chore(main): release 0.2.0

[rigelbuild-compass-release]

🤖 I have created a release beep boop

0.2.0 (2026-09-09)

⚠ BREAKING CHANGES

• ui: migrate apps/ui to Solid 2 (RIG-2202) (#548)

Features

• app-bundle: add compass-app-bundle project that builds the release tarball (#431) (cb3be7e)
• app-bundle: re-scope the bundle to carry embedded's sidecars (RIG-3200) (#863) (d524f02)
• ci: lint SQL migrations with squawk + sqruff (RIG-3031) (#764) (5f3c256)
• cli: add operator message-post and agent-status nouns (RIG-2662, RIG-2663) (#585) (a11e167)
• comms: deliver ask answers as messages on the durable rail (RIG-2257) (#600) (4228ee7)
• comms: OpenDM handler + AsAccount adapter + relay dispatch + spawn auto-open (RIG-2964) (#757) (afcce53)
• comms: org-management agent tools — comms adapters, hub dispatch, spawn role/persona (RIG-2673) (#630) (bca111c)
• comms: peer-DM T0 name-addressing cutover — agents address channels+topics by name (RIG-2956) (#730) (c8ee830)
• compass-agent: activate loop OpenTelemetry in cli.ts main() (RIG-2508 T1) (#648) (837687c)
• compass-agent: add board_set_issue_state native tool (RIG-3191) (#842) (5b80961)
• compass-agent: add comms_open_dm + comms_dm peer-DM tools (RIG-2966) (#749) (7d896c4)
• compass-agent: add effect dep + Bun runtime smoke (RIG-2424 T1) (#465) (0ee510a)
• compass-agent: add the forge tool surface (T1+T2) (RIG-2672) (#603) (ea0a9d8)
• compass-agent: ask round-trip over the comms transport (RIG-1509) (#411) (65b261d)
• compass-agent: consolidate transport ManagedRuntime ownership (RIG-2424 T5) (#475) (b1e2ce1)
• compass-agent: decode traceparent off the wire control (RIG-2871) (#957) (3823c2d)
• compass-agent: meter the inbound control source + span its connections (O3) (#540) (c3fc01d)
• compass-agent: migrate control-source reconnect pump to Effect (RIG-2424 T4) (#474) (4961ce7)
• compass-agent: migrate frame-sink durable lane to Effect (RIG-2424 T2) (#467) (1084c42)
• compass-agent: migrate off the vendored oh-my-pi subtree onto @oh-my-pi/* 18.0.11 (RIG-2407) (#924) (a64f003)
• compass-agent: migrate publish spine to Effect (RIG-2424 T3) (#471) (69581b1)
• compass-agent: require role/persona on agents_spawn_peer and render handles only (RIG-2726) (#762) (0393d52)
• compass-agent: scaffold transport OTel layer + containment test (O1a) (#515) (e121084)
• compass-agent: SessionInjection op-kind observation on the steer/deliver seam (RIG-2486) (#496) (d567033)
• compass-agent: span the outbound transport send + drain (O4) (#542) (9eb8d67)
• compass-agent: surface error/abort content as SessionError trace frames (RIG-2616 T2) (#850) (3839fb9)
• compass-agent: surface swallowed models.yml errors at boot; fail closed on unresolvable pinned model (RIG-2654) (#697) (b4447d5)
• compass-agent: thread TurnTracer through the three injection shapes (RIG-2508 T2) (#693) (8b60afd)
• compass-agent: trace-continuity bridge module (RIG-2508 T1) (#688) (e20c1eb)
• compass-agent: validate spawn role against the closed Manager taxonomy (RIG-3074) (#810) (655b056)
• compass-agent: wire OTLP exporters behind the transport OTel gate (O1b) (#520) (03f26d0)
• compass-app: close-time cancel of a window's in-flight calls (SEA-2035 M3b) (#360) (f9b4f88)
• compass-app: darwin build path via build-tag restructure (RIG-2753, T2) (#640) (eb2240f)
• compass-app: flip GTK3->GTK4 + webkitgtk-6.0 core (T2-T5) (RIG-2819) (#682) (4c958ca)
• compass-app: multi-window gtk3 e2e smoke gate (SEA-2035 M4) (#369) (e3d18ea)
• compass-app: revive embedded dual-mode + supervisor pipeline (RIG-3197, RIG-3198) (#844) (6a22bf9)
• compass-app: thread the bundle bin/ dir onto the embedded stack's PATH (#415) (809c616)
• compass-app: version stamp + --version on the desktop shell (#414) (3305429)
• compass-stack: add preflight checks + self-host docs (RIG-2761) (#669) (ae0a9ce)
• compass-ui: add the embedded boot arm to the shell-mode fork (RIG-3199) (#861) (3bdeac8)
• compass-ui: board-ify the Bridge PRs view (RIG-2129) (#416) (9b5ec31)
• compass: compass-guestd real PID-1 init (RIG-2589) (#552) (93b4a63)
• compass: handle-address request inputs — schema, proto flip, resolver, comms edge (RIG-2880) (#698) (0a22bab)
• compass: microVM V2a boot harness + KVM-gated boot spike (RIG-2591) (#574) (d73ae7e)
• compass: pack bootable erofs guest image + module initramfs (RIG-2590) (#559) (06866a6)
• compass: seed GuestControl proto + host vsock dialer (RIG-2588) (#547) (6fffd5c)
• config: admit prompts/<role>/SYSTEM.md + expose Prompts info bucket (RIG-3075) (#808) (a9b889f)
• config: profile registry — admit profiles/<name>/profile.yml at all three doors (RIG-2968) (#813) (ec3fe59)
• config: role prompts, concepts doc, and skill labels for the Manager taxonomy (RIG-3076, RIG-3077, RIG-3078) (#802) (ac68cd4)
• delivery: factor routeMentionsFor + add scanMissedMentions (RIG-2600) (#549) (5872e73)
• delivery: offline-mention record+wake arms + owed-mention start sweep (RIG-1641 T2) (#499) (c9ad908)
• delivery: propagate trace context through delivery dispatch (RIG-2892) (#739) (aa025b0)
• delivery: reap held-deliver entries on Runner re-enroll (RIG-1612) (#463) (2a5843f)
• delivery: wire recovery scan at both recovery points + live-path mark (RIG-2601) (#551) (32f4aa6)
• design-ledger: add Retired row status for scrapped-without-successor decisions (#522) (6f38814)
• devenv: add microVM VMM userspace toolset to dev shell (#502) (cf5d3e6)
• devenv: de-pin 3 agent-image devenv-fork sites onto the tool (RIG-2812) (#815) (44e5034)
• devenv: move root devenv source onto the RigelBuild fork (RIG-2814) (#816) (66ce611)
• devenv: relax Linux guards for macOS-native postgres/server/UI/cert/mint (SEA-2003) (#346) (00a8d06)
• e2e: AwaitControlDispatch fixture primitive over SubscribeAgentSession (RIG-2487) (#504) (29f1f59)
• fabric: add NATS EventFabric + RunnerFabric seams (RIG-3107) (#877) (909a02b)
• fabric: add tenant-wildcard comms subscribe (RIG-3107) (#903) (6371320)
• fabric: add the RoutingFabric seam for binding-cache invalidation (RIG-3108) (#955) (c953baa)
• flake: repo-root flake.nix packaging + nixpkgs-pin parity gate (RIG-2757, T6) (#642) (1b3f52f)
• forge: agent turn-end notification arm + forge ack (RIG-2732) (#678) (0ee2f6b)
• forge: container-scope subscriptions, notification kinds, forge ack frame (RIG-2732) (#674) (7a8ddae)
• forge: GitHub App installation-token source (RIG-2732) (#679) (31de779)
• forge: GitHub Provider write methods + Provider.BodyLimit (RIG-2170) (#394) (7396fcf)
• forge: GitHub read Provider — GetIssue/GetPullRequest/Checks (#413) (4fb68a8)
• forge: GitHub SubmitReview + Provider.SubmitReview method (RIG-2170) (#398) (b1001f2)
• forge: Linear provider (read + write, issues half) (RIG-2170) (#400) (068320d)
• forge: ListUpdatedIssues updated-order conditional walk (RIG-2883 T2) (#709) (2e3245c)
• forge: notify router + snapshot apply (RIG-2732) (#676) (c5c6862)
• forge: reconcile sweep + conditional reads (RIG-2732) (#677) (0518386)
• forge: surface rate-limit retry hint on the forge error channel (RIG-2255) (#750) (2426dd2)
• forge: webhook ingress + event normalize (RIG-2732) (#675) (082a28c)
• forge: wire agent forge subscribe/unsubscribe — store writer + DL-053 GC (RIG-2732) (#631) (f7c414a)
• guest_control: grow GuestControl with the V2b exec surface (RIG-2493) (#696) (d97d8bc)
• guest-image: microVM guest kernel + rootfs derivations and moon build gate (#507) (1b968b8)
• guestd: arm nft_script as guest root before the exec gate (V3 W1) (#754) (43b98d0)
• guestd: forward /run/compass/agent.sock to the host gateway over vsock (#817) (193f78d)
• guestd: replace the Health-only stub with the V2b in-guest supervisor (RIG-2493) (#701) (d86412d)
• ingest: board reconciler startup sweep + slow ticker + watermark (RIG-2883) (#708) (b769389)
• ingest: board webhook arm — fan-out sink + hydrating ingest queue (RIG-2883) (#706) (d9227fc)
• keyboard: four G-leader sequence rows + display/aria hardening (RIG-2708) (#613) (c7105ce)
• keyboard: leader-sequence runtime in the keymap dispatcher (RIG-2709) (#616) (29c4a7f)
• keyboard: sequence-grammar chord helpers for leader chords (RIG-2707) (#612) (90f01bf)
• linearagent: Linear Agent Session webhook types + API client (RIG-2717 T1/T2) (#637) (3217854)
• linearagent: Linear Agent Session webhook types + API client (RIG-2717 T1/T2) (#638) (574025c)
• linearagent: responder routing + async dispatcher (RIG-2717 T4/T6) (#646) (077d08f)
• lint: enable depguard + gomodguard_v2 with an active import fence (RIG-3033) (#763) (4593022)
• lint: stricter Biome rules + GritQL fixed-sleep ban (RIG-3032) (#769) (0af33ac)
• microvm: host-written per-session pidfiles with PID-reuse defense (RIG-2498) (#974) (19c3c95)
• microvmtest: add untagged microVM test gate package (#503) (6840479)
• microvm: virtio-fs mount-ns isolation + volume-quota verification (RIG-2497) (#912) (0e05a9a)
• notify: resolve a check_suite head SHA to its PR number (RIG-2869) (#950) (088d13a)
• otel: add go/internal/otel bootstrap package (RIG-2888) (#699) (108f174)
• otel: emit runner client spans (RIG-2890) (#714) (20fa1c0)
• otel: emit server-side spans + traceresponse header (RIG-2889) (#713) (bd97337)
• otel: stamp the PostHog session id onto backend spans (J1 inbound half) (#996) (6966925)
• prompts: activate the issue/PR-tool references in the role block-0 prompts (RIG-1734) (#849) (b937e25)
• proto: add SessionError to the compass.v1 session-trace contract (RIG-2616 T1) (#846) (ad7bff4)
• proto: add SessionInjection + trigger_traceparent trace fields (RIG-2891) (#700) (9e3f2db)
• proto: add traceparent to SteerControl/DeliverControl for trace continuity (RIG-2508) (#694) (c484235)
• proto: forge submit_review arm + ReviewRef ack + envelope ForgeRef/client_request_id (RIG-2170) (#393) (92287a4)
• proto: OpenDM RPC + gateway arm; GROUP_DM retirement; DM/convert fields (RIG-2962) (#738) (7eddb90)
• proto: org-management comms + spawn arms for agent gateway (RIG-2673) (#628) (dd4f291)
• release: attach the Linux client bundle to the semver Release (RIG-2752) (#761) (6c61631)
• release: build the macOS .app/.dmg client bundle on a macos-14 lane (RIG-2754) (#784) (3acedd7)
• release: release-gated asset + image jobs, port release-notes tool (RIG-2915) (#742) (7188de6)
• release: release-please config + unified release.yml (RIG-2914) (#741) (5219558)
• release: version.txt base for bundle, required-image release posture, unified-lane docs (RIG-2916) (#743) (867159a)
• renovate: auto-bump DefaultPostgresImage digest within postgres:18 (RIG-2774) (#673) (86c1bd7)
• renovate: auto-refresh pinned Nix FOD hashes on dep bump (RIG-2727) (#626) (99ecc40)
• renovate: couple go bump to go-overlay refresh (RIG-3100) (#841) (e327cbd)
• renovate: migrate compass off Dependabot to self-hosted Renovate (RIG-2432) (#477) (e3d8161)
• renovate: re-land postgres-stack customManager (RIG-2774) (#772) (5371d81)
• renovate: track the RigelBuild/devenv fork in both devenv locks (RIG-2815) (#865) (40398f7)
• runner: backend-gated startup preflight (RIG-3147) (#843) (0773a48)
• runnerhub: agent forge-call relay legs (RIG-2170) (#405) (b3a5841)
• runnerhub: bounded per-router send queue for non-blocking dispatch (RIG-2688) (#604) (05d88e7)
• runner: microVM boot canary startup preflight (RIG-3148) (#847) (1646e0c)
• runner: serve the AgentGateway over a per-session vsock path on microVM (#818) (5fbf3e2)
• runtime: add --volumes to PodmanCLI.Remove as defense-in-depth (#417) (280e999)
• runtime: deliver egress policy to the guest; skip host arm on self-arming backends (V3 W2) (#755) (73a28b7)
• runtime: fill MicroVMRuntime lifecycle methods (RIG-2493) (#719) (6a2c05c)
• runtime: freeze ContainerRuntime.Resize + ResourceLimits at S1 (#454) (64e1583)
• runtime: host GuestExec layer + portable exit-signal error type (RIG-2493) (#702) (27c9411)
• runtime: microVM backend seam + config-driven selection (RIG-2491) (#491) (8fb58e0)
• runtime: microVM static preflight + shared hostcheck core (RIG-3146) (#835) (7e23d19)
• secrets: admin-gated SetServerSecret/DeleteServerSecret over the server registry (#962) (2de6479)
• server: assemble the GitHub agent-notification lane (RIG-2732 T7) (#735) (e3f764b)
• server: forge write chokepoint — ForgeCaller impl (RIG-2170) (#408) (83ae205)
• server: mount the Linear webhook ingress /webhooks/linear (RIG-2732 T7) (#744) (4f539b0)
• server: offline-agent wake seam + system-authorized resume (RIG-1641 T3) (#497) (b924399)
• server: per-deployment public URL + deep-link builder (RIG-2717 T5) (#639) (5d01d87)
• server: re-point the forge boot consumers at the server resolver (#988) (f227491)
• server: retire the forge poll driver, mount the App-only board webhook lane (RIG-2883 T5) (#724) (55bcefa)
• server: seed the tree root as role "supervisor" (RIG-3079) (#834) (bf216c2)
• server: wire the forge write path end to end (RIG-2170) (#425) (e25b19c)
• server: wire the Linear agent-notification lane data sink (RIG-2732 T7) (#751) (8e68875)
• stack: bundle Plane-B fan-in OTel Collector as a supervised child (RIG-2825) (#672) (faf2bc1)
• stack: container-backed postgres + --database-external opt-out (RIG-2759, T8) (#652) (fcae4f0)
• stack: pgid-record v2 kind-tagged union for container teardown (RIG-2760, T8a) (#644) (78da0f1)
• stack: pin stock postgres:18 container image by digest (RIG-2758, T7) (#641) (4d1ebe4)
• stack: supervise a bundled NATS broker as a stack container (RIG-3107) (#878) (d3488ff)
• store,server: model registry store + operator write RPC + fail-closed config lint (RIG-3122) (#853) (010188b)
• store: add mentions_routed_at marker column + scan surface (RIG-2599) (#546) (6338f82)
• store: add the durable session_bindings table and its store methods (RIG-3108) (#990) (983e620)
• store: admit SubjectService token principal (enum half) (RIG-2863) (#911) (71522ff)
• store: forge authored-artifact ownership index (RIG-2170) (#404) (fd5ca78)
• store: migrate accounts + agent_tree to sqlc (T2) (#790) (2d9db7c)
• store: migrate channels + channel_pins + coordination to sqlc (T3) (#792) (be9c371)
• store: migrate messages + topics + delivery to sqlc (T4) (#795) (ff5bfab)
• store: owed_mentions durable backstop + AckDelivery clear (RIG-1641 T1) (#494) (6835515)
• store: recency-guard write-path threading for forge_updated_at (RIG-2883) (#710) (96199ce)
• store: reserved DM group + upsert + create-guard + convert-on-add (RIG-2963) (#746) (0df3c57)
• store: RLS enforcement + per-transaction tenant scoping (RIG-3106) (#830) (6d4acdb)
• store: scaffold sqlc + arm the inline-SQL ban gate (T1) (#780) (a84f2d2)
• store: server_secrets registry, physically separate from user secrets (#960) (bad69ff)
• store: tenant schema + identity plumbing (RIG-2861 T1) (#715) (a17625b)
• store: watermark persistence + enabled-repo enumeration (RIG-2883 T4) (#705) (95421e2)
• toolchain: add devenv-cli source resolver tool (RIG-2546) (#666) (46fe144)
• toolchain: re-land devenv-cli source resolver tool (RIG-2546 T1) (#771) (990644e)
• tools: compass-app-dev local build+launch loop for the native client (RIG-3103) (#819) (0426dc4)
• ui: add the Bridge advancing-card dormant chase-light hook (RIG-2128) (#409) (37c4e0a)
• ui: adopt CoachTip across command-backed chrome + register sidebar toggles (RIG-2704) (#618) (f9cd5bd)
• ui: adopt frozen 1-bit pixel-art state-dot glyphs (RIG-2118) (#862) (eb5ef7a)
• ui: BadgeGlyph — Option-B axis badge (glyph + 2-char code) (#377) (69bb2f5)
• ui: board cuts over to live roster — store.agents() + tree-empty seam (SEA-2099, SEA-2100) (#367) (8b202de)
• ui: Bridge 2-D roving-tabindex keyboard grid + empty-board (RIG-2130) (#472) (16e0d09)
• ui: Cmd/Ctrl+K command palette + point-of-use shortcut chips (RIG-2483) (#529) (dc07f46)
• ui: CoachTip coaching tooltip component (RIG-2703) (#615) (ba93b66)
• ui: embed posthog-js behind an off-by-default analytics flag (#689) (797cd71)
• ui: flip CI/review badges to BadgeGlyph + wire DS badge CSS (SEA-2122) (#378) (0535407)
• ui: install the keyboard spine at the App root (RIG-2456) (#489) (94a8331)
• ui: live-roster presence adapter — presenceLifecycle + adaptRosterEntry (SEA-2096) (#362) (eff9cfb)
• ui: migrate apps/ui to Solid 2 (RIG-2202) (#548) (fb234f3)
• ui: offline fixture boot mode + build-scan hard wall (#382) (b84989f)
• ui: point visual-smoke harness at offline fixture mode (#383) (5089e1d)
• ui: presence joins CommsState — GetRoster seed + AgentPresenceChanged tail (SEA-2097) (#363) (05f5387)
• ui: re-clothe Bridge grid shell onto the hairline board look (#389) (82294b6)
• ui: re-clothe Bridge issue card onto the DS .cx-card (RIG-2126) (#403) (56ec3b6)
• ui: re-theme demo fixtures to a Manager-named example tree (RIG-2346) (#444) (5c42d52)
• ui: reactive agents seam — joinAgents joins live accounts + presence (SEA-2098) (#366) (c7fa028)
• ui: scope-aware tier-3 command dispatch (RIG-2529) (#519) (f406cfe)
• ui: searchable ? keyboard-shortcuts overlay (RIG-2482) (#526) (2cc992a)
• ui: stamp the server trace id onto captured product events (RIG-2874) (#938) (98b6ce9)
• vfs: session persistent-volume lifecycle API + local-dir backend (RIG-3278) (#898) (747b403)

Bug Fixes

• agent: idle @-mention steer starts a turn via prompt(), not continue() (#514) (e0e8973)
• agent: terse the reply-in-channel cue — why lives in SYSTEM.md, not per batch (RIG-2664) (#583) (693bfe5)
• app-bundle: stage postgres share + lib so the bundled cluster can initdb (#448) (a2667a2)
• biome: scope type-aware nursery rules off compass-agent transport (RIG-3051) (#789) (944d095)
• build: stamp version.txt semver on the nix + devenv build paths (RIG-3346) (#939) (87f3f79)
• ci: always run design-ledger-gate on PRs (RIG-3441) (#942) (446bb16)
• ci: skip the CI rollup on a cancelled run so superseded commits are not false-red (#506) (48d4a7c)
• ci: switch moon to native file hashing to end the main full-sweep git race (RIG-2585) (#555) (c7fe3f9)
• ci: union the PR affected closure with the task-level one (RIG-3381) (#935) (ff04f85)
• cli: bound the secret-set stdin read + reject mismatched routing flags (SEA-2030) (#370) (d0030f6)
• comms: guard nil derefs to clear nilaway T3 lane (#775) (f2a7e12)
• comms: resolve agent-caller owner in CreateAgent (RIG-1644) (#443) (a87cb70)
• compass-agent: derive LITELLM_MCP_URL from the delivered base URL (RIG-2674) (#587) (47d46e0)
• compass-agent: emit the export-surface dts probe under node_modules to end the main-CI git race (#541) (121c021)
• compass-agent: event-gate the (g) probe tests instead of a wall-clock budget (RIG-3455) (#970) (375377a)
• compass-agent: isolate transport gauge tests from the shared metric registry (RIG-2656) (#712) (101c3f3)
• compass-agent: recover a deliver stranded against an untracked startup stream (RIG-2644) (#572) (4fbbfee)
• compass-app: repoint default agent image to the live rigelbuild GHCR owner (#455) (c25ce94)
• deps: update typescript dependencies (#591) (01d7d20)
• design-ledger: resolve DL-298/DL-299 cross-lane id collisions on main (#737) (3572ea6)
• design: de-collide duplicate ledger id DL-239, renumber the RIG-2490 row to DL-240 (RIG-2619) (#554) (1e8c0ab)
• design: renumber colliding ledger ids DL-319/DL-320 to DL-322/DL-323 (#851) (fab4a67)
• design: renumber colliding ledger ids DL-327..330 to DL-334..337 (RIG-3107) (#927) (c374bb9)
• devenv: build the operator CLI so the box never serves a stale binary (RIG-3342) (#925) (a971c6c)
• devenv: force moon global toolchain so compass-go tasks resolve (RIG-2286) (#428) (3af740e)
• devenv: single-source the dogfood runner-id so mint and runner never drift (RIG-2660) (#582) (4e78a49)
• eng-docs: bootstrap the deploy toolchain from nix (#368) (7d4c38f)
• eng-docs: bump astro to v7 with lockstep starlight/check (RIG-2585 sec, closes #564) (#570) (b5f92c3)
• eng-docs: serialize astro check after build to end data-store rename race (#427) (785f69f)
• flake: ship the UI dist with #compass-app (RIG-3474) (#1011) (9d0a00f)
• forge: make the live-Linear oracle deterministic + gate it on the forge surface (RIG-2909) (#721) (5cb9397)
• go: repoint a stale sealedsecurity store import to RigelBuild (RIG-1893) (#479) (d0b05a9)
• guest-image: stage /sbin/modprobe so in-guest egress arm autoloads netfilter (RIG-3028) (#759) (e01a20a)
• ingest: key notify snapshot comments by stable id, not URL (RIG-2732) (#768) (5e6bc9b)
• inline-sql-gate: exempt tool CLI from noConsole in its nested biome config (#787) (b758bbd)
• microvm: force ExecStream receive-side down on ctx cancel (#770) (381b241)
• nilaway: clear guestd + events nil-panic findings (#779) (38cb17f)
• release: read the release-please App Client ID from an Actions variable (RIG-2995) (#985) (11076ea)
• renovate: build devenv CLI from root lock, not deleted forks/devenv (RIG-2406) (#518) (26e524a)
• renovate: lockstep flake.nix nixpkgs rev on devenv-nixpkgs bump (RIG-3099) (#814) (a69b610)
• renovate: mirror flake.nix Go vendorHash + cap wails/v3 below 3.1 (RIG-2852) (#681) (589675a)
• renovate: refresh the FOD hash on devenv-nixpkgs channel bumps (RIG-3296) (#897) (1b21603)
• runner/gateway: un-park SteerControl so @mention steers reach the agent (#476) (25794b6)
• runner: close publisher outside pubMu to prevent telemetry stall (#430) (97859dc)
• runner: guard microVM launcher Pdeathsig behind a linux build tag (RIG-3213) (#848) (17111cc)
• runner: guard nil derefs to clear nilaway T1 lane (#773) (8f23b54)
• runnerhub: bound the send1 deliverRefusals registry (RIG-1610) (#483) (a4ab0c7)
• runnerhub: guard proto-getter nil oneofs for nilaway (T2) (#774) (ed9c493)
• runtime: guard nilaway findings in runtime + microvm lanes (T5) (#777) (db628cc)
• runtime: nil-guard launchFunc result so nilaway proves vm non-nil (RIG-1534) (#799) (c4a7070)
• server: guard nilaway proto-getter and spawn-memo derefs (#778) (d8acd3e)
• server: send leading registration-ack on SubscribeAgentSession (RIG-3044) (#785) (9d675bb)
• server: skip redundant ConfigVersion signal on idempotent re-Put (RIG-1657) (#432) (31073d7)
• server: wire the config-bundle store into the runner door so agents receive config (#537) (992f3b5)
• store: back the keyspace partition with a DB CHECK and prove the grants (#961) (349d5d2)
• store: descend through non-string-keyed nodes in models.yml credential denylist (RIG-3116) (#826) (f584880)
• store: guard nilaway reachable-nil findings in store lane (#776) (8095c1e)
• store: reslot messages_author_idx migration 0002->0003 (dup version) (#426) (1adeb98)
• toolchain: build the Go analysis battery with the go1.27 toolchain (RIG-3303) (#904) (ab56c27)
• tools: point orion-ref-gate's failure hint at an in-repo doc (RIG-3344) (#930) (a125326)

Performance Improvements

• store: index messages.author_account_id for AgentHasOpenAsk (RIG-1649) (#419) (be51b51)
• ui: highlight settled code on the leading edge, debounce only streaming ticks (RIG-1422) (#575) (beaaca4)

---

This PR was generated with Release Please. See documentation.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

Compass engineering docs preview: https://release-please--branches--ma.compass-eng-docs.pages.dev

Deployed from release-please--branches--main at e0e8490.

Changed pages:

• CHANGELOG.md