-area decision files (RIG-4849) ([#2005](https://github.com/RigelBuild/compass/issues/2005)) ([db0b043](https://github.com/RigelBuild/compass/commit/db0b04369ec79221ede3bf17bcc1ea80afbc2281))
+* **e2e:** refuse a stale local compass-agent image by source fingerprint (RIG-3667) ([#1768](https://github.com/RigelBuild/compass/issues/1768)) ([69233e5](https://github.com/RigelBuild/compass/commit/69233e5de09df23e24a162d8981e8a83eb318439))
+* **fabric:** keep the publisher traceparent on DLQ copies (RIG-5511) ([#2334](https://github.com/RigelBuild/compass/issues/2334)) ([70569b6](https://github.com/RigelBuild/compass/commit/70569b60407c3817ffd51c0bedc4d395c1493623))
+* **forge:** carry PR head SHA, mergeable state and review commit id (RIG-5182) ([#2194](https://github.com/RigelBuild/compass/issues/2194)) ([ce09ae6](https://github.com/RigelBuild/compass/commit/ce09ae644865bbe993394a436164b9b83ee3869d))
+* **forge:** comment edit, delete, list-since, and create client id (RIG-5181) ([#2185](https://github.com/RigelBuild/compass/issues/2185)) ([e5f53d0](https://github.com/RigelBuild/compass/commit/e5f53d0e11f424c7f74b4b6fd1c7ee4e06181f53))
+* **forge:** link a created pull request to its issue (RIG-4034) ([#1926](https://github.com/RigelBuild/compass/issues/1926)) ([e4d8b81](https://github.com/RigelBuild/compass/commit/e4d8b81977bd7b1dc8f92e48a5c82ad14c192006))
+* **forge:** merge-queue provider with Trunk and a queue sweep (RIG-5183) ([#2210](https://github.com/RigelBuild/compass/issues/2210)) ([a7a709e](https://github.com/RigelBuild/compass/commit/a7a709e2cfbc549f2ffa6143ff572920f7913110))
+* **forge:** read PR timestamps, closing refs and PR list rows (RIG-4034) ([#1914](https://github.com/RigelBuild/compass/issues/1914)) ([7016716](https://github.com/RigelBuild/compass/commit/701671638c49ce1729bedcb31ab52b807e49c9ca))
+* **forge:** resolve App installation per repo owner (RIG-5653) ([#2385](https://github.com/RigelBuild/compass/issues/2385)) ([18c7082](https://github.com/RigelBuild/compass/commit/18c708289f98e4d7ec0e7bb1390fbe277981bea4))
+* **forge:** self-delegate and assignee on Linear issue create (RIG-3299) ([#2315](https://github.com/RigelBuild/compass/issues/2315)) ([7d683e0](https://github.com/RigelBuild/compass/commit/7d683e044afac72153b2aa3634697924b70366a2))
+* **gateway-image:** build and smoke the gateway image from the fork pin (RIG-4341) ([#2190](https://github.com/RigelBuild/compass/issues/2190)) ([bd9a75d](https://github.com/RigelBuild/compass/commit/bd9a75d2e9e44d576441488a9dfa872675b4eed2))
+* **gatewaycred:** clear named OAuth metadata fields on update (RIG-5084) ([#2130](https://github.com/RigelBuild/compass/issues/2130)) ([d389a1d](https://github.com/RigelBuild/compass/commit/d389a1d7b24eef51353f5c9e46f4360b62dccf6e))
+* **gatewaycred:** skip an unreadable row in the pool read (RIG-4783) ([#1937](https://github.com/RigelBuild/compass/issues/1937)) ([03bf169](https://github.com/RigelBuild/compass/commit/03bf1698eef6a9de4c6ce21d3d2d19adffe06b66))
+* **go:** give every background goroutine a span class (RIG-5315) ([#2265](https://github.com/RigelBuild/compass/issues/2265)) ([172acb8](https://github.com/RigelBuild/compass/commit/172acb83aba33b005795cc96d1dcc1d33a83cec2))
+* **guest-image:** pin the agent image as a multi-arch index ([#2132](https://github.com/RigelBuild/compass/issues/2132)) ([1737f89](https://github.com/RigelBuild/compass/commit/1737f8946a6fa0db21e03e29b0963b9a2f48889b))
+* **ingest:** hydrate pull requests onto the board (RIG-4034) ([#1927](https://github.com/RigelBuild/compass/issues/1927)) ([006cc8c](https://github.com/RigelBuild/compass/commit/006cc8c7de574675f13eac3b4b32c1286be0e7f6))
+* **ingest:** retry PR hydrates held by a budget pause (RIG-4826) ([#1971](https://github.com/RigelBuild/compass/issues/1971)) ([2442f58](https://github.com/RigelBuild/compass/commit/2442f585ef44cab361ddc021c26f4ba194623568))
+* **linear:** link sessions through a click-time /l/session redirect (RIG-2794) ([#1717](https://github.com/RigelBuild/compass/issues/1717)) ([dbb0751](https://github.com/RigelBuild/compass/commit/dbb075196955aec145044f7a67794c374b554feb))
+* **linear:** record the issue identifier on the agent-session association (RIG-4043) ([#1709](https://github.com/RigelBuild/compass/issues/1709)) ([526324a](https://github.com/RigelBuild/compass/commit/526324a1ba2f7f047e83d8abb028e7b2b35fd172))
+* **mirror:** agent forge_mirror_messages tool with real-session attribution (RIG-5174) ([#2319](https://github.com/RigelBuild/compass/issues/2319)) ([7b648a1](https://github.com/RigelBuild/compass/commit/7b648a1a69077fab9df709a9630b23289fdb1bec))
+* **mirror:** mirror asks and topics to forge issues and PRs (RIG-5181) ([#2275](https://github.com/RigelBuild/compass/issues/2275)) ([be42af4](https://github.com/RigelBuild/compass/commit/be42af44e5092fdd0b1951c49f8aed77f8021827))
+* **otel:** stamp trace ids on log lines and gate ctx-less roots (RIG-5311) ([#2246](https://github.com/RigelBuild/compass/issues/2246)) ([58a4bad](https://github.com/RigelBuild/compass/commit/58a4bad90d4573f0a421a686be2dd6705e7e9fba))
+* **presence:** restore the publisher trace on bus tails and presence edges (RIG-5513) ([#2353](https://github.com/RigelBuild/compass/issues/2353)) ([11abfc8](https://github.com/RigelBuild/compass/commit/11abfc8adf954cb6ecf7a3b5f0efb8bc5bf4d61a))
+* **proto:** add session blob RPCs (RIG-1582) ([#1995](https://github.com/RigelBuild/compass/issues/1995)) ([3d1adb7](https://github.com/RigelBuild/compass/commit/3d1adb7706ccab41bc0ddf1a81742923f6252d68))
+* **proto:** add status board messages and PR/tracker fields (RIG-5169) ([#2181](https://github.com/RigelBuild/compass/issues/2181)) ([5cbd5be](https://github.com/RigelBuild/compass/commit/5cbd5be330bd2f38b1fdc1e636bb5bd81be57b3e))
+* **proto:** add the GatewayCredentials service for the LLM gateway (RIG-2863) ([#1611](https://github.com/RigelBuild/compass/issues/1611)) ([9fee8fd](https://github.com/RigelBuild/compass/commit/9fee8fd0f1459c4dde75aa127d1a023f5521d2f5))
+* **refs:** parse and scan tracker and forge refs ([#2184](https://github.com/RigelBuild/compass/issues/2184)) ([097a1f8](https://github.com/RigelBuild/compass/commit/097a1f8587c6806ab0f131de6810c6fea4fe1f84))
+* **release:** bump the homebrew-tap compass-cli formula on semver releases ([#2118](https://github.com/RigelBuild/compass/issues/2118)) ([bd236d2](https://github.com/RigelBuild/compass/commit/bd236d27665fc4df2279d649fe19f6e37ba44342))
+* **release:** publish a compass-server OCI image by digest (RIG-5579) ([#2355](https://github.com/RigelBuild/compass/issues/2355)) ([511b1c9](https://github.com/RigelBuild/compass/commit/511b1c9f081a362a2547ee1472849e6e9ea0b5df))
+* **renovate:** fail rollup on a half-relocked devenv lock ([#1936](https://github.com/RigelBuild/compass/issues/1936)) ([89788ea](https://github.com/RigelBuild/compass/commit/89788ea9f0a6b794d31eaec7f337b0f3ee2079fe))
+* **renovate:** manage the Go analysis battery pins (RIG-3306) ([#1742](https://github.com/RigelBuild/compass/issues/1742)) ([0a000af](https://github.com/RigelBuild/compass/commit/0a000af6cb35c38e5554f506d5818446cfa4c83b))
+* **runner-manifests:** render egressAllow and serverCA values (RIG-5594) ([#2360](https://github.com/RigelBuild/compass/issues/2360)) ([f878fa8](https://github.com/RigelBuild/compass/commit/f878fa8cefe0c084b143f3c77f0f734b24beb848))
+* **runner:** bind a resume lifetime on the Runner after accept (RIG-4297) ([#1707](https://github.com/RigelBuild/compass/issues/1707)) ([c421fb1](https://github.com/RigelBuild/compass/commit/c421fb1e946f44dfe18e76783be92727554d222d))
+* **runner:** forward agent session blobs to the Server (RIG-1582) ([#1999](https://github.com/RigelBuild/compass/issues/1999)) ([e9b6983](https://github.com/RigelBuild/compass/commit/e9b6983f060be92a45dfc4c0beb6528cf4065a15))
+* **runnerhub:** accept projected tokens on the Runner door (RIG-4999) ([#2058](https://github.com/RigelBuild/compass/issues/2058)) ([599af8e](https://github.com/RigelBuild/compass/commit/599af8e2a9b64a09f68796b8f1e4841560b514e2))
+* **runnerhub:** relay and fetch session blobs for Runners (RIG-1582) ([#1997](https://github.com/RigelBuild/compass/issues/1997)) ([5d31dc0](https://github.com/RigelBuild/compass/commit/5d31dc0b441594c2f87c05859a0abc3a040e0b99))
+* **runnerhub:** signal one account's secrets version (RIG-5015) ([#2105](https://github.com/RigelBuild/compass/issues/2105)) ([257bbf0](https://github.com/RigelBuild/compass/commit/257bbf0d5b332ee7515b84834414c6bb6e567305))
+* **runner:** pass --agent-batching to agents as COMPASS_AGENT_BATCHING (RIG-5072) ([#2098](https://github.com/RigelBuild/compass/issues/2098)) ([0fb791b](https://github.com/RigelBuild/compass/commit/0fb791bfc8deb393bf1458971f7e2d0c611cc89d))
+* **runner:** read projected tokens from a file and adopt the Server-assigned id (RIG-5000) ([#2060](https://github.com/RigelBuild/compass/issues/2060)) ([14b108f](https://github.com/RigelBuild/compass/commit/14b108ff90ea366c7a418abc36bb14cf66c678f1))
+* **runner:** render projected-token identity and its admission policy (RIG-5001) ([#2061](https://github.com/RigelBuild/compass/issues/2061)) ([5f4b787](https://github.com/RigelBuild/compass/commit/5f4b7874881a6fc19fdf11cab235dc839ce59058))
+* **runner:** render the Runner DaemonSet and KVM device request ([#1773](https://github.com/RigelBuild/compass/issues/1773)) ([4cec371](https://github.com/RigelBuild/compass/commit/4cec371a71370447e09181dfe04c21d68495f54c))
+* **runner:** restore session blobs on resume (RIG-1582) ([#2000](https://github.com/RigelBuild/compass/issues/2000)) ([ecfc1ae](https://github.com/RigelBuild/compass/commit/ecfc1ae615acbaff638b301c0fa11b8c0cfa375e))
+* **runner:** span AgentGateway RPCs and strip stream spans (RIG-5313) ([#2259](https://github.com/RigelBuild/compass/issues/2259)) ([dc6ddd4](https://github.com/RigelBuild/compass/commit/dc6ddd420e56b9c7464c829a8a3bfc285129620f))
+* **runner:** span every Sessions command under the server trace (RIG-5316) ([#2267](https://github.com/RigelBuild/compass/issues/2267)) ([edd6ac6](https://github.com/RigelBuild/compass/commit/edd6ac614db120c6dca1481a972b84cdaf695333))
+* **runtime:** WorkspaceSource variant; Mounts carries the writable session volume (RIG-3281) ([#2119](https://github.com/RigelBuild/compass/issues/2119)) ([0bf231a](https://github.com/RigelBuild/compass/commit/0bf231aef72733c83857e780941492402030cf49))
+* **server-manifests:** render the Server, NATS and dev Postgres for Kubernetes (RIG-5596) ([#2363](https://github.com/RigelBuild/compass/issues/2363)) ([049a1af](https://github.com/RigelBuild/compass/commit/049a1af595e58d82ff5879d1d169bf4b42aec9d1))
+* **server:** accept an operator-supplied admin token file (RIG-2668) ([#2263](https://github.com/RigelBuild/compass/issues/2263)) ([f9ed6db](https://github.com/RigelBuild/compass/commit/f9ed6dbe472b9c2d82484251c30553e5a1d3a261))
+* **server:** add admin-only RenameAccount RPC (RIG-5151) ([#2226](https://github.com/RigelBuild/compass/issues/2226)) ([f626f86](https://github.com/RigelBuild/compass/commit/f626f8613165834e70eedee76ebc2bad38595c53))
+* **server:** add forge scope storage (RIG-4434) ([#1654](https://github.com/RigelBuild/compass/issues/1654)) ([e09539d](https://github.com/RigelBuild/compass/commit/e09539ddb171173eefe17c52289e97ce167f1044))
+* **server:** add owner peering approvals, RPCs and CLI (RIG-4361) ([#1678](https://github.com/RigelBuild/compass/issues/1678)) ([3db225b](https://github.com/RigelBuild/compass/commit/3db225b8e4a96397cfcf719868151f91e8b29240))
+* **server:** add SkipBatchWindow and the StartNowControl agent control (RIG-5071) ([#2087](https://github.com/RigelBuild/compass/issues/2087)) ([eb409a2](https://github.com/RigelBuild/compass/commit/eb409a23ce4371a96852b6b6d940a512cae6f70e))
+* **server:** AgentRepositoryService for agent workstream repositories (RIG-5015) ([#2107](https://github.com/RigelBuild/compass/issues/2107)) ([6738c0b](https://github.com/RigelBuild/compass/commit/6738c0baf60a1fabb4f0a0614a008aef6bcee2e2))
+* **server:** broker a repo-scoped GitHub App token into agent containers (RIG-4724) ([#2008](https://github.com/RigelBuild/compass/issues/2008)) ([fa4bb28](https://github.com/RigelBuild/compass/commit/fa4bb28b9ae0613fd93cc40478b81c27da7af238))
+* **server:** broker owner-grants fallback and typed mint errors (RIG-5022) ([#2103](https://github.com/RigelBuild/compass/issues/2103)) ([07f9020](https://github.com/RigelBuild/compass/commit/07f9020f6a5f059c073be63132674d7d539d6a9c))
+* **server:** configure forge scope enforcement and boot grants (RIG-4434) ([#1656](https://github.com/RigelBuild/compass/issues/1656)) ([9bbb94e](https://github.com/RigelBuild/compass/commit/9bbb94ec54530a802d3308ecffc29ec3d0af1464))
+* **server:** enforce forge write scopes by default (RIG-4950) ([#2056](https://github.com/RigelBuild/compass/issues/2056)) ([f71f2ba](https://github.com/RigelBuild/compass/commit/f71f2ba4a700dad706843bb0c07b04f32c5fc114))
+* **server:** gate forge writes on account scope grants (RIG-4434) ([#1655](https://github.com/RigelBuild/compass/issues/1655)) ([4637391](https://github.com/RigelBuild/compass/commit/4637391cf899bb7d43004be994817816146e7fe8))
+* **server:** gateway credential door takes the agent token (RIG-5204) ([#2204](https://github.com/RigelBuild/compass/issues/2204)) ([84ced89](https://github.com/RigelBuild/compass/commit/84ced89e2e5752e73544d3479abc718bf1448826))
+* **server:** owner-qualify agent author handles (RIG-4026) ([#1720](https://github.com/RigelBuild/compass/issues/1720)) ([1e42084](https://github.com/RigelBuild/compass/commit/1e42084689a2e84aebda9dad49742c7f6d386a64))
+* **server:** per-account first-run tour state (RIG-4505) ([#1687](https://github.com/RigelBuild/compass/issues/1687)) ([2c16dd0](https://github.com/RigelBuild/compass/commit/2c16dd0a61f1658eff882942bcc0bfa0a17ae290))
+* **server:** rate-limit GitHub credential mints with backoff (RIG-4435) ([#2302](https://github.com/RigelBuild/compass/issues/2302)) ([073abf9](https://github.com/RigelBuild/compass/commit/073abf9ce0e156e6e55fe7465e1295dab9debe41))
+* **server:** report build git rev via GetServerInfo (RIG-2039) ([#1760](https://github.com/RigelBuild/compass/issues/1760)) ([470dde8](https://github.com/RigelBuild/compass/commit/470dde8c5768eb3db0a61a5d7dc75228aec248df))
+* **server:** report Runner attachment as compass.runner health (RIG-5352) ([#2282](https://github.com/RigelBuild/compass/issues/2282)) ([cdfee2c](https://github.com/RigelBuild/compass/commit/cdfee2cb74f8d850b967c080bfbea57309e35cd5))
+* **server:** revoke the old GitHub credential on grant removal (RIG-4435) ([#2303](https://github.com/RigelBuild/compass/issues/2303)) ([da36275](https://github.com/RigelBuild/compass/commit/da3627503980f996b94e4c6f0904477cc3ff8a89))
+* **server:** serve an agent’s last credential on a transient mint failure (RIG-5015) ([#2106](https://github.com/RigelBuild/compass/issues/2106)) ([9553cc7](https://github.com/RigelBuild/compass/commit/9553cc7779c1c88b8ea3e4853531c3a6acf8227b))
+* **server:** serve gateway credentials from a sealed store (RIG-4746) ([#1859](https://github.com/RigelBuild/compass/issues/1859)) ([5c56bb5](https://github.com/RigelBuild/compass/commit/5c56bb5e1d426799b1e974b8efef5007c7bc19a6))
+* **server:** serve GatewayAuth on the network door (RIG-5082) ([#2117](https://github.com/RigelBuild/compass/issues/2117)) ([8b0d072](https://github.com/RigelBuild/compass/commit/8b0d072cbe877000453e81800cce9a1d081f1a33))
+* **server:** serve health on every door and mark NOT_SERVING on drain (RIG-5351) ([#2279](https://github.com/RigelBuild/compass/issues/2279)) ([b3b2060](https://github.com/RigelBuild/compass/commit/b3b2060656056d1df6c597b5106996b85aefda4c))
+* **server:** serve the model registry to the LLM gateway (RIG-3980) ([#2088](https://github.com/RigelBuild/compass/issues/2088)) ([b12166c](https://github.com/RigelBuild/compass/commit/b12166cf3371fe2c3d5f3b6f95f4f1f5e403406d))
+* **server:** span every handler mount and strip stream spans from work (RIG-5312) ([#2255](https://github.com/RigelBuild/compass/issues/2255)) ([8d6f1aa](https://github.com/RigelBuild/compass/commit/8d6f1aa4115bc745482f358d50999651600c87df))
+* **stack:** configurable host ports for bundled NATS and collector ([#1690](https://github.com/RigelBuild/compass/issues/1690)) ([b36c78f](https://github.com/RigelBuild/compass/commit/b36c78f91acaee369ff97b4ee658a401f1db4758))
+* **stack:** default the host tier's server to the keyring provider (RIG-3512) ([#2280](https://github.com/RigelBuild/compass/issues/2280)) ([33db616](https://github.com/RigelBuild/compass/commit/33db6167eee0b5ba9b3360bb1334aa7c1747e68a))
+* **stack:** wait for the started Runner to enroll before ready (RIG-4514) ([#1703](https://github.com/RigelBuild/compass/issues/1703)) ([e9aca7b](https://github.com/RigelBuild/compass/commit/e9aca7be3cda9f65704d792fd6a2944db2c68847))
+* **store:** agent config overlay store, merge, locks and layer lints (RIG-5516) ([#2346](https://github.com/RigelBuild/compass/issues/2346)) ([cf438ff](https://github.com/RigelBuild/compass/commit/cf438ff1a7f4d8b7119c2d7f9a72ee0e93e5c4bd))
+* **store:** agent forge scope revoke, list and parent copy (RIG-5015) ([#2104](https://github.com/RigelBuild/compass/issues/2104)) ([91b0b16](https://github.com/RigelBuild/compass/commit/91b0b162eceb505ad638eeb89222a542e454029b))
+* **store:** attach channels to agents with tree or explicit membership (RIG-4186) ([#1762](https://github.com/RigelBuild/compass/issues/1762)) ([5d7f1af](https://github.com/RigelBuild/compass/commit/5d7f1afe2278aa817b814b775664651f55f978c4))
+* **store:** authorize channel writes and reads by tree participation (RIG-4187) ([#1764](https://github.com/RigelBuild/compass/issues/1764)) ([5fdec0d](https://github.com/RigelBuild/compass/commit/5fdec0d33f2b2825930e24c9fa85ad0e224e2cfd))
+* **store:** index session blobs and store them by content hash (RIG-1582) ([#1996](https://github.com/RigelBuild/compass/issues/1996)) ([6c2e829](https://github.com/RigelBuild/compass/commit/6c2e8298b7945c5f5a4c51e234bb4b6c643dea37))
+* **store:** let agent accounts own forge scope rows (RIG-5022) ([#2101](https://github.com/RigelBuild/compass/issues/2101)) ([39f21f3](https://github.com/RigelBuild/compass/commit/39f21f311edcbdcf66711d6c63af1c764f751c88))
+* **store:** move the transcript archive flush off the commit path (RIG-5158) ([#2223](https://github.com/RigelBuild/compass/issues/2223)) ([b7ea071](https://github.com/RigelBuild/compass/commit/b7ea071711777c8601848aec6187698a1d85b056))
+* **store:** owner-set visibility and derived TREE members on channel reads (RIG-4188) ([#1772](https://github.com/RigelBuild/compass/issues/1772)) ([2bb1497](https://github.com/RigelBuild/compass/commit/2bb1497ee4ea5baa787943258ee8137769364d30))
+* **store:** record a client span per Postgres query under a request (RIG-5510) ([#2333](https://github.com/RigelBuild/compass/issues/2333)) ([17af755](https://github.com/RigelBuild/compass/commit/17af755369e1f1b8f7b11da4efb66b2fa2c7793e))
+* **store:** status board tables, patch merge and board reads (RIG-5170) ([#2212](https://github.com/RigelBuild/compass/issues/2212)) ([2ea6f4a](https://github.com/RigelBuild/compass/commit/2ea6f4a6aa0390500ffe1a2fea8a91e133a640b0))
+* **store:** store pull requests and their issue links (RIG-4034) ([#1900](https://github.com/RigelBuild/compass/issues/1900)) ([58b374a](https://github.com/RigelBuild/compass/commit/58b374a357e7f395adfff9e3a518653d4997e906))
+* **store:** TREE subscriptions and delivery over derived participants (RIG-4189) ([#1778](https://github.com/RigelBuild/compass/issues/1778)) ([4eabb2d](https://github.com/RigelBuild/compass/commit/4eabb2d961e062da3eb4e7ed945165959f28f0ff))
+* **store:** unique sibling channel-group names with a repairing migration (RIG-3030) ([#1595](https://github.com/RigelBuild/compass/issues/1595)) ([45b71ef](https://github.com/RigelBuild/compass/commit/45b71efa12b09d6400bfef0bbe668d4ea2b3572a))
+* **ui:** add Start now to the observation pane (RIG-5074) ([#2125](https://github.com/RigelBuild/compass/issues/2125)) ([a51caa6](https://github.com/RigelBuild/compass/commit/a51caa63ea0069949469149692f01e5fa52eb561))
+* **ui:** add the agent board panel and tasks search over ListAgentBoards (RIG-5409) ([#2300](https://github.com/RigelBuild/compass/issues/2300)) ([aaa6bec](https://github.com/RigelBuild/compass/commit/aaa6becddb05b0e59a88b6c6c1083d93eccbaba1))
+* **ui:** Appearance settings section with a reduce-motion override (RIG-4972) ([#2066](https://github.com/RigelBuild/compass/issues/2066)) ([b7f3d15](https://github.com/RigelBuild/compass/commit/b7f3d15aa689beefef79f6419cbee8f7cf6ca666))
+* **ui:** Backlog and Done as Bridge segments (RIG-4968) ([#2053](https://github.com/RigelBuild/compass/issues/2053)) ([afe8748](https://github.com/RigelBuild/compass/commit/afe8748574fa88d29c9d1904d318323e54a6abcd))
+* **ui:** board summary badges in the sidebar and FleetPane (RIG-5177) ([#2290](https://github.com/RigelBuild/compass/issues/2290)) ([cf33dca](https://github.com/RigelBuild/compass/commit/cf33dca8e490b0e5b2bed6e77a83c45e630d60ba))
+* **ui:** chrome on night with selection pane edges (RIG-4966) ([#2050](https://github.com/RigelBuild/compass/issues/2050)) ([8fef455](https://github.com/RigelBuild/compass/commit/8fef455c9067033d602398e855bef021c3cdab6f))
+* **ui:** first-run setup screen and server connect form ([#1757](https://github.com/RigelBuild/compass/issues/1757)) ([1f70448](https://github.com/RigelBuild/compass/commit/1f70448920af04e7f32dded0a87e77a9077e071c))
+* **ui:** first-run tour overlay with spotlight and anchors ([#1744](https://github.com/RigelBuild/compass/issues/1744)) ([d05fa8c](https://github.com/RigelBuild/compass/commit/d05fa8c9d930f0c05baddda5ce36bab2c8e94012))
+* **ui:** General settings section (RIG-4971) ([#2063](https://github.com/RigelBuild/compass/issues/2063)) ([1e73c2f](https://github.com/RigelBuild/compass/commit/1e73c2f451092d7800c89395756bd5b72948abb6))
+* **ui:** issue-mirroring settings and Mirror to issue control (RIG-5537) ([#2336](https://github.com/RigelBuild/compass/issues/2336)) ([cdc27be](https://github.com/RigelBuild/compass/commit/cdc27be135e2651c9ea476778aa59195109abfff))
+* **ui:** keys on a focused card title ref step, open and return (RIG-5238) ([#2322](https://github.com/RigelBuild/compass/issues/2322)) ([2838a8e](https://github.com/RigelBuild/compass/commit/2838a8e5ea6dc6e225ef104267487e3295001456))
+* **ui:** message anatomy from the site (RIG-4963) ([#2043](https://github.com/RigelBuild/compass/issues/2043)) ([523a1c2](https://github.com/RigelBuild/compass/commit/523a1c2b328de825a4f3d2e191821b53572b438b))
+* **ui:** New tab always opens a new tab (RIG-4676) ([#1798](https://github.com/RigelBuild/compass/issues/1798)) ([3069ccb](https://github.com/RigelBuild/compass/commit/3069ccb8135eb0e009572be42a75c276a3c8b0cf))
+* **ui:** project agent lifecycle from session status (RIG-4969) ([#2044](https://github.com/RigelBuild/compass/issues/2044)) ([80d10f0](https://github.com/RigelBuild/compass/commit/80d10f03b4a2fc4a4fe4d4f8061f7a42d9c34596))
+* **ui:** R and Shift+R focus the cursor card's linked title refs (RIG-5238) ([#2320](https://github.com/RigelBuild/compass/issues/2320)) ([dc57223](https://github.com/RigelBuild/compass/commit/dc57223010ca1483d576a23106e8085c9b5cc9d1))
+* **ui:** remove the client-side tracker editor from Settings (RIG-4973) ([#2067](https://github.com/RigelBuild/compass/issues/2067)) ([131ec21](https://github.com/RigelBuild/compass/commit/131ec210f7572c83a7787ee27ad080801321d661))
+* **ui:** Settings shell with a route per section (RIG-4970) ([#2059](https://github.com/RigelBuild/compass/issues/2059)) ([62a692c](https://github.com/RigelBuild/compass/commit/62a692cbb2eb552b096c49e6e4f2cd6141eaff40))
+* **ui:** share the linked-ref rule and seed ref-link rules in test mounts (RIG-5238) ([#2318](https://github.com/RigelBuild/compass/issues/2318)) ([a151a6f](https://github.com/RigelBuild/compass/commit/a151a6f1737915d5dd1301266e82a29cdf3d73a7))
+* **ui:** ship the brand faces with the app (RIG-4959) ([#2036](https://github.com/RigelBuild/compass/issues/2036)) ([b90f2ca](https://github.com/RigelBuild/compass/commit/b90f2ca4fd59ecb25004e778681263961afde528))
+* **ui:** site glyph cells and a 2x state dot (RIG-4962) ([#2040](https://github.com/RigelBuild/compass/issues/2040)) ([5c08fb3](https://github.com/RigelBuild/compass/commit/5c08fb37819290c60328ec4d71f8527f478b3768))
+* **ui:** site greens and hierarchy by color (RIG-4961) ([#2039](https://github.com/RigelBuild/compass/issues/2039)) ([d931ca4](https://github.com/RigelBuild/compass/commit/d931ca42c2d6297fce39003c6d47033abb266627))
+* **ui:** square corners everywhere (RIG-4960) ([#2037](https://github.com/RigelBuild/compass/issues/2037)) ([51eb7c3](https://github.com/RigelBuild/compass/commit/51eb7c3623db9d704dc8b8fc11834b22363add14))
+* **ui:** stack the agent log panel in narrow panes (RIG-4682) ([#1787](https://github.com/RigelBuild/compass/issues/1787)) ([f3ee331](https://github.com/RigelBuild/compass/commit/f3ee3319e9e66d4558cbc511ffd5e3297d191bc1))
+* **ui:** text entry uses the input and button primitives (RIG-4964) ([#2047](https://github.com/RigelBuild/compass/issues/2047)) ([433d4a7](https://github.com/RigelBuild/compass/commit/433d4a749b98092ca5f7c76fb9326da1afebc5e1))
+* **ui:** the agent tree view at /agents (RIG-4967) ([#2052](https://github.com/RigelBuild/compass/issues/2052)) ([9a52094](https://github.com/RigelBuild/compass/commit/9a52094da1fb4dcfa9eada18a83d869db35cde67))
+* **ui:** the needle mark alone in the top bar (RIG-4965) ([#2048](https://github.com/RigelBuild/compass/issues/2048)) ([ee74e79](https://github.com/RigelBuild/compass/commit/ee74e7910d71b82b99278f9eb0633ccc7ec05c56))
+* **ui:** tour overlay, spotlight and anchors (RIG-4507) ([#1782](https://github.com/RigelBuild/compass/issues/1782)) ([c5e4bbb](https://github.com/RigelBuild/compass/commit/c5e4bbb1ff08b53081e662c93bf74bff88c38ab7))
+* **ui:** tour state, demo data seam and store.tour controller (RIG-4506) ([#1734](https://github.com/RigelBuild/compass/issues/1734)) ([ed785b9](https://github.com/RigelBuild/compass/commit/ed785b9f06ea8d11949df3daf1492924e82edd0a))
+* **ui:** tour.start palette command and idle-deferred first-run start (RIG-4509) ([#1784](https://github.com/RigelBuild/compass/issues/1784)) ([7e9a3f6](https://github.com/RigelBuild/compass/commit/7e9a3f624ab6f207215479a827c07fd352ff00bc))
+* **ui:** two-pane split with a resizable splitter (RIG-4446) ([#1780](https://github.com/RigelBuild/compass/issues/1780)) ([9fa2751](https://github.com/RigelBuild/compass/commit/9fa2751d6ad3f36a38ef5fd92a2a8f5b620a7e31))
+* **ui:** view tab strip with keep-alive and open-in-tab links (RIG-4444) ([#1755](https://github.com/RigelBuild/compass/issues/1755)) ([04278b6](https://github.com/RigelBuild/compass/commit/04278b6f89b85f8766e6723ce18aa9cbac8399a2))
+* **ui:** W leader chords and palette commands for tabs and panes (RIG-4445) ([#1770](https://github.com/RigelBuild/compass/issues/1770)) ([2afaa08](https://github.com/RigelBuild/compass/commit/2afaa085f7c05f7cb69f7696b0c41be1a3d7d4b3))
+* **ui:** window layout model, hash sync and session persistence (RIG-4443) ([#1743](https://github.com/RigelBuild/compass/issues/1743)) ([26f50c3](https://github.com/RigelBuild/compass/commit/26f50c391e2b9095e58ab8df6edf9bc952dda760))
+* **usage:** derive compute-usage rollups and prune the raw compute log (RIG-2872) ([#1513](https://github.com/RigelBuild/compass/issues/1513)) ([c144385](https://github.com/RigelBuild/compass/commit/c144385dd5ed16bf354e97824a7c7efc6702fb9a))
+* **vfs:** put Stamp and ReconcileOrphans on VolumeManager (RIG-3309) ([#1939](https://github.com/RigelBuild/compass/issues/1939)) ([dd8b65a](https://github.com/RigelBuild/compass/commit/dd8b65a327f58529af3649e5c07dd8c9c92dd160))
+* **vfs:** snapshot store with reflink probe, copy fallback and (account, repo) index (RIG-3279) ([#2094](https://github.com/RigelBuild/compass/issues/2094)) ([79550f3](https://github.com/RigelBuild/compass/commit/79550f3c3ce95bc75e740e78b1078462f4d16055))
+* **vfs:** VirtualFS seam with checkout/snapshot/customer-mount backend (RIG-3280) ([#2115](https://github.com/RigelBuild/compass/issues/2115)) ([56a05b6](https://github.com/RigelBuild/compass/commit/56a05b6ae9f42b13a2fbeb9fb5c70a8e18526d22))
+
+
+### Bug Fixes
+
+* **agent-image:** build the agent with the pinned bun ([#2001](https://github.com/RigelBuild/compass/issues/2001)) ([a295957](https://github.com/RigelBuild/compass/commit/a295957b0a926e5951780c423e1904bc136ad411))
+* **agent-image:** read the lock's per-platform manifest key in the prune (RIG-1750) ([#2198](https://github.com/RigelBuild/compass/issues/2198)) ([a2e9391](https://github.com/RigelBuild/compass/commit/a2e93910e5a7b48426ce082ef411a6fe018b0079))
+* **bridge:** never follow redirects from the TLS target ([#1963](https://github.com/RigelBuild/compass/issues/1963)) ([1dd01e0](https://github.com/RigelBuild/compass/commit/1dd01e0d980c82997533088461c8dafa168778bd))
+* **build:** ship the pinned secretspec CLI with compass-server (RIG-4583) ([#1758](https://github.com/RigelBuild/compass/issues/1758)) ([1024cd5](https://github.com/RigelBuild/compass/commit/1024cd522fe2f712ab9406e05ca2b07b18a12823))
+* **ci:** run design-ledger touch-coupling on PRs, fail if unwired (RIG-3924) ([#1799](https://github.com/RigelBuild/compass/issues/1799)) ([e9aea23](https://github.com/RigelBuild/compass/commit/e9aea2340481c629ba9f118e858c811c5b9e5d5d))
+* **ci:** take PR changed paths from the merge ref's first parent (RIG-5229) ([#2207](https://github.com/RigelBuild/compass/issues/2207)) ([bf3c04c](https://github.com/RigelBuild/compass/commit/bf3c04c30381f20086c5fac6d59551ca4a575815))
+* **cli:** close the enrollment CLI review nits (RIG-1380) ([#2229](https://github.com/RigelBuild/compass/issues/2229)) ([da93b73](https://github.com/RigelBuild/compass/commit/da93b73b5fdc00689acff073bf44e68385d54bdd))
+* **comms:** trim a departing member's final ChannelChanged to the channel id (RIG-1325) ([#1745](https://github.com/RigelBuild/compass/issues/1745)) ([50b3224](https://github.com/RigelBuild/compass/commit/50b3224c6d41fad32e42dea38f835c8c53bbad55))
+* **compass-agent:** anchor abort mutants on code, not comment text (RIG-3778) ([#2258](https://github.com/RigelBuild/compass/issues/2258)) ([042f9f0](https://github.com/RigelBuild/compass/commit/042f9f027e824e13b2a9de1aefebea55c28fa46f))
+* **compass-app:** ask before restarting a version-mismatched embedded stack (RIG-5102) ([#2133](https://github.com/RigelBuild/compass/issues/2133)) ([c8633a2](https://github.com/RigelBuild/compass/commit/c8633a26677a42b430f0c87143062967290b5160))
+* **compass-go:** pin RPC contracts and cap socket-door reads ([#2340](https://github.com/RigelBuild/compass/issues/2340)) ([865c4f0](https://github.com/RigelBuild/compass/commit/865c4f09963ab022c234b64c9e2261aa28c06c69))
+* **deps:** clear the lockfile's known advisories (RIG-5013) ([#2186](https://github.com/RigelBuild/compass/issues/2186)) ([4edeba7](https://github.com/RigelBuild/compass/commit/4edeba7f0c61843081257271eb6215830b89e903))
+* **deps:** update go dependencies ([#2160](https://github.com/RigelBuild/compass/issues/2160)) ([8210993](https://github.com/RigelBuild/compass/commit/82109933a4ddde4eaa32b00a1ea0cafe7f3523b2))
+* **deps:** update typescript dependencies ([#2161](https://github.com/RigelBuild/compass/issues/2161)) ([95bbe7f](https://github.com/RigelBuild/compass/commit/95bbe7fa771cc220057a592c84f6b1df1f2c2d0c))
+* **design-ledger-gate:** exempt automation branches only for their bot (RIG-4823) ([#2076](https://github.com/RigelBuild/compass/issues/2076)) ([89a42f0](https://github.com/RigelBuild/compass/commit/89a42f061da506fd5b0c7f17c7c38b7dcb2c057a))
+* **design-ledger-gate:** exempt Trunk merge-queue PRs from touch-coupling (RIG-4821) ([#1922](https://github.com/RigelBuild/compass/issues/1922)) ([b698561](https://github.com/RigelBuild/compass/commit/b698561b3f80d0e5ad4e18ec4e1904ac1533ff11))
+* **design-ledger-gate:** govern every record under a governed root (RIG-3417) ([#1982](https://github.com/RigelBuild/compass/issues/1982)) ([32b0959](https://github.com/RigelBuild/compass/commit/32b0959ee83026c2da5f8db332ba04d4152a28bb))
+* **devenv:** default GOLANGCI_LINT_CACHE to the per-clone lint cache (RIG-1465) ([#1792](https://github.com/RigelBuild/compass/issues/1792)) ([56feb99](https://github.com/RigelBuild/compass/commit/56feb9905e096cef6febed7b7a09acdcadd67d36))
+* **devenv:** refuse a NUL or UTF-16 version.txt before stamping (RIG-3439) ([#1789](https://github.com/RigelBuild/compass/issues/1789)) ([5b23d08](https://github.com/RigelBuild/compass/commit/5b23d08ac974f62e874fc656e6c7f854132ff1e0))
+* **e2e:** carry the shared stand-up failure text into every leg (RIG-4613) ([#1759](https://github.com/RigelBuild/compass/issues/1759)) ([e388948](https://github.com/RigelBuild/compass/commit/e3889482a94683b0cab6574712391a22845edc94))
+* **fabric:** detect a consumer reaped while no pull was waiting (RIG-3448) ([#1876](https://github.com/RigelBuild/compass/issues/1876)) ([4124a94](https://github.com/RigelBuild/compass/commit/4124a94159819efb73928001124efb8a759d78f7))
+* **fabric:** give the max-deliveries advisory fetch its own deadline (RIG-4786) ([#1875](https://github.com/RigelBuild/compass/issues/1875)) ([04a16d2](https://github.com/RigelBuild/compass/commit/04a16d23e8116b970bc0c299604f62f3baf4d072))
+* **fabric:** park an event once when a late Term races the advisory (RIG-4494) ([#1683](https://github.com/RigelBuild/compass/issues/1683)) ([6e9a113](https://github.com/RigelBuild/compass/commit/6e9a113b2966af061142b2f1f4f1956cc2f53101))
+* **fabric:** reap abandoned durable consumers after 2x MaxAge (RIG-3448) ([#1807](https://github.com/RigelBuild/compass/issues/1807)) ([1ddda30](https://github.com/RigelBuild/compass/commit/1ddda30e6685fddf6c15cb2c1e2abf5081c1492e))
+* **forge:** archive live-oracle Linear issues with Bearer auth (RIG-3299) ([#2314](https://github.com/RigelBuild/compass/issues/2314)) ([00783cd](https://github.com/RigelBuild/compass/commit/00783cd370a0d6f1f6e46b896737d9de409335d1))
+* **forge:** discard a live-oracle issue whose timed-out create committed (RIG-5468) ([#2364](https://github.com/RigelBuild/compass/issues/2364)) ([c9dcdad](https://github.com/RigelBuild/compass/commit/c9dcdad89145fff66b35bb5fd8a75a6c262c9695))
+* **forge:** leave a PR's checks unset when no roll-up was fetched ([#1680](https://github.com/RigelBuild/compass/issues/1680)) ([ca5a14e](https://github.com/RigelBuild/compass/commit/ca5a14e7b0cb8e831738c65ea8b0e06deb239e2e))
+* **forge:** reuse the CreateIssue node id for follow-up writes (RIG-4859) ([#2035](https://github.com/RigelBuild/compass/issues/2035)) ([5a59515](https://github.com/RigelBuild/compass/commit/5a595153a7972595eaae102fb24813c7105524cc))
+* **gateway:** refuse a steer or deliver control without its message (RIG-2464) ([#2208](https://github.com/RigelBuild/compass/issues/2208)) ([7cc9bdc](https://github.com/RigelBuild/compass/commit/7cc9bdc596772bb5b8a23413fa7a93ee4d9f3702))
+* **go:** serialize concurrent golangci-lint runs (RIG-4813) ([#1889](https://github.com/RigelBuild/compass/issues/1889)) ([419f3ad](https://github.com/RigelBuild/compass/commit/419f3ada001eed2d39feae6a59a1adb5d8ed1763))
+* **guest-image:** read the agent image anonymously in the relock ([#2074](https://github.com/RigelBuild/compass/issues/2074)) ([4374f4c](https://github.com/RigelBuild/compass/commit/4374f4c3c3b0340ebbdf889b217606f586302716))
+* **hooks:** bound the pre-push moon ci concurrency to 4 ([#1682](https://github.com/RigelBuild/compass/issues/1682)) ([4fae441](https://github.com/RigelBuild/compass/commit/4fae441cbf55cdc1f20cca668c3060206ea3696d))
+* **linearagent:** skip Linear emits for a replayed delivery (RIG-4133) ([#1781](https://github.com/RigelBuild/compass/issues/1781)) ([5c58c64](https://github.com/RigelBuild/compass/commit/5c58c644a7d49bf4f78fb52f338447d28345d1f6))
+* **macos-bundle:** inject the pre-create flush so tests never run a real sync (RIG-4476) ([#1671](https://github.com/RigelBuild/compass/issues/1671)) ([7d7f1a9](https://github.com/RigelBuild/compass/commit/7d7f1a92152c980fa160ed6579895a2ded5aa5e0))
+* make main green again (RIG-4878) ([#1990](https://github.com/RigelBuild/compass/issues/1990)) ([ea5c036](https://github.com/RigelBuild/compass/commit/ea5c03617cfc4dadf76d32c1efbf16e24eaf50a8))
+* **microvm:** bound Shutdown reap grace by its ctx (RIG-3240) ([#2073](https://github.com/RigelBuild/compass/issues/2073)) ([e9faac3](https://github.com/RigelBuild/compass/commit/e9faac344a3af341cb27ec7109e18d8c5f70b218))
+* **microvm:** stop passt mapping the guest gateway to the host (RIG-3428) ([#1984](https://github.com/RigelBuild/compass/issues/1984)) ([ce232e8](https://github.com/RigelBuild/compass/commit/ce232e81293e92f6108a5255ad2d3c0bc950c9e9))
+* **microvm:** translate virtiofsd ids instead of mapping namespace-root (RIG-3330) ([#1941](https://github.com/RigelBuild/compass/issues/1941)) ([768d71a](https://github.com/RigelBuild/compass/commit/768d71a01ef14e375905f965767ec3eb27f0b3c5))
+* **release:** gate the runner image on all of go/ (RIG-5590) ([#2357](https://github.com/RigelBuild/compass/issues/2357)) ([9044357](https://github.com/RigelBuild/compass/commit/9044357cc429cfe1ef5405b4c992e3e81b76af62))
+* **release:** republish guest and runner images on devenv.lock changes ([#1689](https://github.com/RigelBuild/compass/issues/1689)) ([9a39795](https://github.com/RigelBuild/compass/commit/9a39795bee9562bb03b34ee014a0dae1b42e4938))
+* **renovate:** accept = and ? in package-diff artifact versions ([#2298](https://github.com/RigelBuild/compass/issues/2298)) ([93d7f84](https://github.com/RigelBuild/compass/commit/93d7f8426bd53b27a946e2049fcb14427dcbd23b))
+* **renovate:** drop the Meissa rule's schedule window (RIG-4852) ([#2019](https://github.com/RigelBuild/compass/issues/2019)) ([fbf679d](https://github.com/RigelBuild/compass/commit/fbf679d3f7dc0587abcc2c13ee23a46693f04fb5))
+* **renovate:** let the daily cron alone set the cadence (RIG-4852) ([#1983](https://github.com/RigelBuild/compass/issues/1983)) ([2b42dcc](https://github.com/RigelBuild/compass/commit/2b42dcc579a35522879ab13c03c90b95a6a0b4ff))
+* **renovate:** lift the hourly PR cap that starves daily runs (RIG-4935) ([#2075](https://github.com/RigelBuild/compass/issues/2075)) ([b08ac5d](https://github.com/RigelBuild/compass/commit/b08ac5dc9dfa6339942b6b8366de9895c7543aa5))
+* **renovate:** read devenv build JSON in the package-diff collector ([#2295](https://github.com/RigelBuild/compass/issues/2295)) ([dc6b2e3](https://github.com/RigelBuild/compass/commit/dc6b2e38c5bcb071c657527a50d1555db041010d))
+* **renovate:** refresh the entrypoint FOD through its agent-image vehicle ([#2030](https://github.com/RigelBuild/compass/issues/2030)) ([9da4903](https://github.com/RigelBuild/compass/commit/9da49034e9e52ba2b8fe9280b27ac2d645f412b5))
+* **repo:** exempt release CHANGELOG from MD050 (RIG-1746) ([#1650](https://github.com/RigelBuild/compass/issues/1650)) ([f89fa83](https://github.com/RigelBuild/compass/commit/f89fa83fd246414498e22e712507110e4bb63864))
+* **runner-image:** pass the runner lane to closureChanges in its gate test (RIG-5590) ([#2374](https://github.com/RigelBuild/compass/issues/2374)) ([7e616fa](https://github.com/RigelBuild/compass/commit/7e616fa0004408339d8eda7af148be35a8aa6808))
+* **runner:** bound ControlAck size before decode (RIG-4777) ([#1849](https://github.com/RigelBuild/compass/issues/1849)) ([31f37bd](https://github.com/RigelBuild/compass/commit/31f37bd2cae068bd459d7b6ea6e83d136a5f7a2f))
+* **runnerhub:** cap inbound RunnerService messages (RIG-3586) ([#1676](https://github.com/RigelBuild/compass/issues/1676)) ([f1c3291](https://github.com/RigelBuild/compass/commit/f1c3291df5c5c1e5bb59e5d4f4d656ee786929ba))
+* **runnerhub:** ERRORED cleanup releases only the binding it saw (RIG-4742) ([#1810](https://github.com/RigelBuild/compass/issues/1810)) ([933a535](https://github.com/RigelBuild/compass/commit/933a535b0fffc45ed0dc9aa89bb40472ec34ef37))
+* **runnerhub:** fail enrollment when the durable reap fails (RIG-3691) ([#1700](https://github.com/RigelBuild/compass/issues/1700)) ([c7a9a5f](https://github.com/RigelBuild/compass/commit/c7a9a5ffc3447c8a26a54cb9969f2a03c8a19b99))
+* **runnerhub:** ignore lifecycle frames that arrive after ERRORED (RIG-4452) ([#1774](https://github.com/RigelBuild/compass/issues/1774)) ([1ee489e](https://github.com/RigelBuild/compass/commit/1ee489e33bb3f4b77742b499f2b84e1c8b3e70b8))
+* **runnerhub:** one distinct code for an unbound caller session on every relay leg (RIG-5124) ([#2214](https://github.com/RigelBuild/compass/issues/2214)) ([48c24fd](https://github.com/RigelBuild/compass/commit/48c24fdd468cc12dfca82a43e5126e0695974e2b))
+* **runnerhub:** report a token-store fault as Unavailable, not Unauthenticated (RIG-4529) ([#1711](https://github.com/RigelBuild/compass/issues/1711)) ([056c388](https://github.com/RigelBuild/compass/commit/056c38810ebfa03b8bf24106d544da25f0632b65))
+* **runnerhub:** resolve fetched secrets under the agent tenant (RIG-4912) ([#2121](https://github.com/RigelBuild/compass/issues/2121)) ([af24e74](https://github.com/RigelBuild/compass/commit/af24e7415e7a18d97b6f58ba87e840dccfa5b8cd))
+* **runnerhub:** run Runner relays under the session tenant (RIG-5110) ([#2123](https://github.com/RigelBuild/compass/issues/2123)) ([dbb08fc](https://github.com/RigelBuild/compass/commit/dbb08fcb04ba3ff6678b9bb0d4deaa1596ea1103))
+* **runnerhub:** scope the faulted-reap read-through refusal per Runner (RIG-3691) ([#1681](https://github.com/RigelBuild/compass/issues/1681)) ([7e8faf5](https://github.com/RigelBuild/compass/commit/7e8faf50816d6c3f550ccb02a884c0efeed2a052))
+* **runnerhub:** serialize enroll reaps with session promotion ([#1756](https://github.com/RigelBuild/compass/issues/1756)) ([77a78f5](https://github.com/RigelBuild/compass/commit/77a78f530274c3561fd3b978a82e1ddac77c0908))
+* **runner:** retry enrollment with bounded backoff (RIG-3691) ([#1699](https://github.com/RigelBuild/compass/issues/1699)) ([3058dcb](https://github.com/RigelBuild/compass/commit/3058dcb7b1809b08aceeebc6e31aa18360088bb9))
+* **runner:** run the startup preflight under the signal ctx (RIG-3218) ([#1790](https://github.com/RigelBuild/compass/issues/1790)) ([ba07785](https://github.com/RigelBuild/compass/commit/ba07785e967100eb47161543c744768e150be2c9))
+* **runner:** sweep detached exec sessions when an agent stops (RIG-4708) ([#1805](https://github.com/RigelBuild/compass/issues/1805)) ([4be37e2](https://github.com/RigelBuild/compass/commit/4be37e293d773084623df80228ca784f4ca48109))
+* **runtime:** don't cancel podman start/run mid netns setup (RIG-5334) ([#2305](https://github.com/RigelBuild/compass/issues/2305)) ([1371ecf](https://github.com/RigelBuild/compass/commit/1371ecf5b9869cdc7399f6cf9517f8cbe1502c68))
+* **runtime:** kill the in-container process group when a CLI exec client dies (RIG-4181) ([#1791](https://github.com/RigelBuild/compass/issues/1791)) ([9b77e93](https://github.com/RigelBuild/compass/commit/9b77e93b82fbb321030ae50136826cad695d2548))
+* **runtime:** refuse to start when containers.conf opens a pasta forward (RIG-5249) ([#2235](https://github.com/RigelBuild/compass/issues/2235)) ([19ab097](https://github.com/RigelBuild/compass/commit/19ab097b4ceaf2cab47d14f84c86428f108f808d))
+* **runtime:** report unstartable exec programs as exit 127/126 on every backend (RIG-5121) ([#2225](https://github.com/RigelBuild/compass/issues/2225)) ([34863c1](https://github.com/RigelBuild/compass/commit/34863c1f35d71fc3574921a85846e9cf8a07c7f7))
+* **secrets:** name the dotenv file when it cannot be opened (RIG-5589) ([#2362](https://github.com/RigelBuild/compass/issues/2362)) ([27e1166](https://github.com/RigelBuild/compass/commit/27e116639f525e174d6611f15f7affb436d55461))
+* **server:** apply review fixes to agent workstream repositories (RIG-5015) ([#2266](https://github.com/RigelBuild/compass/issues/2266)) ([c683c98](https://github.com/RigelBuild/compass/commit/c683c981371964924a75924f237dcf49a76dc715))
+* **server:** bound header-read and idle time on the UDS and dev doors (RIG-1258) ([#2368](https://github.com/RigelBuild/compass/issues/2368)) ([b5a8f10](https://github.com/RigelBuild/compass/commit/b5a8f10e92f3585a0b240d462e61c89bcce3ec01))
+* **server:** cancel and join the runner-ready seed in Serve's drain (RIG-1953) ([#2176](https://github.com/RigelBuild/compass/issues/2176)) ([48b3407](https://github.com/RigelBuild/compass/commit/48b34077ba2c87ce86cc5cb4a90559cff068e0be))
+* **server:** carry subscription scope and prove forge_subscribe over the wire (RIG-2732) ([#2007](https://github.com/RigelBuild/compass/issues/2007)) ([72b3af3](https://github.com/RigelBuild/compass/commit/72b3af3707f69420534ad5ae887c5ed97fd1468c))
+* **server:** close doors when the shutdown drain overruns (RIG-1252) ([#1785](https://github.com/RigelBuild/compass/issues/1785)) ([231a8be](https://github.com/RigelBuild/compass/commit/231a8be7a55c1ca0643384c0a67aa0220916ac85))
+* **server:** match the whole socket identity before cleanup removes it (RIG-4696) ([#1786](https://github.com/RigelBuild/compass/issues/1786)) ([72ad0c1](https://github.com/RigelBuild/compass/commit/72ad0c17c9b8e734de6cfd3d13535163b369b180))
+* **server:** never deliver or accept a user GitHub secret (RIG-4949) ([#2055](https://github.com/RigelBuild/compass/issues/2055)) ([9d54866](https://github.com/RigelBuild/compass/commit/9d54866be61d85b264ceeb2ed0d259e6a3de2fb7))
+* **server:** reject forge coordinates registered with an empty host (RIG-3870) ([#1667](https://github.com/RigelBuild/compass/issues/1667)) ([e9e698f](https://github.com/RigelBuild/compass/commit/e9e698f802a702c1bd67b07280ea1fb8aa73200b))
+* **server:** reuse a still-valid bootstrap admin token on restart ([#1808](https://github.com/RigelBuild/compass/issues/1808)) ([d88cc15](https://github.com/RigelBuild/compass/commit/d88cc15ef0e0a7857aa91b6c671f1f3c2f24cad4))
+* **server:** warn when the admin-token state dir is shared ([#1801](https://github.com/RigelBuild/compass/issues/1801)) ([cd1c445](https://github.com/RigelBuild/compass/commit/cd1c445feeb86878238f455f7158a1127e943a38))
+* **sql-migration-gate:** fail closed on a shallow clone instead of deepening it (RIG-4889) ([#2149](https://github.com/RigelBuild/compass/issues/2149)) ([645355f](https://github.com/RigelBuild/compass/commit/645355ff81c430b13f5f73192780ceb36d849a91))
+* **stack:** bound container teardown by ctx and never block Phase A (RIG-4571) ([#1748](https://github.com/RigelBuild/compass/issues/1748)) ([3a26d4b](https://github.com/RigelBuild/compass/commit/3a26d4b7d5e578a597b54c13c446067be6921b6a))
+* **stack:** confirm cross-process teardown by group exit, not socket alone (RIG-3937) ([#1657](https://github.com/RigelBuild/compass/issues/1657)) ([94067d9](https://github.com/RigelBuild/compass/commit/94067d9041ff125b36fe8c6c6ef7c2e2e30c28a3))
+* **stack:** default the microVM runner run root to the runtime dir (RIG-4514) ([#1693](https://github.com/RigelBuild/compass/issues/1693)) ([f3beee1](https://github.com/RigelBuild/compass/commit/f3beee1d6909589762cb6a30b444f2dc829190dd))
+* **stack:** hand compass-server a stack-bound network-door listener ([#1806](https://github.com/RigelBuild/compass/issues/1806)) ([2145218](https://github.com/RigelBuild/compass/commit/21452184972165845f946298d31612ffdb8a6454))
+* **store:** a nested channel group takes its parent visibility (RIG-4750) ([#1940](https://github.com/RigelBuild/compass/issues/1940)) ([dc9dc82](https://github.com/RigelBuild/compass/commit/dc9dc82984704eb6e7ad36965522f1e30f8499aa))
+* **store:** cap the pgx pool at 10 unless the DSN sets pool_max_conns (RIG-2300) ([#2137](https://github.com/RigelBuild/compass/issues/2137)) ([c6c0f48](https://github.com/RigelBuild/compass/commit/c6c0f487fa7a25b5a83cd4aa8b8dede29b84225c))
+* **store:** check model-level headers at the models.yml door (RIG-5287) ([#2227](https://github.com/RigelBuild/compass/issues/2227)) ([b86a40e](https://github.com/RigelBuild/compass/commit/b86a40e9789531bab7448338121f9610f5e4987b))
+* **store:** refuse a session binding for another tenant's agent ([#1702](https://github.com/RigelBuild/compass/issues/1702)) ([f966054](https://github.com/RigelBuild/compass/commit/f9660541de6e3c99014f1372151a6f9c1735c6b1))
+* **store:** refuse non-string models.yml header values at the door (RIG-3134) ([#2224](https://github.com/RigelBuild/compass/issues/2224)) ([be9a90e](https://github.com/RigelBuild/compass/commit/be9a90e836247c3204f0aeac1d930443440e0609))
+* **store:** refuse URL-embedded credentials at the models.yml door (RIG-5292) ([#2245](https://github.com/RigelBuild/compass/issues/2245)) ([5278ccd](https://github.com/RigelBuild/compass/commit/5278ccd49271460683c1ca08222b0625a4af0224))
+* **store:** reslot the state_changed_at migration to 0003 (RIG-2347) ([#2373](https://github.com/RigelBuild/compass/issues/2373)) ([b64837f](https://github.com/RigelBuild/compass/commit/b64837f3c35f7fc08b9e0c81da78e0042047f400))
+* **store:** scope MessageAskIDs to the author's edit authz (RIG-1552) ([#1753](https://github.com/RigelBuild/compass/issues/1753)) ([6f32ae5](https://github.com/RigelBuild/compass/commit/6f32ae519cd63cd1e53187321999fc55be349a64))
+* **toolchain:** print nix attrs before resolving the closed sets (RIG-5489) ([#2325](https://github.com/RigelBuild/compass/issues/2325)) ([4b57e16](https://github.com/RigelBuild/compass/commit/4b57e1674aa90c3da6026e4330221bee6452c3e7))
+* **ui:** chrome cleanup: drop ADE and usage bar, Session Log naming, pane edges, row re-measure (RIG-4771) ([#1811](https://github.com/RigelBuild/compass/issues/1811)) ([a6742db](https://github.com/RigelBuild/compass/commit/a6742db20df029b975f22fa7fbe9d697290a3423))
+* **ui:** give each Playwright run its own Vite optimizer cache ([#2068](https://github.com/RigelBuild/compass/issues/2068)) ([357d418](https://github.com/RigelBuild/compass/commit/357d418e4a80c70d990c600d1b676d9fa1101b67))
+* **ui:** keep the Bridge Issues/PRs toggle in place (RIG-4773) ([#1812](https://github.com/RigelBuild/compass/issues/1812)) ([088b5a2](https://github.com/RigelBuild/compass/commit/088b5a27d04f94d85fcd4706e50c12aeb79204c3))
+* **ui:** live Session Log tails SubscribeAgentSession for the open agent (RIG-4772) ([#1814](https://github.com/RigelBuild/compass/issues/1814)) ([173c723](https://github.com/RigelBuild/compass/commit/173c723a7f4e0ee62a107d1c41cb4361b6b4dfe9))
+* **ui:** route message search hits on the wire channel id (RIG-4295) ([#1646](https://github.com/RigelBuild/compass/issues/1646)) ([496cb68](https://github.com/RigelBuild/compass/commit/496cb68a84ca2644884a3cb120e370144d10223c))
+* **ui:** stop Playwright's git capture shallowing the CI checkout (RIG-4889) ([#2148](https://github.com/RigelBuild/compass/issues/2148)) ([d12dda6](https://github.com/RigelBuild/compass/commit/d12dda607477abc95af2509fc363e94ea51b6fcc))
+* **vfs:** move volume metadata out of the agent-owned root (RIG-3311) ([#1938](https://github.com/RigelBuild/compass/issues/1938)) ([d18da2c](https://github.com/RigelBuild/compass/commit/d18da2c4d8133b9677e4c8ea9caea51b38f7a405))
+
+
+### Performance Improvements
+
+* **board:** batch ref derivation across boards on roster and list (RIG-5336) ([#2365](https://github.com/RigelBuild/compass/issues/2365)) ([e42a563](https://github.com/RigelBuild/compass/commit/e42a563ae674af5d9e87f60ae377cd65780a8080))
+* **runtime:** run agent containers under an init so stop is prompt ([#2260](https://github.com/RigelBuild/compass/issues/2260)) ([330abab](https://github.com/RigelBuild/compass/commit/330abab435aec8db67718bafdb1498ed780fbab8))
+* **store:** walk a PutAgentConfig bundle once for both profile lints (RIG-3220) ([#1797](https://github.com/RigelBuild/compass/issues/1797)) ([fdf6220](https://github.com/RigelBuild/compass/commit/fdf62209242cdc04676d198f8fe116cf32ed9611))
+
 ## [0.3.0](https://github.com/RigelBuild/compass/compare/v0.2.1...v0.3.0) (2026-09-16)
 
 
diff --git a/version.txt b/version.txt
index 0d91a54c7..9e11b32fc 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-0.3.0
+0.3.1