openrig/CHANGELOG.md

OpenRig Changelog

Agent-readable release notes for coding agents and human operators installing, upgrading, or operating OpenRig.

Versioning: pre-1.0 minor releases may include contract additions, deprecations, and behavioral changes. Breaking changes are called out explicitly.

---

[0.7.8]

Published 2026-11-05 as @openrig/[email protected], built from the commit tagged v0.7.8 (12df562c).

OpenRig 0.7.8 lets a person answer a runner seat's permission requests, with a conformance check and an example runner to build against. It includes 0.7.7's fixes plus repairs across seats, tmux, Slack and the TUI. It also includes a reference for running a Claude worker in an NVIDIA OpenShell sandbox, but that worker isn't usable in this release: see the OpenShell reference.

Before you upgrade

• Restart the daemon after installing:

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

  Four migrations (142 to 145) store a Claude seat's MCP opt-out, seat activity grants, OpenShell environment bindings and the person chosen to answer a seat's permission requests. (#2177, #2295, #2296, #2301)
• The bundled openrig-core plugin advances from 0.1.23 to 0.1.24. One line of its seat-continuity skill changed. Managed refresh preserves replaced files under $OPENRIG_HOME/backups/managed-refresh/<id>/; reapply local edits you still need from that copy. (#2287)

Permissions for runner seats

• A runner seat's permission requests now reach a person, and the default is permit. The runner contract's first version refused every request. Section 7 of docs/reference/harness-runner-contract.md now covers who is asked:

  • With a default person, "They get an ordinary ask in the Feed and on Slack. No setup is needed."
  • To choose someone else, run rig seat set-permissions-to <seat> --to <person> --reason "…". --clear returns to the default.
  • When no one can be asked, the request is "Permitted at once, with the agent's own allow option."
  • Refusal is opt-in, with --deny.

  "A person's no is never a grant." An unanswered request "stays pending and visible" until the agent's turn ends: "It's never timed out into a grant." (#2301)

• A runner conformance check: node docs/reference/runner-conformance/check-runner.mjs --runner '<runner command with {agent}>' --name <harness>. It covers the answered path, and needs Node and tmux but no daemon, model, credentials or network. (#2303, #2306)

• An example runner for DeepSeek Harness (dsh), with its preset, is under docs/reference/community-harness-examples/dsh/. OpenRig doesn't install it. (#2305)

• A seat activity grant lets a runner outside the host's hook setup report activity for one seat and launch, without the install-wide hook token. (#2295)

The OpenShell reference isn't usable in 0.7.8

0.7.8 includes rig environment (setup, create, attach) and a reference for binding a seat to an NVIDIA OpenShell sandbox (daemon/assets/openshell/README.md). In our release testing the worker never became usable: after the sandbox was created and the native process started, rig environment connect failed when its check timed out after 5 seconds, so no team work ran. Don't rely on this path in 0.7.8. (#2296, #2300, #2378)

Seats, delivery and the TUI

• Seats:
  • an isolated tmux server per OpenRig home (rig config set terminal.tmux_server isolated);
  • claude_mcp: none for a Claude member;
  • resuming with a new token file;
  • first starts on rig launch --seats;
  • an accurate account record and kept effort after rig provider switch;
  • skill copies, activity hooks and startup declarations kept across rig down, resumes and exports;
  • clearer stops for handover's fork:<seat>, a missing conversation, claude not found, Codex restart refusals and failed unpins. (#1260, #2177, #2269, #2342, #2344, #2337, #2338, #2190, #2297, #2287, #2255, #2282, #2330, #2332)
• tmux:
  • with OPENRIG_TMUX_CONTROL=1, no crash on tmux 3.3a to 3.7c when the control client ends while another leaves;
  • a submit key that a read-only client blocks is pasted instead. (#2317, #2325, #2345)
• Wakes:
  • OPENRIG_WAKE_SUSPEND matches destinations with a colon;
  • prompt escalations stay deliverable without a reachable person;
  • reminders stop at a full quota;
  • human@kernel raises no false finding;
  • OpenRig's own Codex hooks are trusted when no choice is recorded;
  • refusals name their fix. (#2353, #2343, #2281, #2286, #2294, #2290, #2284, #2280, #2273, #2202)
• Slack and usage:
  • typed replies to parked decisions are recorded as answers;
  • row bodies render Markdown;
  • resolved decisions stop showing as live asks;
  • OpenRouter charge retries aren't delayed. (#2293, #2299, #2316, #2349, #2314)
• Hosts and setup:
  • rig host edit and rig host remove;
  • a warning when another OS user's daemon holds the port;
  • rig daemon status shows a pending start. (#2310, #2346, #2302, #2348)
• The TUI and views:
  • agent pages show health and recent work;
  • pod, spec and instance-table views read correctly;
  • rig terminal open mission:<id> --follow --provider herdr follows a mission. (#2263, #2264, #2265, #2266, #2327, #2260, #2289)
• Also:
  • MCP text is cut between whole characters;
  • an ACP cancel survives a failed note;
  • long transcript lines read faster;
  • there are Pi and kernel dashboard recovery guides. (#2268, #2262, #2274, #2186, #2275)

Behaviour that changed

• A runner following section 7 gets answers or permits, not refusals. --deny keeps a seat refusing.
• On tmux older than 3.7c, OPENRIG_TMUX_CONTROL=1 uses spawned clients instead of a control client.

Known limits

• No harness has run end to end under the contract yet. The dsh example and the conformance check were checked against stand-ins.
• The answer owner is a registered person. "A colleague's answer is followed on this host. If the ask is handed to another host, the request waits, shown as needs input, until the agent's turn ends."
• allow_always from a permit: with no one to ask, "If the agent offers only allow_always, the harness then remembers a permission nobody chose."
• "Permits and answers aren't recorded beyond the runner's pane and the ask itself."
• Coming as follow-ups: recording a permit made when no one can be asked, and passing a person's typed words that aren't a plain yes or no to the agent.
• The dsh example keeps one hold per seat: "if dsh asks twice in one turn, settling one ask releases the hold while the other may still wait on a person."
• The worker isn't usable (above). The reference also requires NVIDIA OpenShell 0.1.6, a Linux image, and an API-backed provider using ANTHROPIC_API_KEY; subscription or OAuth credentials aren't supported. "Provider registration and image construction can incur costs." The worker's activity reads unknown, from pane sampling, never idle.
• The OpenShell README example uses operator@kernel; the actual kernel operator is operator-agent@kernel.
• "Never grant the guest access to the daemon's main API port (normally 7433)." The guest-only listener is what confines a guest's reach. Its grant only authorizes requests for its own seat and launch.
• The 0.7.7 and 0.7.6 limits below still apply.

Credits

Thanks to @Aschenbath, @dajiaohuang, @Vaishnavi220506, @Nikhila-Dhevi-R, @Nikhi00718, @oodadoudou, @DeryFerd, @ch-davidriott, @vanducng, @Ethereal49, @AdityaxDeore and @Mydudeclaps for merged contributions. Thanks to @salbang, @ziadeh, @davey64, @bpamiri and @oneandonlydean for reports carried into this release, and to @bpamiri for dsh-seat, whose fake agent the conformance check's stand-in follows.

[0.7.7]

Published 2026-11-02 as @openrig/[email protected], built from the commit tagged v0.7.7 (f3d8bac4). 0.7.7 is a separate reliability patch for 0.7.6. Its three fixes are also in 0.7.8.

OpenRig 0.7.7 is 0.7.6 with three reliability fixes for managed Claude seats: an idle prompt under Claude's "Update installed" line is recognized again, managed compaction no longer types into a message you haven't sent, and a Claude seat launched through a wrapper script can be rebuilt again.

Before you upgrade

• Restart the daemon after installing so the fixes take effect:

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

  There are no database migrations. The bundled openrig-core plugin stays at 0.1.23 with unchanged files.

Fixed

• A Claude seat under the "Update installed" line reads idle again. After Claude installs an update, it prints "✔ Update installed · /restart to apply" (or "Restart to apply") below its mode bar. OpenRig didn't recognize that line, so a seat at an empty prompt read unknown instead of idle, and managed compaction waited. Both spellings are now recognized; lines that only look similar still read unknown. (#2311)
• Managed compaction no longer types into a draft. With the optional typing guard off (the default), compaction's preparation prompt could be pasted onto a message someone had typed but not sent. Now the preparation prompt, /compact and the restore prompts check the input box first: typed or unreadable input holds the step with a reason. A held restore prompt goes ahead on its own once the box is empty; a manual rig compact says why it stopped, to be retried once the box is empty. An empty box or Claude's own suggestion goes ahead. (#2347)
• A Claude seat launched through a wrapper script can be rebuilt again. On 0.7.6, rig seat handover --source rebuild on a seat whose claude is a #! script that starts the real Claude without exec stopped after 30 seconds with "Waiting to confirm the new Claude process in this pane", though the new Claude was running. The readiness check now also accepts the script's own direct child when it names this launch's conversation; every other check is unchanged. (#2341, #2354)
• A failed handover no longer moves the seat's resume target to the new, unprimed conversation while the seat keeps its previous occupant. (#2354)

Known limits

• Other reasons managed compaction can wait are unchanged.
• The draft check reads the input box just before pasting. Typing that starts in the same moment can still be appended to.
• A Claude seat whose current occupant generation was never registered, such as an adopted Claude carrying another generation, or a managed launch whose tenure record failed to write, keeps its first conversation token, but later hooks don't move it.
• The 0.7.6 known limits below still apply.

Thanks

• @oneandonlydean for the report and the evidence in #2341.

[0.7.6]

OpenRig 0.7.6 lets one terminal workspace follow the current owners of a slice's open work through handoffs and completions. It also keeps more seat settings through expansion and restore, reports retained dead panes honestly, and repairs queue and Slack delivery paths.

Before you upgrade

• Restart the daemon after installing so the new code and database updates take effect:

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

  Two migrations add the selected account-home path to nodes and the runner declaration to sessions. Both have prefix 141; their distinct full filenames identify them. (#2143, #2239)
• The bundled openrig-core plugin advances from 0.1.22 to 0.1.23. Claude's activity hook clears permission marks after a tool batch. Managed refresh preserves replaced files under $OPENRIG_HOME/backups/managed-refresh/<id>/; reapply local edits you still need from that copy. (#2209)

Follow the work in a slice

• Open rig terminal open slice:<name-or-id> --follow --provider herdr. Membership comes from pending, in-progress and blocked queue rows tagged with that exact slice. Owners appear once with all their obligations listed; unavailable owners and tile overflow stay named. Handoffs retain the association unless their tags are replaced. New slice views default to four automatic tiles; --max-tiles changes that. Known empty slices stay following; incomplete reads retain the previous viewers. Pins, drafts, unknown input and focus retain departed viewers, and closing a viewer never stops its agent. Slice following targets the Linux Herdr 0.9.5 / protocol 22 path. Mission following is not included. (#2259)

• Named Herdr sessions use their configured endpoint throughout viewer and follow operations. The TUI's terminal action opens the agent, pod or rig currently in view. (#2205, #2232)

• Client-visible HTTP change: /api/terminal/viewer/ensure now returns 400 for view_required and unknown_provider, where it returned 200 with an error body. Clients should continue reading the body code. Missing slice identities return 404; ambiguous or unavailable identities return 409. (#2259)

• When a slice's folder name repeats across missions, tag its work with the slice's unique ID (rig queue create --slice <id>) or add --mission <mission>. A row tagged only with the shared name cannot be placed, so the view reads incomplete until it is. (#2261)

• A join refused before a pane split can join on a later refresh. Hold notices keep the seat and phase. The first notice keeps the original reason; later notices can show a generic reason, while the original failure remains in the journal. A created viewer whose attach has not yet run can continue without replacing its pane. (#2271)

Seats, accounts and harnesses

• Expansion keeps the member settings accepted by rig up, including env, effort and startup settings. Restores retain the model saved with rig seat set-model. (#2250, #2227, #2228)

• Move a running Codex or Claude Code seat to an existing account home with rig provider switch --seat <seat> --to-account <name> --account-home <dir>; preview with --dry-run. This starts a fresh conversation with a handover, retaining the seat's address and work. --clear-account-home returns to the configured defaults. (#2143)

• Claude subscription/API-key switching has a same-conversation path: rig provider switch --seat <seat> --to-account api --api-key-file <abs>; return with --to-account plan --token-file <abs>. In-flight work is interrupted. The API-key path remains unqualified; verify the resulting account and conversation. A new Claude member can instead name a prepared subscription token in its spec with claude_token: {label: name, file: /abs/token}. (#2191, #2246)

• Relaunch retains the selected seat and its observed executable. Codex identity reads preserve OS argument boundaries, and in-place restart can recognize a verified Node launcher named MainThread. This does not establish that the reported #2200 restart refusal is fixed. (#2196, #2212, #2247)

• Managed seats inherit the daemon's SSH agent socket for git over SSH; check the daemon's agent with ssh-add -l. (#2222)

• Community presets can report turns and accept a declared model. runner: true with launch_result: true records runner activity per launch. passes_model: true passes the requested model as OPENRIG_MODEL; it does not observe the effective model. The Cursor and Hermes examples leave this off pending native qualification. These are opt-in preset fields, not a completed integration with every harness. (#2239, #2243)

• Draft integration author contracts describe harness, runner and platform duties, distinguishing implemented interfaces from proposals. Start at the author-contract entry point. (#2272)

Delivery and Slack

• Original queue wakes retry after a selection prompt clears. Retries identify OpenRig as the sender, workflow entry keeps its caller, and prompt-blocked alerts remain routable when the original sender is on another host. (#2235, #2229, #2237)
• Work sent to a terminal-only seat gets a recovery finding for a person. Cross-host rig queue create --verify reads the destination's receipt; unreadable receipts remain unconfirmed without replaying the create. (#2192, #2193)
• Slack button answers resume decisions parked on the person asked. Replies Slack places outside a deleted thread are recorded at their actual location, so the next reply reaches the right conversation. (#2245, #2240)
• Use rig slack setup --reactions off to stop acknowledgement emoji waking agents. The default remains route, and regenerating the app manifest preserves the choice. Alert selection filters eligible notifications without dropping older eligible asks behind an arbitrary row cap. (#2241, #2183)

Status, inventory and help

• A readiness deadline no longer ends a still-starting daemon. The CLI returns a nonzero pending result naming the child PID, launch endpoint and log. It leaves the child running and retains the startup reservation, without declaring readiness or allowing a duplicate start. Follow that pending guidance before recovery. (#2267)
• A verified exited process in a retained pane reads pane_exited, instead of running and ready. Inventory avoids discarded graph loads, scopes startup history to the requested rig's nodes, and reuses node identity for activity reads. These changes make no universal latency claim. (#2248, #2225, #2226, #2236)
• Completed mission labels reflect accepted proof, without making proof readiness complete a mission. Snapshot ages use UTC correctly; emoji stay whole when TUI health, config and rig-table cells are shortened. (#2249, #2251, #2252, #2253)
• Smaller command fixes: chatroom tmux rig names stay literal; a trailing slash in OPENRIG_URL still identifies the same daemon; a trailing slash in the missions root no longer hides a slice's mission. rig host doctor names the entry replies actually reach. (#2218, #2220, #2221, #2214)
• Help and contributor checks: edge help explains deferred escalation targets; section addressing ignores HTML comments; the guide covers shared kernel-dashboard recovery. Install pins, help links and earlier release text are corrected. Scenario fixtures honor send verification, execute tmux directly, and reject unknown step verbs at schema load. (#2204, #2211, #2213, #2238, #2244, #2254, #2256, #2257, #2215, #2216, #2217)

Known limits

• The Codex hook-refresh refusal in #2200 remains unresolved. If rig seat restart <seat> --keep-conversation refuses, nothing is stopped: leave the seat running and report the refusal with CLI and daemon versions. A refused restart has not refreshed the hooks.
• A viewer whose attach already ran and then exited back to a shell is not restarted automatically. The whole slice view can hold until that tile is resolved. No tested workaround is offered for that case.
• Following protects uncertain input by retaining tiles. A larger workspace or explicit --max-tiles can help with overflow. Protected Codex delivery can still retain messages it cannot confirm before paste; retained is not delivered. Disabling its typing guard removes protection and is not recovery.
• Internet-facing hosted members remain experimental, unsupported, off by default and at your own risk. Slice following does not require them.

Credits

Thanks to @seanmcn, @DeryFerd, @Aschenbath, @Vaishnavi220506, @bradvin, @jay23606, @rudycelekli and @Nikhi00718 for merged contributions, and to @akushonkamen, @jcmurrayii, @KM199 and @pdurlej for contributed changes, reports and reproductions carried into this release.

[0.7.5]

OpenRig 0.7.5 adds rig terminal open qitem:<id> --follow: keep one terminal workspace as a task's current owners join and leave. Joining viewers do not request focus; departures remove viewers, not the agents or conversations. Follow mode is scoped to Linux Herdr 0.9.5 / protocol 22. The exercised journey used shell stand-ins; real-agent follow qualification and active render cost are not established by that result. Changes since 0.7.4:

Before you upgrade

• Restart the daemon after installing to run the new code and database update. Migration 126 adds deferred escalates_to target addresses to the edges table, preserving existing edges. Previously inert escalation edges now affect recovery for seats without a delegation parent.

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

• The bundled openrig-core plugin goes from 0.1.21 to 0.1.22. Its queue-handoff skill teaches agents to park waits on CI or a long job with a continuation and wake. As before, managed refresh preserves replaced files under $OPENRIG_HOME/backups/managed-refresh/<id>/; reapply any local edits you still need from that copy. No setting is added or removed.
• A Codex hook-refresh refusal remains unresolved. The earlier remedy rig seat restart <seat> --keep-conversation --reason "refresh hooks" (preview with --plan) was reported to refuse one Codex seat upgraded from 0.6.x. Its cause is unknown: the inspected 0.7.4 check already accepts the reported process tree. #2200 is not fixed in 0.7.5; this is not an established refusal of all staged-script launches. A refused restart does not complete the hook refresh. If it refuses, nothing is stopped: leave the seat running and report the refusal with CLI and daemon versions. If Codex asks for hook review, review the hooks you intend to enable.

Follow one task in one workspace

• Follow the current owners of a queue item: rig terminal open qitem:<id> --follow --provider herdr. The view derives membership from the task's open rows and explicitly linked successors. Joining seats get verified viewer tiles in the same workspace. A complete empty task drains removable tiles and keeps the workspace; after retained tiles are gone, following stops. Run --follow again to resume it. (#2199)
• Keep control of the view: --pin, --unpin, --suppress, --unsuppress, --suppression-ms and --max-tiles adjust presentation. --no-follow leaves the layout in place. The default is eight tiles, four seconds of departure grace and twelve more seconds for a focused leaver. Pins can exceed the cap; input-retained leavers do not consume a joining seat's slot. See terminal sessions. (#2199)
• Uncertain input keeps its tile. Typed drafts and unreadable composers retain departed viewers, including Pi, terminal and community harness seats whose input cannot be confirmed. Unpinning does not override that. There is one delayed input recheck, then queue/session events or an explicit follow command can reconsider it. Failed or incomplete reads retain the previous view with an explanation. Activity hooks do not trigger renders. (#2199)
• Protected Codex delivery no longer strands a message it can't submit. On a Codex seat whose typing guard is draft-aware or openrig-urgent, a message whose complete text can't be confirmed visible before paste is retained, not sent, instead of being pasted where it can't be submitted. The default (guard off) is unchanged. Use a larger pane or a shorter message; turning the typing guard off turns draft protection off and is not a recovery. Pastes over 1,000 code points are retained. Wrapped lines use a conservative bound, so most wrapped wakes in common four-tile views can be retained even when they fit natively; approximate standard-envelope examples are one-paragraph bodies over about 115 characters at 80×22, 192 at 80×24, or 526 at 120×30 (examples, not limits). A later resize is not atomic, and layouts with Codex's image-enabled ambient pet are unqualified. (#2242)
• Codex 0.164's two-row composer footer is recognized. A departed Codex agent's empty composer no longer reads as unconfirmed input that keeps its tile. Delivery's draft-aware and openrig-urgent typing guards use the same reader, so an empty Codex 0.164 composer there can now receive typed delivery. (#2206)
• Clients can ensure a missing viewer without relaying out existing panes through POST /api/terminal/viewer/ensure. It rechecks task membership and existing viewer identity before creating or reusing a tile. Preview names not-provisioned, verified or unconfirmed; membership gives no input authority. This path has the same Linux Herdr 0.9.5 / protocol 22 scope. (#2133)
• An unconfirmed pane no longer counts as opened. CLI and TUI output name it as degraded with pane_unconfirmed, distinguish it from a skipped seat, and omit its restart-command report. An all-unconfirmed open exits nonzero. Inspect before retrying; this is not proof that nothing opened. (#2173)

Fixes by what you see

• Slow successful sends have time to answer. Local and HTTP rig send wait 60 seconds, plus an explicit idle wait, instead of five seconds locally or thirty over HTTP. A timeout still means unconfirmed. The advice now says that a busy recipient may hold input off-screen: missing pane text does not prove non-delivery, so reconcile before another send or duplicate queue item. No automatic resend is added. This does not diagnose the daemon's latency. (#2198)
• A wake that was unroutable before its seat had a pane is retried once the binding exists, through the row's existing wake intent. The outbox does not send that same intent again after it is settled as delivered. (#2170)
• A parentless seat's recovery can follow its declared escalates_to address, including another rig on the same daemon. A delegation parent still takes precedence. Unavailable or ambiguous targets use the explained fallback; an already-open recovery keeps its recorded owner. This is one escalation hop, not cross-host routing. (#1772)
• A stuck finding needs evidence to close. Delivery, pickup or explicit custody can resolve it; a changed reporting threshold, an unreadable registry or a failed wake becoming unconfirmed cannot silently clear it. (#2153)
• Fresh Claude handovers wait for the current launch. Retained scrollback or an echoed shell command cannot make a new process look ready. The context packet waits for the matching process and Claude's complete drawn input frame. (#2159)
• Runtime send refusals return HTTP 409 rather than 500. A stale recorded Claude pane names rig reconcile-session <seat> as the repair; nothing is typed on that refusal. (#2157)
• rig down keeps a rig down after a rolled-back start. It records the explicit stop without rewriting the superseded session's history. The rig start --last help now explains which rigs return and how an explicit stop keeps them out; the kernel is not selected by --last. (#2166)
• Status and configuration describe the selected rig. rig ps reports periodicSnapshotActive only for rigs the scheduler actually snapshots (#2168); the web Overview reads the rig's current exported configuration instead of a same-named library template (#2188).
• Host labels and next steps are clearer. The TUI shows the configured local host name while retaining its stable identity (#2162). rig host add and pair explain how to opt an HTTP host into remote Feed attention; registration leaves that setting unchanged (#2179).
• Small CLI corrections: attach --self reads tmux's rewritten separators (#2178); transcript and capture line counts use their normalized values on local and remote paths (#2164); stdio MCP warns on out-of-range daemon ports while continuing to serve, without substituting a port (#2160).
• Notification adapters release unread HTTP response bodies, without changing their send result or waiting for cleanup. No performance improvement is claimed here. (#2172)
• Scope audits agree on slice folders numbered 100 and above. The guide also explains that moving a slice reopens its proof judgments; a clean structural audit is not a proof judgment. (#2194)

Presets, hosted members and guides

• The pi-tui example runs Pi's own terminal UI as a community harness. It gives each seat its own Pi agent folder and passes startup input to Pi. One Pi 1.4.0 / OpenRig 0.7.4 run showed a parked wake returning to the same session and an unattended handoff to a second seat. It did not prove Pi chooses that coordination by itself. Resume is not declared. Use it unattended: a wake can submit a person's half-typed draft, and unrecognized dialogs can receive the send. Busy-turn wakes and other Pi versions remain unqualified. (#2182, #2184)
• Interactive Pi setup is explicit: copy the coordination skills and use delivery_hint: send_text for a startup file that must reach a preset's first input. A plain terminal seat does not receive queue wakes. Setting its typing guard to off can type notices into a shell; keep the default for a seat that can return to one. These are documented limits, not new guards. (#2174, #2180, #2181, #2185)
• Hosted-member guidance names its real reach. A member without a wake trigger checks work when its owner next starts a session; a listed tool is not a grant, and completed work closes with no-follow-on. Hosted members exposed over the internet remain experimental, unsupported, off by default and at your own risk. The guide explains narrow grants and token revocation; this terminal-follow release requires no internet exposure. (#2187, #2189)
• Publishing a team bundle: add and declare a README after rig export, then run rig bundle check at the revision being submitted (#2176). Queue guidance teaches parking long waits with a continuation and wake (#2167).
• Contributor maintenance: the test guide corrects installed-scenario counts and cases (#2165); the compaction receipt fixture shares one clock, with no product change (#2169). Published release notes, the capability map and roadmap records were carried forward (#2161, #2175, #2197).

Limits carried forward

• Follow mode is Linux Herdr 0.9.5 / protocol 22 only. Other platforms, providers and selector kinds retain one-shot open. Its exercised journey used shell stand-ins, not native agents. Active render cost is unmeasured. The first workspace on an empty provider may gain focus, and a viewer can resize the agent's terminal; ignore-size is not resize isolation.
• Unreadable composers retain departed tiles. This includes input the inspector cannot read on Pi, terminal or community harness seats; unpinning alone does not establish that closing is safe.
• Escalation across rigs is same-daemon only. Upgrade followed by snapshot restore of deferred escalation targets has not been qualified.
• A webhook 2xx is acceptance of the ring, not pickup. A hosted member's activity remains unknown between calls. Principals record attribution, not authentication. See hosted members.
• Reviewed-history resume remains a client operation through startup review, not a CLI command. Kernel restore evidence lasts one daemon process.
• OpenClaw interrupted local turns are not recovered; Hermes has no declared resume or measured idle gateway exit. rig down stops a community harness's pane; survival of independently spawned children remains untested. Inspect actual processes before relying on their exit.
• The reported Codex restart refusal in #2200 remains unresolved, as do the other 0.7.4 limits unless a change above names them fixed: Codex permission qualification only on 0.164.0, earlier removed hook approvals, SSH tiles after a Herdr restart, unqualified native cmux, Slack-only shared channels and the existing browser-sizing and old Slack-thread limits. Isolated account-home switching is not included.

Credits

Thanks to @icey-zzz (#1772), @Aschenbath (#2153, #2159, #2162, #2169, #2179), @DeryFerd (#2164, #2165), @Nikhi00718 (#2172) and @dajiaohuang (#2188). Thanks also to @rudycelekli for the contribution from #1416 completed in #2160; to @AdamWhitehurst (#1544, #2049), @kevinhsykes (#2151), @aanestesia (#605), @todie (#1419) and @tgrundtvig (#21), whose reports led to fixes here; and to the other people whose reports and reviews led to these fixes.

[0.7.4]

OpenRig 0.7.4 lets an assistant you already use work as a member of your team. An assistant connected over MCP can be listed on its rig's team as a hosted member, learns from the connection how to take, finish and hand on work, can ask a person while keeping the item, and can be rung by a webhook when work lands for it; when nothing can wake it, its person is told instead. rig mcp serve --http can check each remote caller's key with an external grant service, offer OAuth discovery, record whose grant acted, and serve MCP clients on protocol revision 2026-07-28 beside 2025's. You can list the conversations a seat could resume, and a client can resume the one a person reviewed. Daemon start now brings back only a kernel that this start found down. It is built from the commit tagged v0.7.4. The changes since 0.7.3:

Before you upgrade

• Restart the daemon after installing. One database update applies on its first start (migration 140). It adds a column, empty on earlier rows, that records which grant's caller acted, to queue transitions and their archive, inbox and outbox entries, and stream items.

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

• The bundled openrig-core plugin goes from 0.1.20 to 0.1.21. The queue-handoff skill gains writing guidance, and the Claude hooks add StopFailure, which reports a stop caused by a rate limit. As before, startup first copies each file it replaces under $OPENRIG_HOME/backups/managed-refresh/<id>/; if you edited one, reapply your change from the copy. A Claude seat gets the new hook at its next launch, resume, restore or handover. Codex sees its openrig-core plugin as changed: if a Codex seat stops at "Hooks need review", review the hooks in Codex.
• Going back to 0.7.3 leaves migration 140's column in place, unread.

What's new and fixed

Assistants as team members

• A rig's team shows the members that live outside a terminal. A roster entry can mark a member as hosted ("hosted": true), such as an assistant connected over MCP. rig_team lists a rig's hosted members with their declared capabilities and caveat, no pane, and activity unknown: OpenRig doesn't observe a hosted member between its calls, so it never reads idle. A roster that can't be read gives a note, never "no members". rig roster show and find say the member is hosted. (#2095)
• The connection teaches the assistant how to work. The MCP server's instructions say that its inbox is the items addressed to its seat, that a wake only points at the inbox, and to claim an item, do it, then close it with the answer or hand it on. When an item needs a person's approval first, it keeps the item and asks: it blocks the item on that person with the question as the summary, and the answer returns the item in progress. A hosted member can call rig_whoami to learn the seat it acts as. (#2095, #2127)
• When work waits for a member nothing can wake, the person is told. The stuck sweep used to address its finding to that same member. Now it goes to the person, on Steering and the TUI's Feed, and to Slack under the default subscription, saying to ask the member to check or to fix the address. (#2110)
• A hosted member can be rung when work lands for it. Its roster entry declares a webhook trigger: wake.webhook with url_ref, authorization_ref and optionally secrets_env_file. These are secret names, read from the daemon's environment or a 0600 env file; values never go in rosters or rows. OpenRig POSTs a pointer to the row (the event work-waiting, the row id, destination, summary and sender, never the row's body), waits up to 10 seconds and doesn't follow redirects. A 2xx is recorded as the ring being accepted, not as the member waking. If the member doesn't claim the work by the stuck sweep's unclaimed age, its person is told. (#2115)
• The team sees when a hosted member last showed up. rig_team shows when each hosted member last called the team's MCP server, and its latest ring and how that went; rig roster show and find show the last call. With no evidence it says unknown, never idle, and a claim on a row is still the only pickup. (#2121)

Remote MCP callers and grants

• rig mcp serve --http --grant-service <url> checks each request's key with an external grant service instead of the local token file, on every request, with nothing cached. --grant-service-header-file <path> sends one Name: value header with each lookup. (#2096, #2141)
• OAuth discovery: --oauth-resource <url> with --oauth-issuer <url> publishes OAuth protected-resource metadata (RFC 9728), so an MCP client that signs in with OAuth can find out how to authenticate, and a request with no credential or a bad one gets a standard challenge. The key and its grant still decide what the caller may do. (#2135)
• Whose grant acted is recorded. The rows a granted caller's actions write record the caller's principal (principal:v1): its source, its grant name or id and, for a grant service, the grant's version. It's attribution, not authentication, and never a credential. (#2098, #2141)
• A caller's seat that was created but never launched (for example with rig import --materialize-only) is served, instead of every request being refused with seat_unavailable. (#2125)
• A caller granted through a grant service hands its tasks to the team it was granted, never to its own caller seat or another caller's (#2132), and can't attach tags that claim OpenRig's own Slack provenance or a workflow's internal sign-off, so a person asked about its task sees its whole text (#2126).

MCP protocol 2026-07-28

• rig mcp serve, over stdio or --http, serves clients on MCP protocol revision 2026-07-28, which has no initialize handshake, sends its version on every request and may open with server/discover. They reach the same tools and the same work loop. Clients that open with 2025's initialize keep working unchanged, on the same endpoint and process. (#2112)

Resuming the conversation you chose

• rig seat history --rig <id> --node-id <id> lists the recorded Claude and Codex conversations this exact node could resume, read-only and without native tokens (--json; --snapshot-id with --history-session-id checks one reference it returned). The rig ID is rigId in rig ps --nodes --json, and the node ID is identity.nodeId in rig whoami --session <seat> --json. (#2100)
• A client can resume the history a person reviewed for an exact node, through the daemon's startup review. Applying it rechecks the choice and the settings through the existing restore path, and refuses, rather than substituting another conversation or starting fresh, if the history changed or became unavailable. A running or unverified terminal is left alone. With 0.7.3's saved seat settings by node id (#2051), this completes the three stages agreed in #1837. (#2109)

Task views

• rig terminal open and the daemon's terminal preview accept qitem:<id>: the current local owners of that task, meaning its pending, in-progress and blocked rows through explicitly linked successors, without closed predecessors or past senders. Stopped, missing, external and unresolved owners are named, and incomplete lineage is reported rather than cut short. It's a read-only membership view: it doesn't follow the task as it moves, and an explicit open still has the provider's usual workspace effects. Preview and open responses now carry viewDescriptor (kind, name). (#2131)

The kernel at daemon start

• Startup brings back a kernel only when this start found it down, which is what a reboot leaves. A kernel that was already down before this start stays down, with its old conversations. rig start and rig daemon start --wait-for-kernel say why and how to bring it back (rig up kernel --existing); --wait-for-kernel no longer prints a timeout and an authentication hint for a kernel skipped on purpose, and still exits 1. (#2146, #2152, #2156)

Seats and runtimes

• A Claude seat stopped by a rate limit is recognised from Claude's StopFailure hook, even when its status line shows no usage window, and pending handoffs use the existing wake ladder and retry timer. A delayed older Claude hook no longer replaces the current state in send readiness, attention, review telemetry or the wake scheduler. (#1908, #2113)
• rig handover --source fresh on Claude reports the restore packet delivered only when Claude's composer shows it submitted. If it's still staged after one retried Enter, the handover fails with context_delivery_failed. (#1863)
• A periodic snapshot between separate named-agent launches keeps a down agent's resume source, including its restore policy and community harness selection, without claiming it was running. (#2123, fixes #1822)
• A resumed Pi seat no longer prints Entry not found after READY on every restart: a saved history cursor Pi doesn't hold is recovered. (#2122)

People, parks and reviews

• A park on a registered person's own address (<id>@external) resolves only from a Slack reply written after its question was posted (#2106), keeps its --summary and --evidence-ref (#2107), and shows in NEEDS YOU in the slice, mission and rig reviews, with asks to that address, instead of the person being listed as an agent holding work (#2108).
• The reviews' agents band counts only open rows as held, and a seat with work in progress reads as working even when it also has an older blocked row. (#2136, fixes #2129)

TUI and CLI

• rig or rig tui started in a terminal that reports 0 rows or columns waits and draws on the next resize, instead of crashing on its first frame. (#2099)
• The TUI lists a host's rigs by name, in rig ps's order. (#2134, fixes #2130)
• Opening a seat whose runtime doesn't report effort no longer shows a failed read in the TUI header. (#2102)
• rig whoami, rig down, rig ask and rig health in a tmux pane without OPENRIG_SESSION_NAME no longer print tmux's invalid option errors. (#2103)

Also: an artifact whose frontmatter header isn't closed no longer wakes an artifact-pool worker as ready (#2016); with Pi cost reporting on, a seat that now runs Claude or Codex shows its current cost, and a charge lookup retried during a re-post finishes (#2120); the queue-handoff skill says to write a handoff that can be acted on after one read, as guidance and not a filter (#2154, #2155); the harness preset guide says to check that a harness answers on its own first (#2116); seat environments are exercised on Linux in CI (#2101); and portability and test fixes (#2147, #2148, #2149).

Behaviour that changed

• A kernel that was already down before daemon start is no longer restored on that start; see "The kernel at daemon start".
• rig daemon start --wait-for-kernel for a kernel skipped on purpose prints the reason and the way back instead of a timeout header and an authentication fix. It still exits 1.
• Work waiting for a member nothing can wake is reported to its person, not to that member.
• A caller granted through a grant service can't address its own or another caller seat, or set OpenRig's Slack provenance or a workflow's internal sign-off tags.
• A park on a registered person's address resolves only from a reply written after its question.

Known issues

• A webhook ring proves only that the endpoint accepted it. Whether the member woke and took the work is its claim on the row. An ordinary chat app can't receive unsolicited events, so a hosted assistant without a webhook-capable runner sees work only when it checks. (#2115)
• A recorded principal is attribution, not authentication. The daemon records what the MCP adapter tells it about the caller it checked. (#2098)
• The task view (qitem:<id>) is membership only. It doesn't follow a task as it moves, keep a reusable viewer, or change who may type into a seat. (#2131)
• Resuming a reviewed history has no CLI yet. rig seat history lists and checks; applying a choice is through the daemon's startup review, for clients. Choices are limited to this node's eligible Claude and Codex histories in the current compatible snapshot. (#2100, #2109)
• The kernel's restore evidence lasts one daemon process. If the first daemon after a reboot exits before the kernel's restore starts a seat, the next start finds it already down and leaves it down, saying so. Bring it back with rig up kernel --existing. (0.7.3's issue of a long-gone kernel returning on daemon start is fixed by #2146.)
• OpenClaw's interrupted local turns are still not recovered. The seat shows as needing attention, and a send submits a new turn: inspect the pane with rig capture first. For an unattended seat, use the Gateway preset. (#2092)
• Whether processes a community harness starts outside its pane survive is still not exercised, and rig down stops only the pane. (#2088, #2077)
• Hermes: as in 0.7.3, the example preset doesn't declare resume, and whether a seat's Hermes gateway exits once idle is unknown, although docs/reference/community-harness-presets.md says it exits. Check with ps before relying on it.
• A Codex seat's own permission settings were enforced natively in 0.7.3's test with Codex 0.164.0; other Codex versions weren't tested. (#2048)
• Upgrading doesn't restore Codex hook approvals that an earlier OpenRig removed. If Codex asks for hook review, approve the hooks you mean to enable. (#2035)
• After the last managed session ends, an empty tmux server may stay running. That alone doesn't mean an agent is still running.
• Slack threads from before 0.7.3 keep 0.7.3's limits: a reply on an ask parked before the fix can still reach the person asked, and a message received before 0.7.3 can still show OpenRig's routing footer, policy text and attachment paths when an agent asks a person about it. (#2119, #2124)
• Shared channels are Slack only, and the primary user's authority in the TUI is attribution, not authentication. (#1992, #2006)
• The cmux path wasn't tried in a real cmux, and a remote host's rigs are read over HTTP only. (#2080, #2052)
• Window sizing: a browser that closes while the daemon is down leaves the window at the browser's size until the next web-terminal visit, and a --readable capture isn't atomic with a person's own edits. (#2065, #2075)
• The runtime-switch handover change hasn't been shown to cure the unsent-handover case that prompted it. (#2054)
• The community harness field keeps its name (communityHarness) and its original database update; renaming them would break a return to 0.7.2.
• Not in this release: verified task viewers (#2133), switching a seat to an isolated account home (#2138, #2143), source evidence for resolving stuck findings (#2153), the stale-pane repair message (#2157), current launch evidence for fresh handovers (#2159), and a warning for out-of-range MCP daemon ports (#2160). Hermes resume and measured idle exit, and OpenClaw interrupted-turn recovery, aren't in this release either. The limits listed for 0.7.3 still apply unless a change above names them fixed.

Credits

Thank you to everyone whose work is in this release: @Aschenbath (#1908, #2101, #2113), @Nikhi00718 (#1863, #2016, #2106, #2107, #2108), @bradvin (#2100, #2109), @dajiaohuang (#2123) and @seanmcn (#2147, #2148, #2149). And thank you to @pr0xc3nt4ur1 (#1822), @duncanleung (#2130), @ziadeh (#2129), @alperta (#99), @smota (discussion #2117) and @oSquashBlossomo, whose reports and reviews led to fixes here.

[0.7.3]

OpenRig 0.7.3 lets a team work with several people. You can register more than one person and choose a default, add a Slack shared channel whose members reach the team with each message labelled by who sent it, give organizations and groups a policy the agents can read, and see in the TUI's Feed whose queue you are looking at. Community harness authors get a written contract and tests, and an OpenClaw seat whose last local turn was refused now shows as needing attention. Codex seats can keep their own sandbox and approval settings, and Codex's own trust and config edits survive OpenRig's next launch. It is built from the commit tagged v0.7.3. The changes since 0.7.2:

Before you upgrade

• Restart the daemon after installing. One database update applies on its first start: it adds a column for a Codex seat's own permission settings.

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

• Startup replaces OpenRig's own plugin and skill files (openrig-core goes from 0.1.19 to 0.1.20; the messaging-the-human skill changed). As in 0.7.2, it first copies each file it replaces under $OPENRIG_HOME/backups/managed-refresh/ and logs where, edited or not. If you did edit one, reapply your change from the copy. The shared openrig-herdr skill that seats can load also changed.
• If you register a second person, choose a default person with rig gateway default <id>. With several people registered and no default, the last escalation step posts to nobody and the notice digest waits. An install with one person is unaffected. (#1992)
• If a seat relied on inheriting the daemon's own environment (ANTHROPIC_BASE_URL, OPENAI_BASE_URL or CLAUDE_CODE_USE_BEDROCK, for example), declare the variable in the rig's or member's env:. The first seat on a new tmux server used to get the daemon's whole environment; it now gets the same scoped environment as every other seat. (#2047)
• If you might go back to 0.7.2, know what it ignores. 0.7.2 loads every registered person, but not the default person, shared channels, organizations, groups or policy kept in $OPENRIG_HOME/gateway/participants.yaml, and its guard against another person's reply is weaker. It keeps a Codex seat's recorded permission settings but doesn't read them, so its launches of that seat use the earlier posture, which can be broader. (#1992, #2048)

What's new and fixed

Several people, shared channels and a default person

• More than one person can be registered: rig gateway human add <id> --display-name <name> --binding … now works for a second and third person. Choose the default with rig gateway default <id> (or --default on human add; --clear removes it). The default, or the only registered person, receives the last escalation step, the notice digest, Mission Control's my-queue view, workflow fallbacks and pairing approvals. For a workflow's human step, workspace.operator_seat_name is still read first. Everything new lives in $OPENRIG_HOME/gateway/participants.yaml, and each person's existing file keeps the keys an older daemon reads. (#1992)
• Slack shared channels. rig gateway channel add <id> --display-name <name> --binding slack:<connectorRef>:<secretsRef>:<channelId> registers a Slack channel as one participant, <id>@external. Anyone writing in that channel reaches the team, whether or not they are a registered person and even when nobody is registered. Each row ends with a block OpenRig adds after the message: the channel, its organization and groups, who sent it (a registered person, or a Slack user who isn't one) and the policy that applies (cut at 6,000 characters; the full text is in rig gateway participants --json). (#1992, #1998)
• A row sent to a shared channel is posted as a notice, and --reply-to answers in the sender's Slack thread. An ask to a channel is accepted with an advisory that nothing there will answer it, and its questions show as a plain list. A channel's messages never answer, close or resume an ask, and a channel never acts on a row. rig gateway channel remove <id> refuses while open rows are addressed to it, unless you pass --force. (#1998, #2068)
• Organizations, groups and readable policy. rig gateway org set <id> --name <name> [--policy <text> | --policy-file <path>] and rig gateway group set <id> --organization <id> --name <name> [--policy …]. Policy on an organization, group, person or channel is context for the agents' judgment: rig gateway participants [--organization <id>] [--json] and rig gateway human show --json list each line with where it comes from. Nothing enforces it. (#1992)
• Whose queue the Feed shows. The TUI's whose <person|all|default> command chooses it, and the Feed's first line says whose queue it is and who acts. With a default person, the TUI opens on their Feed. Answering, approving or resolving someone else's ask from the TUI records the primary user (the default person, or the only one registered) as acting, and the note keeps the person who was asked. This is attribution on a trusted network, not a login. (#2006)
• A park addressed to a registered person (<id>@external) can be resolved. (#2061)
• rig slack post-open-asks posts the asks that are still open, for example after rig slack enable, which now points to it when there are some. (#2086, suggested by @rakoort in #1679)
• The reply hint on a person's message now carries --reply-to, so an agent following it answers in the person's Slack thread. This was a known issue in 0.7.2. (#2055)

Community harnesses

• docs/reference/community-harness-presets.md says what a community harness gets from OpenRig and what it doesn't (no turn-cancel verb, no approvals reaching OpenRig), how to write one in five steps, and how promotion is judged. Tests now cover the coordination and resume contract. (#2078, #2088)
• OpenClaw: when OpenClaw refuses its last local turn ("Session … changed while starting work. Retry."), rig ps, the seat list and the TUI show the seat as needing attention (OPENCLAW_TURN_NOT_RECOVERED), and a send to it says it submits a new turn. OpenRig doesn't recover the refused turn (see Known issues). (#2092)
• rig down names the community harness seats whose own processes may keep running after their pane stops (Pane stopped: …, and paneOnly in --json). (#2077)
• Hermes: the example's docs now say a Hermes gateway runs per Hermes home, so one per seat with the example launcher. A two-seat run showed separate gateways, homes and sockets, and stopping one seat left the other running. (#2097)

Codex seats

• A Codex seat can keep its own sandbox and approval settings: rig seat set-permissions <seat> --codex-permissions <file> (sandbox, approval, and for workspace-write also network_access, writable_roots, exclude_tmpdir_env_var and exclude_slash_tmp), or codex_permissions in the spec. --codex-profile <name|inherit> sets an existing seat's Codex profile. They're passed as explicit flags on every managed launch, resume, restore and handover; seats without either launch as before. (#2048)
• A launch finds the trust tables Codex saves with single-quoted keys, instead of adding a duplicate that stopped every Codex session on the machine from starting. (#2034, reported by @borfast in #2029)
• After "Trust all" in Codex, the trust survives OpenRig's next launch, and OpenRig no longer adds its hook groups again when Codex has moved them. (#2035)
• OpenRig finds its own Codex config tables wherever Codex moved them, keeps a table of yours that Codex printed between its markers, and refuses a write that would change anything beyond its own tables. (#2046)
• A Codex resume command now puts the conversation id right after resume, so a directory with a space in it can't be read as the id. (#2038)
• A verified Codex seat started under a shell or launcher gets its generation record; a real conversation mismatch is refused with its own message. (#2084 by @Aschenbath, diagnosed by @fsafey in #1799; #2094)

Terminals, capture and the TUI

• rig capture --readable (120x40) or --size <WxH> reads a small seat at a readable size and then gives its window back. --json adds readable. (#2075)
• After someone watches a seat in the web terminal, or follows capture's resize hint, the window gets its own size and sizing mode back. (#2065)
• A TUI running inside cmux opens terminal views in cmux, and a cmux_unavailable answer names cmux's automation setting. (#2080, reported and traced by @R14014 in #1069)
• The TUI keeps a registered remote host in the topology tree on every tab, and drilling in lists its rigs. (#2052, reported by @AdamWhitehurst in #2049)
• rig setup and rig doctor check that tmux can capture a pane, on a throwaway server. No tmux version is refused. (#2081, from #980 by @MichelMabinuola)
• New seats keep tmux's TERM_PROGRAM and TERM_PROGRAM_VERSION, which Claude Code uses for Shift+Enter and image paste in tmux, and the first seat on a new tmux server gets the scoped environment too. (#2043, #2047, reported by @AdamWhitehurst in #2041)

Sending and the queue

• rig send --wait-for-idle longer than 300 seconds no longer fails at 300 seconds, and rig skill loadout --apply --wait-for-idle waits as long as asked. (#2020, #2024)
• A local rig send whose connection drops says delivery is unconfirmed, not that the message wasn't sent. (#2060)
• Claude's "Resume session" picker reads as waiting for a person, and a send there refuses with target_needs_input instead of typing into its search box. (#2040)
• rig workflow project past an unanswered human gate says, in its advisories and the transition note, that it doesn't record the person's consent, and the messaging-the-human skill says a response isn't consent. (#2093, refs #1710 by @george661)
• The delivery digest says why it sent nothing. (#2063 by @Coder8124, part of #800 by @d3fvxl; #2066)
• rig config set feed.subscriptions.<host>.enabled accepts a host id with dots. (#2062, reported by @AdamWhitehurst in #2057)

Seats, launch, export and workspaces

• A seat's saved settings (permissions, policy, model, effort) can be targeted by the node id a client showed; if that node is gone, a same-named replacement isn't chosen in its place. docs/reference/seat-node-targeting.md describes it. (#2051 by @bradvin, the first part of #1837)
• A runtime switch's handover to Claude Code waits for Claude's input box, and sends Enter again while the handover is still in it. (#2054)
• rig export keeps each pod's startup files. (#2087 by @Aschenbath)
• Applying a pod, launching a member or retrying a first start resolves launch profiles off the daemon's request thread. (#2067 by @Aschenbath, refs #1653 by @VltrnOne)
• rig scope --workspace <path> mission create creates the first mission in that workspace, and refuses a path that doesn't exist; slice create no longer falls back to the global missions root. (#1093 by @Coder8124, reported by @kainne44 in #70)
• The execution view skips pickup history it doesn't use for blocked rows, and large candidate reads let other daemon requests run in between. No overall speed-up is claimed. (#2042, #2039)

Messages and docs

• A Slack channel-map change says to restart the daemon, not to disable and enable Slack, which would mark waiting alerts as already posted. (#2072)
• A queue verb run outside a managed seat says to set OPENRIG_SESSION_NAME, instead of naming a flag it ignores. (#2074)
• New or corrected docs: what a seat is set to versus what it runs, and a newcomer's reading order (#2079); an exact resume delivers no startup actions, and a managed Claude seat keeps its session name (#2085); separate work goes in a queue row, and --wait-for-idle sends nothing if the wait ends busy (#2089); the A2A walkthrough (#2082); one continuing Slack conversation keeps its earlier context, whoever writes (#2083); two cases where Herdr reads a waiting seat as idle (#2056); the account and permission choices in the CLI reference (#2073); and which scope commands refuse a missing --workspace tree (#2064).
• For contributors: mocked startup tests no longer wait in real time (#2091 by @sn1thy), the first-run reference check works with Windows paths (#2050 by @DeryFerd), and test cleanup waits for private tmux children (#2070).

Behaviour that changed

• A registered person can't settle an ask that was asked of someone else: it's refused with answer_not_recorded. Using a terminal no longer overrides a different registered person's identity; from the TUI, the primary user can. (#2061, #2006)
• A shared channel is refused for every action on a row, not only for answers and approvals, and an act on a channel's ask is recorded as the person at the terminal. (#2068)
• With several people registered and no default, the last escalation step reads undeliverable:no-default-person, and the notice digest waits until a default is chosen. (#1992)
• The first seat on a new tmux server no longer inherits the daemon's whole environment. (#2047)
• rig scope --workspace <path> mission create refuses a path that doesn't exist instead of creating it. (#1093)
• A send to a Claude seat at its "Resume session" picker refuses (target_needs_input), and startup there reports attention_required at once instead of waiting out its timeout. (#2040)
• A Codex resume command reads codex resume <id> --add-dir …; older process lines are still read. (#2038)
• rig capture's small-pane hint points to --readable. (#2075)
• In the execution view, a blocked row no longer carries a last-activity time. (#2042)

Known issues

• OpenClaw's interrupted local turns are not recovered. OpenRig shows the seat as needing attention and a send submits a new turn, but it doesn't repair or retry the refused one: inspect the pane with rig capture first. Recognition covers OpenClaw 2026.10.6's local layout with its complete two-rule editor; a cropped, changed or ambiguous layout isn't recognised, and any other full-width rule in the captured lines leaves a real refusal reading unknown. For an unattended seat, use the Gateway preset (openclaw-gateway.yaml), within what that preset declares. This was checked against a retained OpenClaw screen, not yet against a running OpenClaw. (#2092)
• Whether processes a community harness starts outside its pane survive is not exercised by the contract tests. rig down stops only the pane. (#2088, #2077)
• Hermes: the example preset doesn't declare resume, because reopening a named session (and a missing one) hasn't been checked with a real Hermes. The remaining real-Hermes checks weren't run, whether a seat's Hermes gateway exits once idle is unknown, and the pane-only stop hasn't been checked again on 0.7.3. (#2077, #2097)
• docs/reference/community-harness-presets.md says a seat's Hermes gateway exits once idle ("Stopping"). That hasn't been checked: whether it exits is unknown. Check with ps that a stopped seat's gateway has gone before relying on it.
• Shared channels are Slack only. A binding must be slack:…. If participants.yaml can't be read, no shared channel is known: no channel sender is admitted, and rig slack post-open-asks can miss asks to channels. (#1992, #1998, #2086)
• The primary user's authority is attribution, not authentication. Only a current TUI sends it (a request without a seat identity); an older TUI's answer on someone else's ask is refused. (#2006)
• A Codex seat's permission settings were enforced natively in our test with Codex 0.164.0, including after a managed restore and a restart. Other Codex versions weren't tested. Going back to an older OpenRig keeps them unread (see Before you upgrade). The Codex trust fixes stop new duplicate hook groups but don't remove existing ones. (#2048, #2035)
• The cmux path wasn't tried in a real cmux, and a remote host's rigs are read over HTTP only: an SSH host stays listed, but drilling in can't read it. (#2080, #2052)
• rig or rig tui started in a terminal that reports 0 rows or columns crashes on its first frame (a detached, headless or just-resizing pane). It's present since 0.7.2 and fixed on main by #2099 for the next release. Start the TUI in a terminal with a size.
• Window sizing: a browser that closes while the daemon is down leaves the window at the browser's size until the next web-terminal visit, and a --readable capture isn't atomic with a person's own edits to the window. (#2065, #2075)
• The runtime-switch handover change hasn't been shown to cure the unsent-handover case that prompted it. (#2054)
• The community harness field keeps its name (communityHarness) and its original database update; renaming them would break a same-database return to 0.7.2.
• Not in this release: per-instance tmux isolation (#1260), the read-only client submit retry (#2090), the prime-agent runtime (#2069), hosted members on a team (#2095) and grants from an external grant service for rig mcp serve --http (#2096). The limits listed for 0.7.2 still apply unless a change above names them fixed.

Credits

Thank you to everyone whose work is in this release: @Aschenbath, @Coder8124, @bradvin, @sn1thy and @DeryFerd.

Thanks also to @AdamWhitehurst, who reported #2041 (addressed by #2043 and #2047), #2049 (addressed by #2052) and #2057 (addressed by #2062); @borfast, who reported #2029 (addressed by #2034) and the repeated trust prompt in #17, which @jimallen opened (addressed further by #2035); @R14014, who reported #1069 and traced it through the code (partly addressed by #2080); @kainne44, who reported #70 (addressed by #1093); @VltrnOne, who reported #1653 (worked on in #2067); @d3fvxl, who reported #800 (part addressed by #2063); @fsafey, who reported and diagnosed #1799 (addressed by #2084); @MichelMabinuola, who reported #980 (addressed by #2081); @rakoort, whose suggestion in #1679 became #2086; @george661, whose #1710 led to #2093.

---

[0.7.2] - 2026-10-25

Published as @openrig/[email protected], built from the commit tagged v0.7.2 (8b180689). This entry carries the corrected public notes from the GitHub Release.

OpenRig 0.7.2 gives each seat more of its own setup. A seat can run on its own Claude or Codex account, move to another login or to the other runtime without leaving its team, and keep its own Claude tool rules in a shared project folder. Sends are refused less often at seats that are plainly working, and more reliably at real dialogs, including Pi's. Codex seats can still commit after a restore, an assistant over MCP can hand work on, and Rex joins Herdr and cmux as a terminal. It is built from the commit tagged v0.7.2. The changes since 0.7.1:

Before you upgrade

• Restart the daemon after installing. Six database updates apply on its first start.

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

• Startup replaces OpenRig's own plugin and skill files (openrig-core goes from 0.1.18 to 0.1.19; the delegating-work and openrig-user skills changed). As in 0.7.1, it first copies each file it replaces under $OPENRIG_HOME/backups/managed-refresh/ and logs where, edited or not. If you did edit one, reapply your change from the copy.
• On Linux, if a seat's tools use the session bus, set the bus address in the rig's or member's env:. Seats now start with an address that can't connect, even when a shell startup file sets XDG_RUNTIME_DIR (see Behaviour that changed and Known issues). (#2036)
• Declare a seat's own CLAUDE_CONFIG_DIR or CODEX_HOME in the rig spec's env:. A one-off rig up --env no longer applies those two, and says so. (#1945)
• If you might go back to an earlier version, set equivalent native Claude rules first. Code from before #1914 opens the upgraded database but leaves per-member Claude tool rules out of launch, so a seat's denies stop applying. docs/reference/rig-spec.md has the details. (#1914)

What's new and fixed

A seat's own account and runtime

• A seat can run on its own Claude or Codex login. Sign in to a separate home once, natively, then name it as an absolute CLAUDE_CONFIG_DIR or CODEX_HOME in the member's or rig's env:. It applies at the seat's next launch, and rig seat status and rig provider status show which home a seat uses and where it comes from. (#1937, #1945)
• rig provider switch --seat <seat> now moves one seat to another subscription login on the same conversation. A Codex seat moves to a login saved in its own Codex home (--to-account <name>, Linux only), after its current login is saved as before-switch-<time>. A Claude seat moves to its own subscription token file (--token-file <path>, made with claude setup-token), and --stored-login moves it back; OpenRig keeps only the file's path and your label, never the token. rig provider precheck --seat <seat> shows what a switch would do, changing nothing. (#1972, #1980, #1991)
• rig seat set-runtime <seat> --runtime claude-code|codex --reason "<why>" moves a live seat between Codex and Claude Code. The successor starts first, gets a handover and confirms it before the old runtime stops, and the seat keeps its address, queue rows and claims. --dry-run shows the settings, what is cleared and the costs; --recover finishes an interrupted switch. Built on @Aschenbath's design in #1214. (#1895)
• rig provider status --refresh --provider claude --claude-token-file <path> --credential-label <label> reads a Claude token's usage on request, one model turn per refresh. (#1901)
• A Claude seat set to the alias haiku with the plan permission is told at launch, at restore and in rig seat status that Claude Code answers its plan-mode turns with Sonnet, and how to set a full Haiku id. (#1942)

Claude tool rules per member. Claude members that share a project folder can keep their own tool rules: claude_permissions with allow and deny lists in the spec, or rig seat set-permissions <seat> --rules <file.json> --reason "<why>" for an existing seat. A change is audited and applies at the next managed launch or resume; OpenRig never writes the rules into the project's Claude settings. Checked natively on Claude Code 2.1.309: two seats in one folder enforce their own rules, a managed policy wins, and fresh, resume and fork launches enforce them. See Known issues for what isn't claimed. (#1914)

Sending to a seat

• A working Claude seat that quotes approval-prompt text in its own output, such as › 1. Yes, proceed (y), no longer has sends and queue wakes refused as if it were at a prompt, including when Claude draws its input box high in a tall pane. Real permission, question and MCP dialogs still refuse. (#1955, #2005)
• A draft in a Claude seat's input box that starts with a blank line no longer reads as an empty box, so a send isn't typed into it. (#1977)
• A draft-aware send to a Claude seat keeps ownership of its paste when Claude's footer changes to a hint such as "paste again to expand" (see Known issues for #14). (#1921)
• An ordinary rig send to an adopted Pi window waiting at a confirmation dialog is refused with target_needs_input and types nothing, instead of choosing the highlighted answer (#2015). A later change extends that recognition to Pi's input and editor dialogs, including help rows that wrap in an 80-column pane (#2026). A Pi seat that OpenRig runs shows an extension dialog in its pane, cancels it and marks the seat as needing attention (#1996).
• A queue wake refused at an approval prompt is retried once when the seat's attention clears, instead of waiting for the stuck sweep. (#1961)
• After a person declines a Claude permission prompt, rig seat clear-attention <seat> --reason "<what you saw>" clears the prompt the latest hook still names, and the send refusal says to. (#1912)
• rig send to a mid-turn Codex seat says the message joins the running turn and may redirect it, and names --wait-for-idle for separate work. (#2007)
• rig capture says when a pane smaller than 80x24 may cut off the prompt a seat is at, with the command to resize it. (#1969)
• A seat with an unrelated pane beside its own still gets sends and wakes, in its recorded pane. (#1616, @Vaishnavi220506)

Codex seats

• A Codex seat on the default workspace-write sandbox can still commit after a resume, fork or restore, and can write its own topology folder, so it keeps its LEARNED.md. When the sandbox refuses its recap, the daemon saves it. (#2000, #2023, #2018, #2008)
• rig seat restart --keep-conversation on a Codex seat keeps a writable root whose path holds a space, looks for the resumed conversation in the home the running Codex uses, and, when it can't prove the resume, says the pane restarted instead of "nothing was restarted". (#2003, #2037, #1950, #1958)
• When a Codex home has a hooks.json, OpenRig puts its activity hooks there and moves its own old inline block out of config.toml. Your hooks, their trust and your disables stay; @fsafey found the mixed-format problem in their fork. (#1957) Inline hook trust is keyed by the managed group's actual position. (#2028, @dajiaohuang)
• A signed-out Codex seat at the sign-in chooser or API-key entry reports login_required instead of waiting out the readiness timeout (Codex 0.164.0 and 0.162.1). (#1967, @Aschenbath) (#1983)
• A resumed Codex seat is recognized when its footer shows a model with a reasoning label, such as GPT-6.1 Sol medium, or a versioned non-gpt model, so rig up --existing no longer stops there. (#1944) (#1778, @Nikhila-Dhevi-R)

Claude compaction and restore

• A managed Claude restore reads its own restore files without stopping at a Read approval, including on macOS, through a symlinked home or project, and for the generic or configured post-compact-extra.md and preparation root. The grants apply from the seat's next launch or resume. (#1940, #1952, #1962)
• A seat restored with claude --resume that stops at Claude's resume chooser in a tall pane is reported as waiting for a person's choice instead of resumed, and a Codex model chooser there reads as model_selection_gate. An old chooser above a resumed session no longer reads as live. (#2010)
• After a managed compaction, a Claude seat's restore starts on the next poll instead of waiting for something to change its screen. (#1971)
• rig compact <seat> --state and seat status show an owed restore stage and its last delivery result, and repeated failures open one queue item for whoever can act. (#1953)
• When Claude refuses a startup turn late, for example on an expired login, OpenRig checks again before the next startup input's Enter and holds the rest as owed. (#1976)
• The model-divergence monitor no longer flags a Claude seat pinned to an undated id that answers with its dated snapshot, or to a Bedrock inference-profile id. (#1927, #1931)

Assistants and other agents

• OpenRig's MCP server adds rig_queue_handoff and rig_queue_unclaim (36 tools), so an assistant can pass held work on, or put it back, in one step. (#1970)
• A community-harness preset can set first_input: true to hand the harness its first startup turn at launch instead of pasting it into the pane. The Cursor example uses it and is no longer startup-assisted, and OpenClaw seats keep named conversations as a local agent or a Gateway client. (#1987, #2017, #2009)
• rig stream act <id> records what a reader did about a stream item: --work <row>, --decline "<reason>" or --duplicate <id>. rig stream show lists each reader's current action. (#1899)
• The guide that rig acp run --help names now ships: rig context get reference/acp-agents.md. (#1930)

Running a team

• Rex is a terminal provider. From a Rex pane, rig terminal open <view> --window and the TUI open the team's view as a Rex session; --provider rex selects it. (#1935, @vanducng)
• An open rig view keeps a seat's tile when its tmux session is replaced, and a fresh replacement prints how to reopen the view. (#1964, #1941)
• rig launch <rig> <seat> first-starts one seat of a team imported with --materialize-only, without restoring the others. (#1965)
• A pod seat that never launched starts fresh from its saved launch recipe after a daemon restart, instead of waiting at a shell. (#1503, @Vaishnavi220506)
• After a team's tmux server dies, rig down settles its seats, so rig archive and rig up can proceed. (#1999)
• A team of terminal seats reads fully restored after rig start, and rig down names the terminals it stops. (#1984)
• A launch whose tmux made no session fails as session_not_created or session_unconfirmed instead of reading launched. (#1910)
• A service bundle install on a machine without Docker Compose v2 stops with compose_missing before it writes the target or creates the team, and --plan warns that it would. (#2025)
• rig export copies the team's culture file and names each seat whose agent ref points outside the exported folder. (#1975)
• rig queue resolve <row> --decision "<evidence>" also releases a row parked on a typed blocker such as external:, fold: or auth:. (#1809, @dajiaohuang, from @BillyOutlast's report)
• rig queue whoami resolves a project-tagged row against its catalogued project, rig proof add finds a slice in another catalogued project, and rig scope mission create writes the mission's name. (#1526, @Vaishnavi220506) (#1938, #1936)
• A rig queue create whose outcome is unknown reads the row back once by its ID before reporting, and a cross-host write that times out reads INDETERMINATE instead of failed. (#1978, #1911)
• Slack: every post names its sender first, an escalation names the seat the work waits on, a reply from another registered person reaches the agent as their own message instead of answering someone else's question, and Slack rows name who wrote. (#1960, #1893)

Reliability

• A dead seat's stuck-sweep finding goes to someone who can act, not to the dead seat, and says which rule chose them. (#2011, #2021, #2033)
• A seat held at a choice prompt that no hook announces, such as Claude's usage-limit dialog, now escalates while it holds work. (#1919)
• The parked-owner reminder no longer reaches a seat in the first 5 minutes after it starts waiting, such as just after a handoff or a question to a person. A seat at an approval or question prompt gets no grace. (#1963)
• A Pi or OMP seat's second startup block reaches the running turn instead of raising runtime_error. (#1943, reported by @astral-fleet-sessions)
• The daemon starts listening before it works through a backlog of queue notifications, so startup doesn't time out behind them. (#1993)
• A startup database-conflict check that can't get an answer now says so, instead of reading like a clean one. (#1974, from @calv-io-n's finding)
• Proof-source monitoring watches the missions root, not the whole workspace. (#1951)
• Queue views, health reads with long histories and send checks do less repeated work. (#2031, #2013, #1994)
• A stalled-after-claim finding's age counts from the stall, not the claim. (#1959)
• From contributors: queued terminal input is dropped after its client disconnects (#1636, @Vaishnavi220506); TUI focused summaries load their health findings (#1986, @Kero-66 and @Aschenbath); the TUI keeps the stream's connection state across pages (#2014, @Nikhi00718); the web dashboard reads a skipped kernel boot as "Boot not tracked", not "Unknown" (#1917, @Aschenbath, reported by @Kero-66); the compaction-and-restore scenario runs through a launch script, and the test-system docs state the CI job's real counts (#1924, #1925, @DeryFerd).
• Guidance: the installer guide says what setup and starting Codex seats write to your home configuration, and the operator puts project work on a team's queue; a Codex user who declines the remembered command rule is offered the operator conversation; rig queue update --help and its refusal say how to cancel a row (--state done --closure-reason canceled); rig skill audit says what its stale and hash findings mean; 14 subcommands that showed a blank help summary now have one; the openrig-user skill says a queue create's request ID isn't the row; delegating-work also applies when judging a delegated result; and docs/reference/seat-delivery.md lists all six typing-guard modes. (#2001, #1973, #1956, #1966, #1923, #1909, #2012, #1989)

Behaviour that changed

• On Linux, a seat launched by OpenRig now gets the daemon's XDG_RUNTIME_DIR, with DBUS_SESSION_BUS_ADDRESS=disabled:, a session bus address that can't connect. Tools whose sockets live in the runtime directory work in seats without per-tool setup, and a seat's D-Bus clients don't find or start the session bus on their own. A seat's own XDG_RUNTIME_DIR, from env: for example, leaves both as before, and its own bus address is kept. Unchanged: macOS, a daemon started without XDG_RUNTIME_DIR, and terminal.inherit_tmux_environment on. See Known issues. (#2036, reported by @borfast in #2030)
• rig up --env CLAUDE_CONFIG_DIR=… or CODEX_HOME=… isn't applied, and the CLI says so; other --env values work as before. Name a seat's home in the spec's env:. (#1945)
• rig provider switch acts: it used to answer failed_safely every time. (#1972, #1980)
• A rig send to a seat that is switching runtime is held, not typed (outcome: retained, reason: runtime_switch_in_progress); send it again after the switch. (#1895)
• rig seat status --json always carries permissions.account.advisories (empty unless there's an advisory). (#1942)
• Every Slack post starts with From <seat> on <machine>, and an escalation's headline reads Waiting on <seat>: <summary>; update anything that read the sender from the last line. (#1960)
• A row OpenRig creates itself, such as a stuck-sweep finding or a workflow escalation, wakes its seat from OpenRig's own sender with no reply line, instead of from the row's creator. A stuck-sweep closure is recorded as stuck-sweep@system. (#1905) (#1811, @Aschenbath)
• With agents.operator_session set, a dead seat's finding goes to that agent first, then the operator seat (workspace.operator_seat_name), then the row's creator. Approvals still reach the person. With it unset, routing is as before. (#2021)
• An alert for a seat at a choice prompt follows queue.wake_human_rung: under explicit-only it stays with the operator seat as a visible row, unless that seat is a person. Only one choice-prompt alert reaches a person at a time on a machine; the others wait as visible rows and post when it retires. Permission-prompt alerts post as before. (#1919)
• On a Codex home with a hooks.json, OpenRig's activity hooks go there, and its own old inline block moves out of config.toml. (#1957)
• The recap store refuses to write through a link at RECAP.md or recap-superseded/ (recap_write_refused), a layout that used to work. (#2018)
• Cross-host queue writes wait 15 seconds for the daemon's answer, and a timeout reads "queue request got no answer in time" with the ID to reconcile by. (#1911)
• The Cursor reference preset is startup_assisted: false and passes its first prompt at launch. (#2017)
• In a Pi seat that OpenRig runs, an extension /command typed mid-turn runs at once instead of being refused as a steer. (#1943)

Known issues

• On Linux, seats now get the runtime directory with a session bus address that can't connect. This is an accepted trade-off, and default hygiene, not isolation. A shell startup file that sets only XDG_RUNTIME_DIR used to let a seat's clients find the session bus; now the seat keeps DBUS_SESSION_BUS_ADDRESS=disabled:. To use a session bus, set its address in the rig's or member's env:. systemctl --user reaches the person's user service manager from a seat, whatever the bus address. A Codex stdio MCP server still needs env_vars = ["XDG_RUNTIME_DIR"] in Codex's config.toml to see the variable. (#2036)
• Per-member Claude tool rules have limits. Member denies aren't claimed to hold in bypass mode (full_bypass). Handover and restore carry the rules, but aren't proven to keep the same conversation. An allow list doesn't withdraw broader inherited grants, and these are Claude's own tool rules, not OS or credential isolation. A change applies at the next launch or resume, not in a running process. Going back to code from before #1914 drops the stored rules from launch (see Before you upgrade). (#1914)
• Pi dialog recognition is a bounded screen check. #2015 refuses ordinary sends at an adopted Pi confirmation dialog, and #2026 later extended the same classifier to Pi's input and editor dialogs and wrapped help rows. Each was checked with a real Pi for its own case only. Layouts outside them keep the earlier behaviour, so an ordinary send can still type into them: more than six rows under a confirmation dialog's border, a widget that draws its own border, clipped or incomplete help, more than three wrapped help rows, and custom extension UIs. Neither check was repeated on the final 0.7.2 build.
• Moving a seat's account or runtime has limits. A conversation saved under a seat's earlier home doesn't resume in its new one, and live usage refresh still reads only the daemon's own logins. A Codex login switch is Linux only; other seats on that Codex home keep their old login until their next token refresh, then stop with "signed in to another account" until you run the printed rig seat restart <peer> --keep-conversation for each. A runtime switch starts a new native conversation (only the handover carries over), clears the source runtime's model, effort and Codex profile, and doesn't apply Claude launch additions such as an agent file or run startup slash commands. Selected separate-home restart/restore and useful conversation-continuity cases passed. Runtime switching worked in both directions in a minimal setup; one direction required an extra Enter. See Verification and remaining limits below for the untested paths.
• A new Claude agent's startup text can stay unsent in its input box. Press Enter in its terminal.
• Claude seats on a macOS native install can read as needing attention after a restore (#86). Check the seat's terminal before acting on it.
• A Slack channel-mapping change needs a daemon restart. Don't use rig slack disable then enable for it, which marks waiting alerts as seen.
• Ubuntu 22.04's tmux 3.2a: the known crashing query is gone, but a narrower race remains. Prefer another tmux.
• rig daemon start can take 20 to 40 seconds before its listener warning, longer than the TUI's 30-second "restore everything" wait. On a slow host, run rig daemon start yourself first.
• A Claude seat signed in with a long-lived token (claude setup-token) still gets no automatic usage reading. The reader accepts only claude.ai subscription logins and reports not_subscription_login for any other. Read a token's usage on request with rig provider status --refresh --provider claude --claude-token-file <path> --credential-label <label>; the label is yours, not an account the provider confirmed.
• Managed Claude launch requires /usr/bin/env support for -0 and -u (option support checked on GNU coreutils and macOS 15; BusyBox and older macOS unverified). Without the required option support, launch stops instead of falling back to credential-bearing command-line arguments.
• In draft-aware mode, an agent's multi-line message to a Claude seat can remain unsubmitted when the paste changes Claude's footer hint. OpenRig withholds Enter, leaving the text in the composer and later sends waiting. Observed on Claude 2.1.309 with both 0.7.0 and the 0.7.1 pre-cut build. 0.7.2 reads Claude's recognized footer hints as part of the same composer (#1921), but the original failure didn't reproduce in a native check, so #14 remains open.
• Prompt-looking text in a seat's recent output can still be mistaken for an active approval prompt in some layouts, so OpenRig can refuse sends and queue wakes. 0.7.2 lets sends through to a Claude seat whose running timer row sits directly above its empty, framed input box (checked natively on Claude Code 2.1.309, for the layouts exercised). An idle Claude seat with quoted prompt text above its input box, a draft in the box, a mode bar OpenRig doesn't recognize (such as ⏸ manual mode on), an unframed box, and Codex seats are unchanged. Inspect the current native prompt and the refusal before retrying; do not assume that waiting 15 seconds clears it.
• The shared-database check needs lsof. Without a working lsof, the check can't tell whether another live daemon holds the database. The daemon now says so at startup and on /healthz, but the optional daemon.db_conflict: stop stops only on a confirmed conflict, so it doesn't stop then. The warning for a database outside OPENRIG_HOME doesn't depend on lsof. (#1974)
• Managed Claude restoration can still ask for approvals. 0.7.2 lets a seat read its own restore files without asking, from its next launch or resume. A relative policies.claude_compaction.message_file_path still asks once, and a packet read can ask after the native conversation changes. In 0.7.1's representative test, the restore also asked to run four read-only commands, which these grants don't cover. Check the retained restore map and reported gaps before treating restoration as complete. (#1940, #1952, #1962) A native check on Claude 2.1.309 passed the Read grants with no approval prompt; a complete restore with no help isn't claimed.
• A managed Claude restore can remain owed. If a seat stays idle after compaction, rig compact <seat> --state and seat status now show the owed stage and its last delivery result; also read its saved restore map. Before sending a manual restore request, reconcile the native conversation and pending state to avoid a duplicate; do not repeat /compact merely because the restore request has not arrived. (#1953)
• On Linux, very large trees can still cause severe daemon stalls and file-watch-limit failures. Proof-source monitoring now recurses only at the configured missions root, so unrelated checkouts and build trees in the workspace aren't watched, but a large missions tree still is, and the stalls' cause hasn't been confirmed. (#1813, #1951)
• A Claude startup refusal that arrives after OpenRig's last check can still race the next startup input's Enter. When OpenRig withholds Enter, the pasted input may stay in the input box: don't resend it, and follow the recovery step the seat reports. Recovery after signing in wasn't verified natively. (#1976)
• Claude Code answers plan-mode turns with Sonnet when a seat's model is the alias haiku. That's Claude Code's own behaviour, and OpenRig now says so. Configuring the full id claude-haiku-5-5 gave a Haiku answer in a plan-mode follow-up on Claude Code 2.1.309. (#1942)
• A cross-host queue create can still end with an unknown outcome. A timed-out rig queue create --host now reads INDETERMINATE, and the CLI reads the row back once by its ID. If it's still unknown, check that host for the original row ID before retrying. If the row exists, do not create a replacement. If a retry is needed, reuse the same --id and payload; an unsuccessful read is not proof that the row is absent. (#1911, #1978)
• A Codex seat whose queue-state folder or team-workspace path contains a space can still be misread on an ordinary resume or restore, because those arguments come before the conversation id. An in-place restart is fixed. (#2037)
• Automatic Codex hook approval needs OpenRig's plugin folder to match what shipped. If $OPENRIG_HOME/plugins/openrig-core holds files that didn't ship, the Codex plugin still installs or upgrades, but OpenRig approves nothing itself: an existing approval stays as it was, and Codex's own hook review applies. On a restart without a version change, if a hook file or the plugin manifest there differs from what this version shipped, OpenRig doesn't install or upgrade its Codex plugin. On a version upgrade, OpenRig's managed refresh replaces an edited plugin file with the shipped one and keeps your edited copy under $OPENRIG_HOME/backups/managed-refresh/; after upgrading, inspect those backups and reapply any deliberate customization.
• Terminal views: a view opened before 0.7.2 needs closing and reopening to keep its tiles through a session replacement, and a replacement that takes too long can still need a reopen. This wasn't run in the Herdr, cmux or Rex apps or over SSH, so #1939 stays open. Rex wasn't run on Linux, and a Rex tile that fails 2 to 10 seconds after opening is still listed as opened. (#1964, #1935)
• Herdr's own status for a seat can read idle or unknown while OpenRig shows it waiting (needs-input), because OpenRig doesn't feed Herdr a state. Use OpenRig's view or the Feed to find waiting seats. Reopening a view with --provider herdr adds a workspace each time; from inside Herdr, rig terminal open <view> --window reuses a matching one. (#2032)

Credits

Thank you to everyone whose work is in this release: @Vaishnavi220506, @Aschenbath, @dajiaohuang, @DeryFerd, @vanducng, @Nikhila-Dhevi-R, @Nikhi00718 and @Kero-66, and to @borfast, @BillyOutlast, @tianqizhao0704, @calv-io-n, @george661, @fsafey, @astral-fleet-sessions and the Heretek-AI team, whose reports, ideas and outside audit led to fixes here.

Thanks also to @alexveli1 and @george661, who reported #1764 (addressed by #1778 and #1944); @kainne44 and @bobbiejaxn, who reported #81 (partly addressed by #1919); @oneandonlydean, who reported #1813 (partly addressed by #1951); @todie, who reported #1419 (its closure attribution addressed by #1811); @reisalbuquerque, who reported #49 (partly addressed by #1503); @jimallen, who reported #17 (partly addressed by #2028); @parkingmeter, who reported #1933 (addressed by #1963); @vanducng, who reported #1939 (addressed by #1964 and #1941, open for confirmation); and @haichongfu and @vadym-abstract-factory, who reported #14 (worked on again in #1921; still open).

Thanks also to @reco for the runtime-switch request in #589; @pr0xc3nt4ur1 for the edge-preservation and update case in #1193; and @m3ac-AllbrittenJ and @lev-gpt for the stall-reporting and age evidence in #331.

Verification and remaining limits

This release's selected checks found no demonstrated regression against published 0.7.1 or data loss. This is not an all-paths pass. The sealed package, installed checks and a real 0.7.1 upgrade passed at their recorded scope; both first-user journeys completed.

• Slack replies can land outside the originating thread when an agent follows the existing reply hint without --reply-to. This round trip failed in testing. The hint predates 0.7.2; the later fix #2055 is not in this release.
• Abrupt power-loss recovery on 0.7.2 was not tested: the fixture hit its disk-growth cap before its power cut. The 0.7.1 comparison passed data and native-conversation recovery, but its separate terminal-team restore was partial. That baseline is not proof of 0.7.2 recovery.
• Native account, home and runtime coverage is partial. Selected separate-home restart/restore and useful conversation-continuity cases passed. Runtime switching worked in both directions in a minimal setup; one direction required an extra Enter. The full home matrix, a second Claude subscription token, same-token handover and stored-home-change cases, native switch edge cases and full-kernel coverage, some Slack button cases, and the right-side agents' useful answers after resume remain untested. Controlled restart cases do not substitute for the full native matrix.
• The named-risk managed compaction and restore exercise completed with useful continuation after about 46 minutes of work, but the adopted Claude home had no OpenRig hooks. Marker, packet and trace paths that depend on those hooks were not exercised by that run.
• Comparable release-level speed, resource-use and provider usage/charge proof remain unavailable. No across-the-board performance improvement is claimed.

The long-paste issue #14 remains open; the Codex model-picker limitation #2010 and ordinary Codex resume/restore with a space in a workspace or queue-state path remain. The fixed in-place restart path is not proof for ordinary restore. Existing Linux session-bus, Claude member-rule, Pi recognition and other documented limits still apply.

Hermes, Cursor's plug-in work and the Codex member-permission counterpart are not included. Follow-up coverage review is scheduled for 2026-10-26 at 12:00 UTC; that is a review date, not a promise that every gap will be closed.

[0.7.1] - 2026-10-25

Published 2026-10-25 as @openrig/[email protected], built from the commit tagged v0.7.1 (1e392d56). This entry is its release notes, as published on the GitHub Release.

OpenRig 0.7.1 gives you more say over how much your team does on its own. You choose, per seat, how much automatic input reaches an agent's terminal and how far other agents may act on it, and you can see the permissions each seat will launch with. Questions to you land on the TUI's Feed, and Slack can carry every ask or only urgent ones. Team skills stay out of your project, assistants such as Claude Desktop can do much more through MCP, and a managed compaction survives a daemon restart.

Before you upgrade

• Restart the daemon after installing. Eight database updates apply on its first start.

  npm install -g @openrig/[email protected]
  rig daemon stop && rig daemon start
  

• Startup replaces OpenRig's own plugin and skill files (openrig-core goes from 0.1.17 to 0.1.18). As in 0.7.0, it first copies each file it replaces under $OPENRIG_HOME/backups/managed-refresh/ and logs where, edited or not. If you did edit one, reapply your change from the copy.
• Claude seats need Claude Code 2.1.280 or newer to see their team skills (claude --version).
• If an earlier version reset your worktree's Claude permission mode, set it back once by hand. Launching a managed Claude seat used to rewrite defaultMode in .claude/settings.local.json to acceptEdits; 0.7.1 stops, but doesn't repair files already changed. (#1776)
• If you might go back to 0.7.0, undo Slack subscription choices first. 0.7.0 can't read a person file that holds one, so its people registry stops loading. Save each choice (rig gateway human show <id> --json > <id>.json), then run rig gateway human set <id> slack-subscription unset: someone on urgent-only gets every ask in Slack again, as 0.7.0 does. Set it again after you return to 0.7.1. The unset removes only the Slack subscription, so a person file that still holds a subscriptions: entry fails on 0.7.0 too. Don't restore an older gateway folder or database instead: that can lose newer people, bindings and delivery records.
• If you go back to 0.7.0 and then upgrade again, old process evidence can keep a seat reading running instead of being relaunched. (#1906)

What's new and fixed

How much your team does on its own

• rig seat set-typing-guard <seat> --mode off|openrig-urgent|urgent-only|hold sets how much automatic input reaches a seat. rig send --urgent or an urgent queue row marks a message urgent, naming who marked it. Held input stays readable and is never replayed. (#1770, #1781)
• rig seat set-terminal-policy <seat> --preset no-peer-interventions|help-within-instructions|full-control sets how far OpenRig and other agents may act on a seat, with exceptions for compaction and model changes. Existing seats keep full control. (#1846)
• rig seat status shows the permissions a seat's next fresh launch will use and where each comes from; rig setup asks before adding OpenRig's line to your shared guidance files. (#1843)

Asks to you. An ask lands on the TUI's Feed. Every ask still posts to Slack by default; rig gateway human set <id> slack-subscription urgent-only keeps Slack for asks marked --alert, which stand out with a mention. (#1868, #1878)

Seats keep their setup out of your project

• Team skills live in each seat's own storage, not your project's .claude/skills or .agents/skills; rig skill loadout --seat <seat> shows them. (#1008, @puniserv)
• A Claude member can bring its own agent file, system prompt file, plugin folders and Advisor model. (#1737, #1736, @Aschenbath)
• A seat's role no longer overwrites the others' in a shared CLAUDE.md or AGENTS.md, and rig down restores your guidance files byte for byte. (#1840, #1854, #1859, #1867)

Assistants and other agents

• OpenRig's MCP server grows from 23 to 34 tools, including identity, restore status, a rig's team and lead, following a handoff, reading a result and deciding inside a person's decision room. rig mcp serve --http serves an assistant on another machine, each caller acting as its own seat. (#1831, #1835, #1842, #1853, #1860, #1596, @pdurlej)
• rig acp run <row> hands a row's task to an ACP agent such as Hermes or OpenClaw; a new guide covers A2A agents. (#1823, #1829)
• Community harnesses can report, name and reopen conversations, with examples for Cursor, Hermes and OpenClaw. (#1768, #1769, #1771, #1783, #1784, #1826, #1870)

Running a team

• A daemon restart, such as an upgrade, picks up a managed compaction where it stopped. (#1866)

• rig edge add and rig edge remove change one edge on a running rig. (#1733, #1746)

• rig up <spec> --name <rig> runs one spec as several rigs. (#1692, @klueless-io)

• rig watchdog update retunes a job in place; the context watch takes token or percent thresholds. (#1803, @AdamWhitehurst) (#1735, @akushonkamen)

• policies.claude_compaction.preparation_root puts restore maps where seats may write. (#1585, @Aschenbath)

• Herdr: tiles come back after a Herdr restart (one over SSH needs reopening), --session picks a Herdr session, and the TUI's terminal button works over SSH. (#1796, #1076, @Aschenbath) (#1748)

• New seats get the daemon's OPENRIG_DB and TMUX_TMPDIR. (#1812)

• rig setup --providers is remembered (provider.selected), so the kernel starts seats only for the harnesses you chose. (#1817)

• Optional daemon.db_conflict: stop keeps a second daemon off a database another live daemon holds; the default still only warns. (#1890)

• rig stream subscribe <seat> and rig stream read give a seat bounded pages of the observations meant for it, and rig stream show <id> says what became of one. (#1891, #1888)

• Stream retention is on: items emitted after the upgrade are deleted after 30 days, or beyond the newest 20,000, unless a record names them (retention.stream_days, retention.stream_max_items). History from before the upgrade is kept. (#1891, #1897)

• Off by default: once decisions are enabled, rig project wake --decide lets your intake seat route stream observations with one bounded typed decision each, and hands anything uncertain back to that seat. (#1879, #1882, #1894)

• Off by default since 0.6.12: with bundle.services_enabled on (rig config set bundle.services_enabled true), a bundle carries its Compose file, rig bundle inspect shows each service before anything runs, and rig bundle install <bundle> --target <folder> starts its services, then its seats, in that folder. In 0.7.1, --plan --target previews the services an install would run, the before-install view also names a Claude member's own agent, prompt and plugin folders, and the example secrets-manager team publishes Vault's port on the host's loopback only. Proven on Linux; not run on macOS. (#1474, #1848, #1745, #1845)

Reliability

• rig daemon start waits for a slow daemon instead of stopping it, and warns rather than fails when only a secondary listener, such as Tailscale's, can't be verified. (#1716, @dajiaohuang) (#1743, #1793)
• A Claude seat whose startup turn is refused reports its remaining startup context as owed; with an expired login, later startup inputs can still be submitted first (see Known issues). (#1869)
• On Ubuntu 22.04's tmux 3.2a, a closing session no longer sends the query that crashes tmux. (#1755)
• A rebuilt Codex seat keeps its narrower sandbox, and read-only Codex profiles launch. (#1779, #1791, #1825, @bradvin)
• Reminders and workflow keepalives survive a seat swap. (#1777, #1782)
• OpenRig's hooks run without Node on the seat's PATH. (#1727, #1728, #1729)
• After a daemon restart that can't see the seats' tmux server, running agents are no longer detached and relaunched beside themselves. (#1906)
• Provider credentials and the activity-hook token stay off tmux, shell and env command lines; @pr0xc3nt4ur1 first raised it in #1360. (#1907)
• An answer retried from Slack or Steering after an interrupted close is used once, and a replayed Slack reply stays absorbed. (#1896, #1898)
• One stuck row on a removed rig no longer stops the stuck sweep from flagging the rest, and stopped watchdog jobs release their old schedules. (#1903, #1900)
• Health diagnoses still list when an unrelated diagnosis row holds a malformed field. (#1920)
• Upgrading OpenRig no longer stops a working Codex seat at "Hooks need review". OpenRig can renew approval of its own Codex plugin during an upgrade when the prior approval exactly matches the previous shipped bundle, nothing is disabled, and the installed bytes match the shipped bundle. Explicit disables and unrelated hooks are preserved. (#1948)
• A seat waiting at a prompt that only its pane shows, such as a Codex approval prompt, is shown as needing attention, with its reason, in the seat view, rig ps, the compact JSON and the rig count. (#1946)
• From contributors: launch probe evidence (#1499, @Aschenbath); request IDs for creates and checked stops (#1790, #1792, @bradvin); faster cost history, ordered stream replay, kept web-UI drafts and guarded sends at Claude's MCP prompts (#1756, #1757, #1758, #1864, #1865, @Nikhi00718); a non-blocking preflight (#1759, @icey-zzz); clearer compact-plan output (#1629, @taljeri); exports keep culture files (#1657, @Totopo27); no flash in terminal views (#1663, @Vaishnavi220506); pod startup files for added seats (#1701, @AdamWhitehurst); Pi idle heartbeats (#1702, @okle100); the rig ps activity column (#1614, @shravansumanthanan); full workflow trails (#1732, @psbanka).

Behaviour that changed

• rig ps --nodes separates every column with a space and adds an ATTN column before REASON; update scripts that read columns by position. (#1780, #1876)
• rig queue show --json drops lastNudgeInputBox, and send results no longer describe the input box. (#1738)
• rig down asks before stopping the rig you're in; without a terminal it stops nothing and prints the --yes command. (#1838)
• rig up --plan no longer starts a stopped daemon; it exits with daemon_not_running. (#1836)
• An urgent or critical row's wake starts with Urgent (marked by …):. (#1770)
• rig provider moves is back with a new job: filing and reading subscription move reports. It switches nothing. (#1847, #1849)
• rig queue show and rig queue whoami print human notices on stderr. (#1808)
• A seat joined with rig attach as an outside app stays attached through rig down and restore. (#1827, #1834)
• rig send --dangerously-interact --reason into a seat's input box stops and shows text already typed or pasted there, apart from suggestions, instead of pasting over it; clear it and retry, or pass --type-without-checking. Keys for a recognized native menu are sent as before. (#1892)
• rig send to a terminal seat types exactly your text, without the From/To lines, and queue wakes type nothing into it. (#1100)
• A stream body over 16 KiB is stored truncated and marked, and rig stream list --after from a pruned item returns stream_cursor_expired instead of an empty list. (#1891)
• A send held for a draft in the seat's input box reports inputPhase: "not_reached", and a managed compaction prompt held that way counts as not sent. (#1884, #1889)

Known issues

• A new Claude agent's startup text can stay unsent in its input box. Press Enter in its terminal.
• Claude seats on a macOS native install can read as needing attention after a restore (#86). Check the seat's terminal before acting on it.
• A Slack channel-mapping change needs a daemon restart. Don't use rig slack disable then enable for it, which marks waiting alerts as seen.
• Ubuntu 22.04's tmux 3.2a: the known crashing query is gone, but a narrower race remains. Prefer another tmux.
• rig daemon start can take 20 to 40 seconds before its listener warning, longer than the TUI's 30-second "restore everything" wait. On a slow host, run rig daemon start yourself first.
• A Claude seat signed in with a long-lived token (claude setup-token) gets no usage reading. The reader accepts only claude.ai subscription logins and reports not_subscription_login for any other.
• Managed Claude launch requires /usr/bin/env support for -0 and -u (option support checked on GNU coreutils and macOS 15; BusyBox and older macOS unverified). Without the required option support, launch stops instead of falling back to credential-bearing command-line arguments.
• In draft-aware mode, an agent's multi-line message to a Claude seat can remain unsubmitted when the paste changes Claude's footer hint. OpenRig withholds Enter, leaving the text in the composer and later sends waiting. Observed on Claude 2.1.309 with both 0.7.0 and the 0.7.1 pre-cut build; #14 remains open.
• Prompt-looking text in a seat's recent output can be mistaken for an active approval prompt, so OpenRig can refuse sends and queue wakes even while the seat is working. Inspect the current native prompt and the refusal before retrying; do not assume that waiting 15 seconds clears it.
• rig acp run --help points to reference/acp-agents.md, which is not included in this release's reference context pack. Read daemon/docs/reference/acp-agents.md inside the installed @openrig/cli package instead.
• The shared-database check needs lsof. #1763's warning that another live daemon is using the same database, and the optional daemon.db_conflict: stop, find that daemon with lsof. On a host without a working lsof (each lsof call times out after 1 s), the check is skipped without a message, so neither the warning nor the stop happens. The warning for a database outside OPENRIG_HOME doesn't depend on lsof.
• Managed Claude restoration can require native approvals. On a seat without bypass permissions, restoration can ask to read OpenRig files outside its working directory. In a representative openrig-core test on Claude Code 2.1.309 (acceptEdits), the restore and audit completed after three one-time Read approvals (the restore marker, post-compaction instructions and refocusing skill) plus four approvals for read-only commands. Check the retained restore map and reported gaps before treating restoration as complete.
• A managed Claude restore can remain owed without showing why delivery is delayed. If a seat remains idle after compaction, inspect rig compact <seat> --state and its saved restore map. Before sending a manual restore request, reconcile the native conversation and pending state to avoid a duplicate; do not repeat /compact merely because the restore request has not arrived.
• On Linux, workspaces containing very large checkout or build trees can cause severe daemon stalls and file-watch-limit failures. The recursive proof-source watcher covers the workspace root. Keeping large checkout/build trees outside that root may reduce exposure; this mitigation has not yet been verified. (#1813)
• A Claude startup with an expired login can still submit later startup inputs before noticing the refusal. The packaged whats-new (reference/whats-new.md) overstates the hold behavior. Resolve the login and follow the seat's reported continuation guidance; this test did not verify recovery. (#1869)
• On Claude Code 2.1.309, a seat configured with the model alias haiku and the plan permission answered on Sonnet in one observed run. Configuring the full id claude-haiku-5-5 gave a Haiku answer in the plan-mode follow-up.
• A Cursor seat's startup is assisted. It reports attention_required and needs one operator acknowledgement: rig seat clear-attention <seat> --reason "<why>". This wasn't rechecked natively on 0.7.1. (#1870)
• A resumed Codex seat can be misreported as not interactive when its header has scrolled off and its footer uses a multi-word model label such as GPT-6.1 Sol medium; rig up --existing can then stop. Reported on 0.7.0; the same recognition checks remain in 0.7.1. (#1764)
• Cross-host queue creation can report failure after the row was created. A rig queue create --host request can time out or return failure even though the destination host created the row. Check that host for the original row ID before retrying. If the row exists, do not create a replacement. If a retry is needed, reuse the same --id and payload; an unsuccessful read is not proof that the row is absent.
• Automatic Codex hook approval needs OpenRig's plugin folder to match what shipped. If $OPENRIG_HOME/plugins/openrig-core holds files that didn't ship, the Codex plugin still installs or upgrades, but OpenRig approves nothing itself: an existing approval stays as it was, and Codex's own hook review applies. On a restart without a version change, if a hook file or the plugin manifest there differs from what this version shipped, OpenRig doesn't install or upgrade its Codex plugin. On a version upgrade, OpenRig's managed refresh replaces an edited plugin file with the shipped one and keeps your edited copy under $OPENRIG_HOME/backups/managed-refresh/; after upgrading, inspect those backups and reapply any deliberate customization.
• With CODEX_HOME set in a seat's environment, rig seat restart --keep-conversation can report that the resume was not proven and that nothing restarted, although the process actually restarted and resumed. Inspect the seat's pane and native /status before retrying; a failed proof read is not proof that no restart occurred.
• rig provider switch does not switch a seat's account in 0.7.1. Its precheck can refuse an unknown target, and its execution path is not yet wired. The separate home-level Codex auth-switch/restart path is not this command.

Credits

Thank you to everyone whose work is in this release: @Aschenbath, @bradvin, @Nikhi00718, @AdamWhitehurst, @puniserv, @pdurlej, @klueless-io, @shravansumanthanan, @taljeri, @Totopo27, @Vaishnavi220506, @okle100, @dajiaohuang, @icey-zzz, @akushonkamen, @psbanka and @adampog, and to @lev-gpt, @XVVH, @Kero-66, @pr0xc3nt4ur1, @VltrnOne, @BillyOutlast, @gogabrielordonez, @geoff-dhango, @alexveli1, @aanestesia, @team-sudarshana, @oneandonlydean, @t1m3fr33d0m, @smota and @z4cc, whose reports and ideas led to fixes here.

Thanks also to @george661, who reported #1710 (partly addressed by #1721); @m3ac-AllbrittenJ, who reported #331 (partly addressed by #1801); @shintaii and @gopinathrimc, who reported #27 (partly addressed by #1735); @kainne44 and @bobbiejaxn, who reported #81 (partly addressed by #1876 and #1946); and @haichongfu and @vadym-abstract-factory, who reported #14 (partly addressed by #1871).

[0.7.0] - 2026-10-23

Published 2026-10-23 as @openrig/[email protected], built from the commit tagged v0.7.0 (c99450f3). This entry is its release notes.

0.7.0 makes a running team easier to live with. A person can set quiet hours and modes ("asleep", "out of office") so routine questions wait until they're back. Agents can pass a rig's name almost everywhere instead of looking up its id. A machine that reboots brings its kernel back by itself, a rig with one broken seat still restores the rest, and a busy daemon gets your request instead of a refusal. Under the hood, the core got smaller and simpler, and a long list of contributor fixes landed. The changes since 0.6.14:

Before you upgrade

• Restart the daemon after installing (npm install -g @openrig/[email protected], then rig daemon stop && rig daemon start). Six database updates apply on its first start.
• If you pass accounts or API keys to new agents through tmux's global environment (tmux set-environment -g …), new agents no longer inherit it. Put the values in the seat's env, pass rig up --env KEY=VALUE, or keep the old behaviour with rig config set terminal.inherit_tmux_environment true. rig setup warns when it sees a custom tmux configuration. Running agents aren't affected.
• Startup replaces OpenRig's own plugin and skill files with 0.7.0's copies. It first copies each file it replaces under $OPENRIG_HOME/backups/managed-refresh/ and logs where, whether or not you edited it: about 22 copies on the first start after upgrading from 0.6.14, so a copy doesn't mean you changed anything. If you did edit one, your change may stop working until you reapply it from the copy; the log line names the original file.
• If you write queue rows to another machine by its own id (member@rig@<self-id>), run rig host doctor <alias> once per host so the binding learns its address.
• If a script uses rig provider moves, change it: the command and its setting are gone (see "Behaviour that changed").

What's new and fixed

Quiet hours and modes for the person:

• rig gateway human quiet set <id> --daily HH:MM-HH:MM (or --until) holds routine asks while the person is away and posts each one once when they're back. Escalations still go through (#1584, #1606, #1649, #1720).
• rig gateway human mode saves and applies a person's modes, ends them on a schedule with --until, and reports what each one changed. Inside a mode's agreed "decision room", the agent that asked can record a delegated decision; permission prompts are never decided this way (#1656, #1715, #1705).

Rig names everywhere:

• archive, unarchive, release, shrink, expand, snapshot, export, restore --rig and the matching MCP tools take a rig's name. A name two rigs share says so (#1681 and siblings, @Nikhi00718).

Restore and launch:

• After a reboot, the daemon restores a kernel whose seats are all detached (#1081, @haralez).
• A seat missing a startup file no longer blocks the whole rig's restore; the other seats come back (#1696).
• Seats added to a running rig get its culture and startup files (rigs created on 0.7.0) (#1632).
• rig up --env reaches every launch shape (#1511).
• Before a new Claude agent's first startup message, OpenRig looks briefly (up to about five seconds) for Claude's input box, and keeps its checks on the submission. It doesn't guarantee delivery; see Known issues (#1730).
• Codex seats that select openrig-core get its refocus and skills: OpenRig installs the plugin into Codex and, on a first install, trusts its own six hooks after checking their files, so a fresh Codex seat starts without Codex's hook review. The file check happens only when trust is granted: a later edit to the cached hook scripts keeps that trust, as with any hook trusted in Codex. The trust covers that Codex home, so your own Codex sessions there load the plugin too; its hooks do nothing outside an OpenRig seat. A plugin or hook you already disabled, or left untrusted, keeps your choice (#1824).
• A new agent's first startup message says it's OpenRig's identity context, not a task, and a seat with nothing else to start with is asked to confirm its identity and wait for an assignment (#1754).

Seeing what's happening:

• The TUI's agent table shows each seat's configured effort (#1529, @tianxingjian2406).
• rig queue show --json says why a wake didn't land (#1555, @1solomonwakhungu).
• A long-open TUI says when its build differs from the daemon's, and refreshes less often (#1600).
• rig ps --rig and --host --rig report an unknown rig and filter correctly (#1690, #1698, #1706, @Nikhi00718).

Reliability:

• A busy daemon gets the real request; the CLI refuses only when it's confirmed down, and a timed-out write says its outcome is unknown (#1650).
• rig compact --cancel stops a managed compaction that already sent /compact, with no daemon restart (#1660).
• Watchdog deliveries are recorded as they happened, and repeated refusals at a prompt raise an alert (#1713).
• Slack: a thread reply answers only a question posted before it, and a rejected message isn't re-posted (#1568, #1703, @Aschenbath).
• Team agents are asked for permission less often: 15 housekeeping commands no longer prompt (#1665).

Behaviour that changed

• New agents start from a clean environment, not tmux's global one (above) (#1573).
• rig provider moves and provider.subscription_moves are removed; report a subscription move as a queue item instead. rig slack verify lost --reason and --actor (#1672, #1674).
• A done close can't use --closure-reason blocked_on; use rig queue block <id> --on <child> (#1704, @Aschenbath).
• rig setup keeps 10,000 rows of tmux history, down from 50,000 (#1264, @Quentin-M).
• rig up --plan waits as long as an apply. rig seat restart, and policy permissions apply, now ask for permission.
• Output shapes: rig gateway human list prints availability (available|focus|away|off); rig attach prints Sender:; a reused deliveryId no longer deduplicates a send.

Known issues

• A new Claude agent's startup text can stay in its input box unsent. If a fresh Claude seat sits idle with text at its prompt, open its terminal and press Enter.
• The TUI's terminal button refuses inside a Herdr pane reached over SSH (also in 0.6.14). Start the TUI with env -u SSH_CONNECTION -u SSH_CLIENT -u SSH_TTY rig tui, or run rig terminal open '<view>' --provider herdr. A fix is on its way.
• Claude seats on a macOS native install can read as needing attention after a restore (#86). A fix is in progress and isn't in this release.
• A Slack channel-mapping change needs a daemon restart (rig daemon stop && rig daemon start). Don't use rig slack disable then enable for it: enabling marks any alerts waiting to post to Slack as already seen, so open exchanges miss them.
• Ubuntu 22.04's stock tmux 3.2a can crash its whole server when OpenRig checks a pane that has just closed, interrupting the other sessions on that server. Avoid tmux 3.2a for OpenRig; check your version with tmux -V. A replacement version has not been verified against this crash.

Credits

Thank you to everyone whose work is in this release: @Nikhi00718, @Aschenbath, @PROACTIVA-US, @jayhemnani9910, @rudycelekli, @markankamaransheogarat-sys, @haralez, @tianxingjian2406, @1solomonwakhungu, @AdamWhitehurst, @Quentin-M, @arxh80, @DeryFerd, @okle100, @zichen0116 and @13pgpg.

Tested on our own machines, and with first-time setups on Claude and on Codex, before release. A first-time setup on a Mac wasn't completed.

[0.6.14]

0.6.14 is the last planned release of the 0.6 line: a small set of stability fixes on top of 0.6.13. A seat launched by an older OpenRig that refuses every send for a missing tmux pane can now be repaired without losing its session, a manual compaction keeps waiting while its preparation sits at an approval, rig ask --wake refuses runtimes it can't wake, refocus finds notes without starting the CLI once per ancestor, the docs open with a getting-started page for people, an optional Mac check, off by default, can stop one account's rig commands from reaching another account's daemon, and the inventory read behind rig ps and TUI refreshes avoids a full event-log scan. It is built from the commit tagged v0.6.14. The changes since 0.6.13:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). No migration runs. One setting is added, transport.local_user_guard, off by default, and /healthz gains an euid field (#1566). From 0.6.12 or earlier, 0.6.13's migration 117 runs first (and from 0.6.11 or earlier, 0.6.12's twelve before it).
• Expect the bundled openrig-core plugin to go from 0.1.14 to 0.1.15, carrying refocus's own notes lookup (#1563).
• Expect rig ask --wake to refuse a Pi, custom or unrecorded runtime before any wake starts. The CLI and the daemon both need 0.6.14 to catch every case (#1561).
• Expect a manual rig compact to wait longer: its preparation has 180 seconds (was 120), and the request times out after 240 seconds (was 180) (#1562).

Highlights

• Repair a seat that refuses every send because an older OpenRig never recorded its tmux pane: rig reconcile-session <seat> --repair-missing-pane --no-launch fills only the missing pane and keeps the seat's session, resume token and history. It never adopts and records no event. It refuses, writing nothing, when the binding already has a pane, the session has more than one pane or window, the pane changes between its two looks, a seat operation is running, or typing protection is on; an older daemon refuses the request rather than adopting (#1564).
• Keep a manual rig compact waiting when the seat's preparation stops at an ordinary approval. OpenRig never answers the approval; someone has to, inside the deadline (#1562).
• Refuse rig ask --wake for a runtime it can't wake, instead of silently trying a Claude wake (#1561).
• Resolve each ancestor's notes file inside refocus's trace instead of starting rig scope resolve-notes once per ancestor, which could use up the trace's time on a loaded machine (#1563).
• Read fresh-launch fences through the existing node and type index in the fleet inventory read behind rig ps and each rig tui refresh. The query added in 0.6.13 scanned the whole event log, which on a long-lived install was slow whenever the database's pages weren't cached; it returns the same rows (#1617).

Off by default

• Add an optional Mac check, transport.local_user_guard (or OPENRIG_TRANSPORT_LOCAL_USER_GUARD), that makes the CLI refuse a local daemon another account runs when the daemon's /healthz report and two ps readings agree. Missing or disagreeing evidence, and an older daemon, keep today's behaviour; it isn't authentication. /healthz gains euid beside pid whether or not the check is on (#1566).

Guidance and docs

• Add a getting-started page for people, docs/reference/quickstart.md, with a glossary; make getting-started.md the setup reference for the agent doing the setup; lead the README's install section with the rigs skill; and show what OpenRig changes on your machine before you install (#1565).
• Drop three finished items from the roadmap (#1560).
• Name the missing-pane repair where people meet the problem. The send refusal "Managed pane identity unavailable or changed; no input written." now names rig reconcile-session <seat> --repair-missing-pane --no-launch. The compaction refusal for a protected seat with no recorded pane says both fixes refuse while typing protection is on, how to turn it off and back on with the person's agreement, and that plain reconcile adopts into a new session row. The as-built CLI reference and the openrig-user skill list --repair-missing-pane, rig config --help lists transport.local_user_guard, and rig ask --help's exit codes cover the --wake refusals. Text and help only (#1594).

Dependency and install-script changes

• The README's skill and install-script commands, getting-started and the quickstart's example tag pin v0.6.14. No dependency changes.

Known limitations

• The compaction and refocus fixes are tested without a native compaction or a loaded machine. Confirm a compaction by its restore request or the drop in context, and check that refocus showed the current work (#1562, #1563).
• The pane repair refuses while typing protection is on; the send and compaction refusals say so, and protection goes off only if the person agrees. It covers a running launched seat whose pane was never recorded, and refuses others. A delivery held from before the repair can still refuse (#1564, #1594).
• rig context get reference/quickstart.md doesn't resolve: the page ships under the package's docs/reference/ but isn't in the reference context pack (#1565).
• On a Mac with more than one user account, a second user's rig commands can reach the first user's daemon on its default port unless transport.local_user_guard is on. The check trusts the daemon's own report, identity can change between the check and the connection, and direct HTTP clients aren't covered (#1566).
• 0.6.13's other limitations still apply.

[0.6.13]

0.6.13 is the quick follow-up to 0.6.12: fixes found by running teams on it every day, plus documentation. A Claude seat handed over in place waits for the new Claude before its packet is typed, Slack recovers missed messages in mapped channels, recent threads and relayed channels, Pi seats honour their reasoning effort, an OMP seat can be retried after a provider hiccup, and an existing seat can move to a new working folder. It is built from the commit tagged v0.6.13. The changes since 0.6.12:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). Migration 117 runs on every upgrade: it adds an empty, Codex-only provider_account_readings table, which fills only with provider.usage_windows on (off by default) and then keeps each resolved Codex account's readings across a restart (#1535). There is no migration 116. From 0.6.11 or earlier, 0.6.12's twelve migrations run first.
• Expect the bundled openrig-core plugin to go from 0.1.13 to 0.1.14: generated Claude hook commands call the daemon's Node by its absolute path, and existing bare-node entries refresh automatically (#1545).
• Expect a rig name containing a dot to be refused before anything launches, including when you add a member to an existing one or retry its first start, because tmux would rename the session (#1500).
• Expect a Pi seat's effort to reach Pi as --thinking from its next managed launch, restore or handover (#1528); managed Claude seats to receive EDITOR, VISUAL, DISPLAY, XAUTHORITY and an absolute WAYLAND_DISPLAY from their next launch (#1546); and the shipped agent specs' role file to count as the seat's role after a fresh launch (#1522).
• Expect rig restore-check to report caveats where it was green for hooks, still exiting 0 (#1537), and Slack recovery to scan threads inside its seven-day window once from their root on the first start (#1536).
• Expect new output, with nothing removed: a model line per seat after rig ps --nodes's table (#1493), an input-box note on rig capture's stderr (#1490), the caller_cancelled send refusal (#1513), and JSON fields modelObservation, inputBox, signIn, the Codex restart report's gate fields and /api/attention update items (#1508, #1502, #1054).

Highlights

• Check a fresh in-place Claude handover's ready result against the current screen, so the packet waits for the successor instead of reaching a shell (#1553, part of #1544).
• Recover Slack messages in the channel map's channels, replies in tracked threads whose root was posted or which closed in the last seven days, and channels a hub relays to a machine without its own connection; recovered replies land late and never answer a decision, and a rate limit holds its method across a restart (#1536, #739).
• Send a Pi seat's effort as --thinking, with rig seat set-effort and rig seat effort for Pi (#1528); let an OMP seat take an ordinary retry after a typed transient provider failure (#1550).
• Add rig seat set-cwd <seat> --cwd <absolute-path> --reason <text> to save an existing seat's working folder for its next fresh launch or rebuild handover (#1498, finishing #1154).
• Show the model each seat was last seen using in rig ps --nodes, rig roster show and rig roster find (#1493).
• Type nothing later for a send whose caller went away before input started (#1513); read Claude Code's MCP approval menu (#1549), Codex's current folder-trust panel (#1494) and a Codex pane's old menu above an empty composer (#1548) correctly.
• Read Linux processes from /proc on a worker thread instead of forking ps (#1385).

Seats, launch and restore

• Prove a Claude launched through a wrapper script by its executable path (#1540); clear a failed restore's warning after a ready fresh launch (#1527); read a complete idle screen as idle through terminal repaints (#1521).
• Name the Codex startup screen that stopped rig seat restart --keep-conversation (#1502); print the Pi/OMP READY line once per ready transition (#1401); and report a guidance block's real file in the node-detail API (#1523).

Sends, wakes and queue

• Send one message for a seat's parked rows that fall due in the same pass (#1507); route a stuck-item finding on a person's item to the agent that closed it (#1495, finishing #1177); and trim spaces in rig queue list --state (#1501).

Status, TUI and web UI

• Show a sign-in fact on each provider account row (#1508); show open updates for a person in the TUI's Feed (#1054); open a seat's terminal in the Herdr the shared TUI is viewed from, on Linux (#1356); and show an aborted workflow as aborted in the web UI (#1276).
• Keep a Codex account's last reading, its reset and its last observed exhaustion across a daemon restart, shown as history rather than a current reading, and show an expectation, never a reading, when a window's reset has passed (#1535).

Workflows, commands and messages

• Clear a redriven workflow's old completion time (#1517); accept a rig name in rig grow and rig remove (#1407); give working cmux remedies in rig doctor (#1514) and real remedies for an edited projected file (#1512); and print the daemon's message from rig provider (#1510).

Off by default

• Keep the refocus work packet off for both runtimes, and bound its fields when OPENRIG_REFOCUS_WORK_PACKET=1 turns it on (#1542).

Guidance and docs

• Correct the README's machine effects (#1510); say one working account is enough and list what starting OpenRig writes (#1539); give a standard Mac user a user-local Node.js route and say what the registry's checks decide (#1557); explain an adopted seat's restart refusal (#1509) and comparing token use across machines (#1505); and list the community-built Rig HQ viewer (#1515).

Dependency and install-script changes

• End the one-line installer with INSTALLED, SETUP NOT COMPLETE when rig setup isn't ready, keeping setup's exit status (#1547).

Tests and repository checks

• Tie managed /compact and parked refocus to their hook effects in tests (#1538); remove a test fixture's calendar expiry (#1559); and carry 0.6.12's versions and release text onto development main (#1558).

Known limitations

• A fresh in-place Claude handover can still report ready early when the screen, pane or process can't be read or proven (#1553).
• Slack recovery doesn't catch up older open threads, doesn't prune its thread coverage file yet, and one Slack app across machines hasn't run on two real machines (#1536, #1436).
• Managed compaction's 600-character budget rests on one comparison, nothing confirms compaction ran, two hook runs for one seat aren't serialized, and the plugin's manifest hooks still call bare node (#1483, #1344, #1475, #1545).
• rig seat set-cwd checks the new folder once, and background work can use it before you switch (#1498).
• rig policy current and plain rig ps don't show a policy stored with --seat (#1285); rig up --env isn't forwarded for flat-node specs or v1 bundles (#1294); the draft-aware guard can delay other work for a seat (#1481).
• On a Mac with more than one user account, a second user's rig commands can reach the first user's daemon on its default port; this release doesn't change that.
• Managed compaction, refocus after a compaction and snapshot restore behave as in 0.6.12, and 0.6.12's other carried limitations still apply (#1483).

[0.6.12]

0.6.12 is a fix release about recovery and everyday operation, most of it from the community. Restore brings back what you left running and leaves down what you stopped, a slow Claude start ends as needing attention instead of failed, managed compaction sends a /compact short enough to run again, Claude seats load the hooks OpenRig ships for them, and you can set one seat's reasoning effort, give a team environment variables in its spec, change a seat's permission policy in place, launch a rig by name and read what each seat reports it costs. It is built from the commit tagged v0.6.12. The changes since 0.6.11:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). Twelve migrations run on the first start, whatever you use: 100 typing guard modes (#1481), 104 nodes.effort_choice (#1209), 105 Claude cost columns on usage_samples (#1233), 107 and 108 Pi usage tables (#1237, #1244), 109 the mode store's index per category (#1274), 110 workflow_instances.scope_json (#1273), 111 rigs.env_json and nodes.env_json (#1294), 112 two indexes for recent queue activity, about 10 to 12 MB on a long-running install (#1326), 113 applied_launch_observations.daemon_opt_out (#1371), 114 sessions.agent_app (#1392) and 115 the Slack thread map keyed by channel and thread timestamp (#1436). There are no migrations 102 or 106.
• Expect Claude seats whose plugins include openrig-core to run its hooks (activity relay, compaction save and restore, refocus) from their next launch, restore or handover: they start with CLAUDE_CODE_PLUGIN_DIRS set, which needs Claude Code 2.1.280 or later. openrig-core goes from 0.1.9 to 0.1.13 (#1344). The refocus hook may take up to 60 seconds instead of 5 (#1475).
• Expect rig start --last to leave down a rig you stopped on purpose with rig down or rig seat stop, and to print how to bring it back; --json carries keptDown (#1238). After rig down, rig ps reads the rig stopped (#1254) and the restore hint is rig up '<name>' --existing (#1425).
• Expect an ordinary terminal seat to relaunch fresh on restore and re-run its startup actions; a missing required startup file for such a seat blocks the whole restore before anything launches (#1328). Expect restore to stop a seat whose current runtime differs from its snapshot's, before launch (#1190).
• Expect a restored Claude seat that's slow to draw its screen to be watched for up to runtime.readiness_timeout_seconds and then end attention_required with its pane and token kept, not failed, so a restore can take longer (#1359). "Returned to a shell" now means the process tree shows an idle shell (#1357, #1395, #1373, #1364), and a Pi or OMP seat at a bare shell reads attention_required (#1391).
• Expect a send to a pane in tmux copy or view mode to leave the mode and deliver, or be refused with pane_in_mode (HTTP 409) with no text typed (#912). Expect rig send --dangerously-interact to type exactly the bytes and keys given, adding Enter only for a complete answer staged in a recognised Claude Code or Codex input box (#1366).
• Expect managed /compact to be at most 600 characters and sent only to an idle seat, with a separate compact result (submitted, unconfirmed, uncertain, not sent) in rig compact and --state. rig compact exits 1 (was 2) for pane_unknown_protected, and rig send exits 1 with HTTP 409 (was 2 with 500) when a write throws without a code (#1483).
• Expect exit 1 and HTTP 400, not exit 2 and 500, for eleven client-fixable rig queue update refusals (#1319); exit 1 from rig ask for an unknown or ambiguous rig (#1202); and up to 120 seconds of waiting in rig add, single-seat rig launch and rig launch --seats (#1287, #1271).
• Expect a runtime --version check to give up after 30 seconds: daemon start no longer hangs on it, rig bootstrap blocks on a runtime that fails or times out its check (#1211), and rig up's preflight fails a Claude, Codex or OMP check that doesn't answer (a warning for Pi) (#1301).
• Expect login_required only for Claude's current login refusal, not for the "Not logged in" footer alone (#1417); the fable alias to name claude-fable-5-1, with [1m] set aside when comparing (#1482); and pinned Pi seats to be checked, accepting a :high-style thinking suffix (#1349, #1403).
• Expect a custom permission policy saved with CRLF line endings to take effect at the next launch or restore instead of falling back to the floor (#1402).
• Expect rig bundle create to refuse harness login files, and an existing archive holding one without a record to fail verify, unpack and install (#1488).
• Expect rig scope mission create to write status: planned (#1289), and --workspace <project> to create and read missions under the project's declared missions.root (#1430).
• Expect the daemon to run tmux without /bin/sh on Linux and macOS (OPENRIG_TMUX_SHELL=1 keeps the old path) (#1241), and to write Codex's config.toml only when a Codex seat exists or launches (#1297).
• Expect a person's new message in a rig's own mapped Slack channel to reach that rig's representative, and seat posts to name the machine (#1436); the Slack manifest adds the users:read scope (#1433).
• Expect rig remove and rig shrink to keep a seat that receives work while stopping (409, with the work listed) unless --fallback takes it (#1459), and a stale rig unclaim to be refused with session_not_current (#1379).
• Read Typing guard: on (hold) in rig seat status for hold; its JSON's desired and effective now mean hold only (#1481).
• Read lower rig usage top figures where a seat changed conversation or a window reset (#1348, #1473), and execution-view rows bound to a mission by their exact mission: tag (#1304) or a slice by its SPEC id: (#1331).

Highlights

• Launch a rig by name: rig launch <rig> takes a name or an ID, and a name two active rigs share stops with rig_ambiguous (#1312).
• Set one seat's reasoning effort with rig seat set-effort <seat> --effort <level> --reason "<why>" (or --clear), used at its next launch, restore, handover or in-place restart, and read it four ways with rig seat effort (#1209).
• Change an existing seat's permission policy with rig policy apply <policy> --seat <seat> --reason "<why>" (#1285).
• Give a team environment variables with env: on the rig and members in rig.yaml, or for one launch with rig up <spec> --env KEY=VALUE; the values aren't secret (#1294).
• Keep a Codex fork's startup context when its new conversation ID arrives late, with rig seat continue to deliver it once (#1438), and complete a handover to a Codex fork with the ID pending (#1216).
• Correct a row's subject with rig queue update <id> --summary alone (#1270), store an outcome with --resolution on a close (#1292), and read how a row ended in rig queue show <id> --full's closingTransition (#1290).
• Hand work to the team from an agent with no shell through five queue tools on rig mcp serve (#1441).
• Read what each seat reports it costs with rig usage cost, and the same on the TUI's System → Cost page; a missing figure is never $0 (#1233, #1261).
• Start the CLI faster: it loads only the command being run (#1380). The daemon runs tmux without a shell, batches transcript captures, skips unchanged terminals and reads the queue with far fewer queries (#1241, #1242, #1262, #1263, #1326, #1369, #1384, #1389).

Seats, launch and restore

• Recover a seat whose startup failed for a recoverable reason on its next successful send or capture (#1236); keep a periodic snapshot taken during rig down from replacing the pre-down one (#1147); ignore a context reading taken before a seat changed when compacting (#1365); and launch Claude sessions with idleCompaction: false while managed compaction is on (#1282).
• Say which check a failed process-lineage check found (#1398); retry a staged Claude startup prompt twice and recognise more footers (#1295); pass TERM_PROGRAM to managed Claude seats so Shift+Enter inserts a newline (#1399); and keep --no-daemon in the printed Codex resume command (#1371).
• Log why a Codex resume token wasn't captured (#1284); write rig seat set-resume-token to the latest session after a clock change (#1204); and name the live older session in rig seat clean's advice (#1206).
• Leave a non-object .claude/settings.local.json or .mcp.json untouched with a warning (#1311); stop rewriting a Claude seat's settings when its status line is in place (#1286); replace a read-only collector copy by rename (#1251); and remove the launch script with /bin/rm or the shell's rm (#1310).
• Warn in daemon.log when an isolated OPENRIG_HOME still carries the real HOME or CODEX_HOME (#1299); find Codex sign-in files in the real home when HOME is unset (#1418); and treat an empty OPENRIG_HOME as unset in the TUI socket, terminal token and rig crash-cart (#1470).
• Catch up an OMP seat's history past 1 MiB over its RPC protocol v2 (#1279); show the first usable error field for a failed Pi or OMP turn (#1208); resolve rig bootstrap and rig requirements spec paths from your folder (#1213); add detail to a failed rig create --json (#1378); and add rig status --json (#1291).
• OpenRig 0.6.12 adds rig community-harness list for installed community-harness presets, showing their maintainer and declared limits. These harnesses are not tested by OpenRig. Support is launch-only: no resume or fork, no resource projection or startup-file delivery, and identity remains unconfirmed. A quiet screen is not proof that the seat is idle (#1392, #1518).

Sends, wakes and queue

• Recognise Codex's » prompt in input boxes (#635) and in rig send --verify (#1220), and read a Codex seat as needing a person only when a real prompt shows (#943).
• Keep a held-back wake from using up a one-shot park timer (#1222); stop a watchdog retired mid-check from delivering (#1325) while recording its last attempt (#1439); keep a blocker's next wake when it changes mid-send (#1435); and mark a row served by its owner's own reminder servedByOwnReminder (#1424).
• Point an unverifiable handed_off_to close at rig queue handoff and flag a self-targeted close (#1358); stamp a cross-host handoff's close with the sender's identity (#1333); absorb an inbox entry in one transaction (#1451); and say to register a person when none is (#1219).
• Say --summary is a row's subject in help, warnings and skills (#1354), add it to the reply hint (#1355), and show a body's first line in the TUI's RECENT when a row has no summary (#1393).

Status, transcripts and TUI

• Say activity is unknown when rig capture --lines cut lines (#1226); note when a rig ps context filter needs --nodes (#1437); stop a stopped seat's transcript capture and keep its transcript readable (#1281); report a quiet pane as capture_unchanged (#1262); and keep the first line in rig transcript --tail (#1227).
• Label the TUI's proof count accepted or paired (#1288); keep TUI helpers working after the start folder is deleted (#1485); send the window width with terminal previews (#1205); find headings with combining marks (#1471); stop the Help list at its end (#1469); ignore sideways swipes (#1458); and keep emoji whole in TUI rows (#1453) and web UI log previews (#1454).
• Read an IPv6 HTTP host as reachable in GET /api/hosts (#1457), and take ?replay=0|<n>|all on GET /api/events (#1387).

Workflows, scope and proof

• Stamp --project, --mission, --slice and --tags on a workflow's packets (#1273); resolve a member@{rig} target against the bound rig (#1293); and pick up a workflow spec restored with an older modification time (#1363).
• Show a slice parked on an external: gate as a waiting lane (#1303); show a merged: report on the merged rung (#1302); and resolve a dependency by a sibling's SPEC id: (#1372).
• Read CRLF files like Unix ones in SPEC intents (#1316), checkbox blocks (#1315), PROGRESS.md (#1314) and artifact-pool reads (#1322); read folded evidence (#1461) and 1) mini-requirements (#1460) in the Scopes view; and refuse a scope-audit mission outside the slices root (#1221).
• Keep a saved mode and a posture side by side, with rig mode unset --category (#1274); read an unusable preview answer as unknown (#1283); and mark the mode fields nothing acts on (#1307).

Usage, Slack and notifications

• Say when a rig usage series (#1305) or rig bundle history (#1306) bound isn't a date.
• Relay Slack channels across machines with forwardChannels (#1436); deliver named bots to one seat with botInbox (#1433); show a person the gate's question, not the agent packet (#1143), even with long tags (#1240); thread follow-ups to button answers and resolved reactions (#1228); and say how to paste the manifest (#1207).
• Deliver non-ASCII ntfy titles (#1317), and keep emoji whole in shortened notification bodies, slice stories and rig ask excerpts (#1472).

Bundles, specs, packs and requests

• Keep a member's mechanic through bundling (#1464); report a blank spec list item as a validation error (#1318); read a bare agent profile key as empty (#1320); accept .. inside a file name in context packs (#1234) and agent images (#1465); read an empty Compose ps as no services (#1452); and report bytes from macOS's rsync in rig file copy (#1232).
• Answer a null JSON body with 400 (#1342) and an oversized limit with 400 (#1456); match chat search literally (#1455); fix rig restore's hint (#1466); warn about a misread watchdog cadence (#1463); and forward --full in rig whoami --host (#1231).

Off by default

• output.compact now also shortens rig queue show and rig queue transitions (rig queue transitions --full is new) (#1224) and bounds rig whoami --json peers to the new output.whoami_peers (default 8; --all-peers lists all) (#1225, #1248).
• provider.usage_windows now also shows Claude's windows, with --provider codex|claude (#1197), each seat's configured account (#1235) and every registered machine's windows with --all-hosts or --hosts (#1246); the TUI's System → Usage and Usage · all hosts pages read them (#1243, #1259). A Claude account's current availability always reads unknown (#1504).
• Add usage.pi_cost_facts and usage.pi_openrouter_charge: Pi's cost estimate and OpenRouter's charge beside it in rig usage cost, read at a Pi seat's launch or resume (#1237, #1244).
• Add provider.subscription_moves: rig provider moves, moves show and moves record (#1450).
• Add bundle.services_enabled: bundles carry their Compose file and install into a lasting target (#1474).
• Add transport.verify_input_box: --verify to Claude Code or Codex reads verified only when the input box held the text and then emptied (#1267).
• Add the per-seat draft-aware typing guard, rig seat set-typing-guard <seat> --mode draft-aware (#1481), and rig bundle create --include-login-files (#1488).
• Add OPENRIG_TMUX_CONTROL=1 for one tmux control client (#1383) and OPENRIG_REFOCUS_BUDGET_MS for a slow refocus (#1475).

Guidance and docs

• Offer to join the team before the first operator message (#1492, #1496); offer Codex users one removable rules file (#1467); re-check network checks and install through rig setup (#1434); brief a peer by its model (#1486); add an opt-in wake loop for attached apps (#1444); explain rig ask --wake targets (#1426); and point the operator at keeping-a-watch, which now teaches a low-allowance warning (#1217, #1266, #1268).
• Document a newline when Shift+Enter submits (#1404), Codex compaction sizing (#1340), keeping your own Claude status line (#1308), HOME for Pi (#1335) and pinned per-agent rigs skill installs (#1431). In the repository: the README's web UI line (#1491) and contributor pointer (#1370), the roadmap (#1423), the skill workflow (#1432) and the coordination notes (#1277).
• User-visible text says "harness" for the agent software around a model, and "community harness" for one an outside contributor maintains; docs/reference/topology-naming.md defines the terms (#1506).

Dependency and install-script changes

• The daemon declares string-width ^8.3.0, already in the installed tree (#1481), and exports ./composer-prompts (#635) and ./workflow-scope (#1273). The same postinstall and node >=22.

Tests and repository checks

• Run Linux checks on pushes to main (#1487); regenerate shipped skills from one home (#1396); add a daemon-restart scenario (#1440); look up the snapshot restore source only on a changed seat (#1375); use stub runtimes (#1298); clean up test folders (#1300, #1352, #1362, #1330); wait on conditions in timing tests (#1245, #1255, #1427, #1443, #1447); run the native transcript suite concurrently (#1377); test cross-host usage (#1265); and fix two repository scripts (#1229, #1230).

Known limitations

• Managed compaction's 600-character budget rests on one comparison on Claude Code 2.1.282, and nothing confirms compaction ran (#1483). The plugin hooks haven't run through this path in a real session, and two hook runs for one seat aren't serialized (#1344, #1475).
• One Slack app across machines was simulated in one process, not run on two machines (#1436).
• rig policy current and plain rig ps don't show a policy stored with --seat (#1285).
• The draft-aware guard can delay other work for a seat while it waits for idle (#1481).
• rig up --env is not forwarded for flat-node specs or v1 bundles, although the launch may succeed. Do not rely on the flag for those formats in this release (#1294).
• rig seat restart --keep-conversation supports Linux only. The rig status API can still fold a restore forecast into a running rig's status, and a constructed Codex usage-limit screen can linger, as in 0.6.11.

Thanks to everyone whose pull requests are in this release; they are listed in the release notes, with how it was tested.

---

[0.6.11]

0.6.11 is a fix release about recovery and wasted agent time, most of it from the community. A send that waits for a seat to go idle no longer holds up every other send to that seat, a parked seat isn't woken again for rows that haven't changed, restore stops for a decision instead of starting a seat fresh when an earlier conversation may still be resumable, a Codex seat at its usage limit stays marked as limited while its screen redraws, and on Linux a Codex seat can be restarted in place on the same conversation. It is built from the commit tagged v0.6.11. The changes since 0.6.10:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). One migration runs on the first start: 103 adds one column to sessions, intentionally_stopped, which is 0 for every existing row (#1192). There are no migrations 100 or 102. openrig-core stays at 0.1.9; two of its files changed (#1174, #1066).
• Expect a restore to stop a seat at awaiting-decision and start nothing when the seat wasn't running at the snapshot but an earlier session recorded a resume token, because the token doesn't prove that conversation can still resume. rig up --existing and rig launch no longer start it fresh, and rig launch of such a seat exits 1; the message names the command that starts it fresh on purpose (#1141).
• Expect a restore of a rig whose seats are in pods to roll a seat back to awaiting-decision as unresumable only when Claude, Codex or Pi reports its conversation missing, starting nothing and leaving no new pane behind. A rig where every seat ends this way reads partially_restored instead of failed, with exit 1 either way. A Claude that exits to its shell for another reason is reported failed with its pane kept, as in 0.6.10. Restores of rigs without pods keep their earlier handling (#1191, #1218).
• Read outcome: "claimed" from rig queue create --verify for a claimed row whose wake wasn't confirmed, instead of indeterminate (#1168).
• Expect rig send --wait-for-idle N to wait before it takes the seat's delivery lease, so other sends and queue wakes to that seat aren't held behind it. N is now a deadline from the start of the wait, including any time spent waiting for the lease, and a timeout names the wait you asked for (#1103, #1183).
• Expect rig seat launch --fresh --stop to refuse a seat with a still-live older session before it stops the current agent. --plan previews a fresh launch without changing anything and exits 0 even when it would be blocked; --reason is required only to execute (#1156).
• Expect a seat stopped with rig seat stop to be left out of its rig's state, so the rig no longer reads degraded for it. rig ps --nodes --json carries intentionallyStopped, and a rig whose seats were all stopped this way reads stopped (#1192).
• Read rig queue whoami --work-candidates as up to 50 held and 50 next rows, with heldTruncated and nextTruncated; heldAndNextTruncated now means either list was cut. With OPENRIG_REFOCUS_WORK_PACKET on (off by default, as in 0.6.10), the refocus work packet lists held and next work separately, up to 50 each (#1066).

Highlights

• Restart one Codex seat in place on Linux with rig seat restart <seat> --keep-conversation --reason "<why>": the same pane and conversation, on whatever account its Codex home now holds. It doesn't switch accounts itself. It refuses with nothing stopped unless the seat is a Codex seat OpenRig launched, in a single pane, with a conversation it can prove and unchanged running settings. --plan runs every check and stops nothing, and --verify --expect-account <account> reports moved only when a tool turn has completed in the same conversation since the restart and Codex's status names that account. On macOS, a request that gets as far as reading the running process refuses before stopping the seat (#1196, #1195, #1212).
• Stop waking a parked seat whose occupant is known again for the same rows after a wake was delivered, until it updates one of them or one changes state. A failed, refused or unrecorded wake still repeats at the next park, and a new occupant gets its first wake. Delivered means typed into the seat's terminal, not read (#1142).
• Keep a Codex seat at its usage limit unknown with reason usage_limit while its screen redraws, instead of running, with usage_limit under REASON in rig ps --nodes. It clears when a readable screen shows no banner, or when Codex shows it's working again (#1185).
• Report the Slack receipt beside the terminal wake from rig queue create --verify for a registered person who is also a seat with a pane, in a gateway object (posted, transport-failed, never-posted or still-pending); posted isn't read. It waits for that receipt up to the existing 30-second default, even when Slack isn't set up or the row won't be posted, and then reports the Slack side as pending. GET /api/queue/:qitemId returns ownerNotificationLevel (#1085).
• Launch a forked Claude seat (rig fork, or session_source: fork) with its own session ID, so strict restore and clear-attention can verify it as its own conversation. Forking a Claude seat needs Claude Code 2.0.73 or later, which OpenRig doesn't check; forks launched before this read mismatch until they're relaunched (#1144).

Seats and restore

• Stop passing the launching Claude Code or Herdr session's identity variables, such as CLAUDECODE, to seats; if removing them fails, the launch goes ahead with a warning (#1151, finishing #771).
• Warn on stderr when rig up chose / as the launch folder itself (#1150, from #226).
• Expand a member cwd that is ~, starts with ~/ or uses $VAR or ${VAR}, from the daemon's environment, when the path as written doesn't exist (#1153).
• Keep a late readiness result from overwriting a newer launch attempt (#1188).
• Show a Codex seat's runtimeContext.threadId in rig whoami --full --json when its stored conversation ID was verified resumable (#911).

Sends and queue

• Confirm enveloped multi-line messages that the agent's screen indents in rig send --verify and in queue wakes (#1145).
• Read a Claude footer in auto, bypass or plan mode on the last line as idle when no activity hook is reporting (#1179).
• Show the provider's own reason for a failed Pi or OMP turn when it gives one (#1181).
• Give a handed-off closure with no visible successor the same custody advisory and stuck-sweep finding as a done closure (#1189).

Status and TUI

• Take a rig's running count and status in rig ps from the same set of sessions as rig ps --nodes (#1186).
• Say in the TUI when a queue sample hit its cap or failed to load: counts read N+, a seat missing from the sample shows ?, and Pulse no longer lists a NEEDS YOU item a second time. The caps count the whole host (#1175).
• Fill the TUI Topology table's Q, WORK and NOW columns again on drilled views and on a seat's page (#1173).

Slack and ports

• Recover a reply sent with "Also send to channel" in the default channel after a connection gap (#1187).
• Refuse a daemon.port outside 0–65535 in rig config set, and fall back to the file or default with a warning when the environment or config.json holds one (#1140); refuse one in rig daemon start --port, with exit 1 (#1201).

Scope, proof and refused requests

• Give parallel rig scope slice create calls different slice numbers. A number is never reused, and each create leaves a hidden slices/.nn-NN claim file (#1007).
• Take --project <id> or a <project>: scope prefix in rig proof show and rig proof judge; scope readiness for a project selected in the TUI uses that project's own root (#1149, finishing #136).
• Return 400 before storing anything from the chat send and topic routes for payloads that used to fail with 500 (#1122); answer a fractional or non-numeric generation in /api/wake-resolve with the usual "does not exist" reply (#1129); refuse a watchdog scan_interval_seconds that can't be turned into a number, such as non-numeric text, a boolean or an empty array (#1131); and match unmanaged agent process names exactly, plus claude.exe and names cut to 15 or 16 characters (#1133).

Off by default

• Add output.compact (or OPENRIG_OUTPUT_COMPACT): the seven queue write commands print a short receipt instead of the whole row, and --full prints the whole row. While it's off, their output is unchanged (#1137).
• Add provider.usage_windows (or OPENRIG_PROVIDER_USAGE_WINDOWS in the daemon's environment): rig provider status --refresh reads a Codex login's usage windows once. While it's off, --refresh says how to turn it on and exits 1 (#1194).

Guidance and docs

• Split the rigs and openrig-skills skill descriptions by who is asking: a person in their own session, or an agent inside a rig (#1174).
• Add a reference page on keeping a watch for a person with today's queue commands (#1064); see Known limitations.

Dependency and install-script changes

• No npm dependency or lockfile change beyond OpenRig's own version, the same postinstall, and the same node >=22.

Tests and repository checks

• Fix daemon and CLI tests that failed on some Linux machines: ext4 inode reuse, dash as /bin/sh and a 002 checkout umask (#1148, finishing #83); clean up after the pane-isolation tests (#1169); keep the TUI default socket-path test from failing on macOS (#1182); and run the portability report when it's started through a symlinked path (#1109).

Known limitations

• rig seat restart --keep-conversation supports Linux only. Its automated tests are hermetic: they don't restart a real Codex seat.
• The rig status API (GET /api/rigs/:id/status) can call a running rig blocked because of one seat that isn't running: it folds a restore forecast (that seat would stop for a decision) into current status. No seat is halted, and rig status and the TUI's rig list don't show it for a running rig (#1141).
• A Codex seat can keep reading as at its usage limit when an old banner is followed by a submitted prompt and the agent's reply, with no Codex working line and no input line below; it's recorded again every five minutes. The case was constructed from the source and hasn't been seen in a real session (#1185).
• The keeping-a-watch page says a timer fires once. When the typing guard holds a one-shot --wake-after wake back (it shows as retained), that held-back attempt is recorded as the timer's one fire and later wakes aren't, so the timer isn't retired: it can wake the owner again at each interval while the row stays set aside. A row sharing the timer through --wake-watchdog, after the original row was handed off or stopped, loses its one wake if that wake is held back.

Thanks to everyone whose pull requests are in this release; they are listed in the release notes, with how it was tested.

[0.6.10]

0.6.10 is a fix release, most of it from the community. Setup can be told which agent harnesses a person uses, a resumed Claude seat whose session ID changed proves and restores, sends reach Codex seats behind a launcher and Claude seats showing a suggested prompt, restore puts back the guidance rig down removed, and attach commands name the tmux server the daemon actually uses. It is built from the commit tagged v0.6.10. The changes since 0.6.9:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). Two migrations run on the first start. 099 adds one partial index to the queue table (idx_queue_items_recovery_tags) (#1073). 101 adds four empty columns to sessions for a resumed Claude conversation's new ID (#1080). Neither changes existing data, and there is no migration 100. openrig-core goes from 0.1.8 to 0.1.9 (#1080).
• Read rig capture --lines N as the last N lines, with stderr saying how many earlier lines were cut. In --json, lines is then the count returned, with new requestedLines and omittedLines. --history-plus-pane keeps the old N history lines plus the whole pane, and the old JSON without those two fields; without --lines nothing changes (#1136).
• Expect compact rig queue list, overdue and undelivered rows to carry summary, and to leave out body, evidenceRef, humanDetail, waiting, chainOfRecord, replyTo, humanQuestions and humanAnswers entirely, instead of null or "". fieldsElided names them (#1096).
• Expect rig launch <rigId> <seat> (or --seats) on a seat whose agent exited to a shell in its kept pane to return attention_required and exit 1, naming the ways back, instead of reporting it already running (#1070).
• Expect rig up <rig> --existing to report the rig partially_restored and exit 1 when a seat is still missing part of its OpenRig guidance; the node lists guidanceGaps (#1068).
• Read lastNudgeResult as claimed on a claimed row whose wake wasn't confirmed; the recorded value is in the new lastNudgeWireResult (#1094).
• Expect rig chatroom history without --after or --since to return the newest messages, still listed oldest first; --after and --since still page forward (#1057).

Highlights

• Choose the harnesses at setup with rig setup --providers claude, codex, both or a comma list. One not chosen isn't installed or checked and reads skipped, never failed. The first hour also stops echoing tmux's "error connecting to …" at daemon start, and the next steps say the remaining steps are part of the install (#1065).
• Prove a resumed Claude seat whose conversation continued under a new session ID, when its first SessionStart hook from the launched process reports source: "resume". It restores as resumed and sends without the "launch identity differs" warning. Resume commands now carry OPENRIG_RESUME_LAUNCH, and the plugin must be 0.1.9 (#1080).
• Deliver rig send and queue wakes to a Codex seat whose codex is a launcher that starts Codex as a child; the deepest codex on one process chain counts as the seat (#1088).
• Treat Claude's faint suggested prompt in an empty input box as empty, not as a person's draft, so a send to that idle seat isn't refused as prompt_draft. Typed text is still refused (#1139).
• Put back the OpenRig guidance blocks rig down removed from CLAUDE.md, CLAUDE.local.md or AGENTS.md before a resumed seat starts, without touching the person's own text (#1068).
• Name the daemon's tmux server in every printed attach command (-L <name> or -S <path>) when it runs on a non-default socket; the default server's commands are unchanged (#1083).
• Report a seat's wake result and any claim from rig queue create --verify as soon as one is recorded, as outcome, wakeResult and claim, instead of still-pending after 30 seconds (#1029).
• Start the daemon for the first time after a timed-out health probe when the port is free, as on WSL2; refuse only when the port is really held, naming --port (#1061).

Seats and restore

• Show a seat whose tmux session is confirmed gone as detached, with activity reason session_missing, and say in rig ps --nodes and rig seat status to restore or relaunch it; the stored status isn't rewritten (#1074).
• Read a Codex usage-limit banner as activity unknown with reason usage_limit instead of idle; rig provider signals can show a provider-event signal for that seat's account that allows a switch decision (#973).
• Accept a rig name in rig add, as rig down does; a name shared by two active rigs is refused with rig_ambiguous and the candidates (#1027).
• Say why rig start skipped an existing kernel and how to bring it back (rig up kernel --existing) (#1060).
• Refuse a restore's proof from a launcher that isn't Claude when the Claude it starts names a different conversation; such a seat reads attention_required instead of a false resume (#1091).
• Keep a Codex seat's last context reading when the newest usage record holds only quota numbers (#1124).
• Keep git metadata paths that end in a space or tab in a fresh Codex launch's --add-dir (#1134).

Sends and queue

• Stop the queue's recovery and stuck-sweep lookups scanning every row (#1073).
• Match rig view show <lens> --rig <name> as a literal session suffix, so _ and % in a rig name are no longer wildcards, in all seven lenses that filter by rig (#1126, #1165).
• Match rig ask chat keywords such as config.json or C++ literally (#1127).
• Read CRLF queue files in rig heartbeat (#1120), and pick its latest proof with a timestamp that names no zone read as UTC (#1121).

Slack

• Reply once in the thread when a decision click isn't recorded, saying why and, where it helps, to answer in words. A recorded click still gets its usual reply. Best effort; it needs the Slack bot token (#1067).

Terminal and attach

• Open a terminal view in cmux when a caller of the daemon's terminal API names no provider and Herdr isn't available, and say so. rig terminal open without --provider, and the TUI's "Open terminals", still open Herdr, or plain tmux when Herdr is missing, never cmux; the TUI's preview now asks for the same provider as the window it opens (#1071, #1167).
• Recognise a tmux started inside a Herdr pane by Herdr's own markers, so rig terminal open --window opens in the current Herdr (#1130).

CLI output

• Return 400, not 500, for a ?limit= that isn't a number (#586).
• Print the daemon's error as JSON from rig usage top --json and rig usage series --json (#1075), and have rig usage top read every sample in its window (#1116).
• Show the instance and packet the daemon returns in rig workflow instantiate and rig workflow project (#1102).
• Keep a line ending in %, and drop a repeated prompt, in rig transcript --tail (#1104).
• Ignore --json after -- when printing an error (#1106), and print the daemon's error from rig env instead of a JavaScript one (#1115).
• End a truncated file read at a whole UTF-8 character, with truncatedAtBytes saying where (#1119).

TUI

• Count CR+LF as one Enter (#1111), keep an emoji whole at a wrap (#1112), page directory listings in Local reading by 10 with PageUp and PageDown (#1113), and skip fenced examples when opening a file at a heading (#1114).

Scope and progress

• Add a progress row only under a matching ## heading (#1107), and update frontmatter only inside its exact --- delimiters (#1110).
• Report a capability delta expired only when its successor is a readable file (#1123).
• Ignore headings and checkboxes inside fenced examples in a slice's detail panes (#1125) and in the progress tree (#1128).

Guidance

• Keep a team's own first steps and checks from stopping for approval: plain rig commands, the file tool instead of a heredoc, and the project's test command first (#1082).
• Have the operator say what launching a team into the person's folder changes for their own agent there, before they agree (#1086), and tell the person which seat is waiting on a prompt and what it asks (#1087).
• Look for a managed guidance block's closing marker only after its opening one in rig package install (#1135).

Off by default

• Add queue.wake_human_rung: explicit-only keeps the wake ladder's last escalation off the person's Slack unless the row is addressed to a person; the default, always, changes nothing (#1090).

Dependency and install-script changes

• No npm dependency or lockfile change beyond OpenRig's own version, the same postinstall, and the same node >=22.

Tests and repository checks

• Add a scenario for the rig up round trip (#1092); keep the docs guard exact on unusual file names (#1105) and the portability report on header-shaped added text (#1108); list same-second bootstrap runs newest first in GET /api/bootstrap (#1132).

[0.6.9]

0.6.9 is a quick fix release for what people meet in their first hour and in the Slack channel: a Slack connection that stops delivering is caught and replaced, a typed Slack answer is kept, Slack status shows what waits to be retried, a kernel that recovered reads ready, and a cross-host send or a long chatroom wait no longer reports failure when the work went through. It is built from the commit tagged v0.6.9. The changes since 0.6.8:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). Migration 098 adds an index on (qitem_id, transition_id) to the queue's transition history, and openrig-core stays at 0.1.8.
• Stamp the work tree named by rig scope <tier> approve --workspace <path>, and refuse a named workspace with no missions/ folder instead of stamping the configured one (#997).
• Give a cross-host rig send --host to an http-registered host a 30-second request budget, plus any --wait-for-idle time, and report a send that may have arrived as remote-outcome-unknown ("Delivery UNCONFIRMED", exit 1) with the check to run before any resend; only a host never reached reads as unreachable (#1048).

Highlights

• Keep a typed Slack reply to a decision with structured questions in humanAnswers, as a tagged typed reply placed under the first unanswered question; typed text that matches an option's ID is never read as a click, and closing still isn't approval (#1045).
• Show in rig slack status how many retained inbound retry records wait, covering messages, reactions and click answers, or that the count is unknown and why (#1036).
• Drop a retained Slack alert, replayed at gateway start, whose row has left the active states, and record why on the row; open rows' alerts, decision-resolved notices and digests still post (#1051).
• Detect a Slack Socket Mode connection that stays open while events stop, by server pings and by the echo of OpenRig's own posts, and replace it, opening the new connection first and at most once every 5 minutes. Name the delivery state beside "connected" in rig slack status and the connections view (#1052).
• Report a kernel ready once every declared seat recovered from a failed start, with the earlier failure on its own line in rig status and as last_boot_failure from /api/kernel/status; list each kernel seat once (#1044).
• Keep a long rig chatroom wait going through a slow or restarting daemon until its --timeout (#1047).

Dependency and install-script changes

• No npm dependency or lockfile change beyond OpenRig's own version, the same postinstall, and the same node >=22.

Seats

• Recognise a Nix-wrapped Claude Code as the seat runtime, so its seats read running (#1053).

Off by default

• Add the refocus work packet, off by default; no change unless enabled (#1043).

Docs

• Say that rig launch takes a rig ID, from rig ps --json, in the capability map and the what-changed note.

[0.6.8]

0.6.8 is mostly fixes, most of them from the community: one skill being edited in the managed catalog no longer stops every seat's skills, a launch plan can never start a seat, Slack replies stay in their thread, and a workflow that could never finish is caught at validate. It is built from the commit tagged v0.6.8. The changes since 0.6.7:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). There are no migrations, and openrig-core stays at 0.1.8.
• Move the TUI's footer toggle to F, and the selected Scopes view's mini-requirements and narrative keys to M and N, so find, feed, mission, narrative and needs type whole on an empty command line (#1020). Move the selection down and up with j and k on an empty line (#1019).
• Report step_cannot_finish from rig workflow validate, and refuse to instantiate, when no allowed exit can finish a step or route onward. An allowed mapped exit is valid; in a dependency graph, handoff can finish a sink without a next step. A spec that validated on 0.6.7 can be refused now (#1012).
• Report a selected skill skipped for uncommitted catalog content with exit 1 from rig context work-install --runtime <runtime> and rig skill loadout --runtime <runtime>. Inspection is the default; applying with --apply-skills or --apply, respectively, still reconciles the remaining clean skills (#1031).
• Refuse rig launch --plan against a daemon older than 0.5.9, which would ignore the plan and launch (#1024).

Highlights

• Skip a managed catalog skill with uncommitted or untracked content by itself, with a named warning, instead of making the whole catalog unavailable for rig context work-install, rig up, launch and restore preflight. A seat keeps the copy it already has until the catalog change is committed or restored and a later applied projection refreshes it, no runtime gets the uncommitted files, and launch only warns. Uncommitted catalog.yaml still makes the catalog unavailable (#1031).
• Preview a single seat's launch with rig launch <rig> <seat> --plan, locally or over --host (#1023). Read the daemon's version before any plan, and exit non-zero, naming rig ps --nodes -A, when an answer isn't a plan but shows the daemon acted (#1024).
• Post an agent's --human-intent update --reply-to <reply row> answer in the Slack thread where the person replied; the messaging-the-human skill says how (#1021). Wait out a Slack rate limit of 10 seconds or less and retry the post once (#1026). Keep the bot token on Slack's hosts inside the private-file download itself (#1006).
• Deliver the turn boundary, restore request and read-depth audit to a Claude seat that stays quiet after a managed /compact, instead of waiting for its next turn. Each stage still waits for an idle screen (#1035).

Dependency and install-script changes

• No npm dependency or lockfile change beyond OpenRig's own version, the same postinstall, and the same node >=22.
• Finish the CLI and TUI build output with scripts/prepare-workspace-build.mjs instead of chmod, mkdir and cp, so building from source no longer needs POSIX shell tools; not yet run on Windows. Originally contributed by @dajiaohuang in #956 (#1033).

Launch, seats, queue and scope

• Confirm a Claude seat's identity when it was launched with --remote-control (#1025). Save rig down's recovery snapshot even when finding one seat's resume details fails (#1030).
• Show a handed-off task's summary, on one line of up to 120 characters, in its wake (#1028).
• Accept slice folders numbered 100 and above in rig scope audit (#1016). Keep a leading UTF-8 byte-order mark in rig proof add --file (#270).

Docs

• Add a topology naming reference and point the rig spec, bundle and authoring guides to it (#1000). Bring the architecture and CLI reference docs to 0.6.7 (#1015).

[0.6.7]

0.6.7 is about the first hour: after install or start, the agent opens the OpenRig TUI and the kernel's operator for you, laid out for your terminal, and the operator asks fewer permission questions. It is built from the commit tagged v0.6.7. The changes since 0.6.6:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). The first start runs two migrations, the team install folder (#901) and the Slack thread-part map (#947); installs openrig-core 0.1.8, which running seats pick up at their next launch (#928, #965, #972, #975); and copies the rigs and refocusing skills into ~/.claude/skills and ~/.agents/skills, refreshed on every upgrade, leaving a skills.sh copy of rigs alone (#967, #928).
• Install herdr by default in rig setup on macOS and Linux with herdr's own installer (--no-herdr declines; a failed install falls back to plain tmux), offer Ghostty on a Mac (--ghostty, --no-ghostty), and stop installing or configuring cmux. rig setup --json drops cmux_install and adds herdr_install and ghostty_install (#936).
• Open a desktop window by default from rig terminal open <view>; pass --provider herdr|cmux to add tiles to an open workspace (#954). Lay out the default saved:kernel view by terminal width; a saved kernel view still wins (#978, #998). Use a personal herdr config unchanged (#969, #998).
• Check Claude Code and Codex installs, and a login or configured provider credential, in rig doctor, with four new rows, and exit 1 when either is missing or has neither, including an unused harness. A pass means a local credential is available (#924).
• Default agents.advisor_session to the kernel's advisor seat, and target the seat's own rig in rig restore-packet write (#937). Name bundles after rig.yaml's name in rig bundle create and rig up <link> (#985). Fire a periodic reminder one interval after registration (#860). Resolve rig package paths and --target . from the caller's folder (#754). Turn off Codex's startup update check for managed launches (#986).
• Rewrite a Claude seat's status-line command with quoted paths (#852) and move its activity relay to $OPENRIG_HOME/state/claude-activity-hooks/ (#870) at its next launch. Add a command hook to Claude team seats' launch settings (#927) and to the kernel's Claude seats, with a wider allowance (#983); no settings file is written.

Highlights

• Open the OpenRig TUI and operator as the step after install or start, with rig terminal open saved:kernel --window: the operator leads under 120 columns, the dashboard and operator share the first tab from 120, and the advisor has its own tab (#978, #998). Open in the caller's terminal: a herdr openrig kernel space, a new Terminal window copying your front window's size when available, a Ghostty tab, or from Claude Desktop, iTerm or VS Code on a Mac a new Ghostty or Terminal window at the app's default size; on Linux GNOME Terminal, Konsole or xterm at a readable size (#952, #970, #998). Reuse an open herdr view (#957) and never resize existing windows (#958). Without a display, say why and print the command to run (#954, #970). Use the same launcher for the TUI's Open terminals, with attach commands when no window can open (#959). Point help, setup and onboarding at the command (#950).
• Carry the install-to-operator route in the rigs skill: finish the install, hand over the goal, folder and branch, relay the operator's questions, and give a command when no window opens; drop the macOS-prompt warning (#909, #964, #971, #982, #988).
• Publish a one-command install with a stable link and a --dry-run preview (#917). Tell an installing agent to show a refusal from its own permission rules instead of reporting a failure (#950).
• Run lifecycle help (--help, -h) and common spellings of allowed commands without a prompt in Claude team seats; lifecycle actions still ask (#927). Allow the kernel operator's routine inspection commands and WebFetch (#983), read /rigs pages with WebFetch (#994), and run first-boot checks as separate commands (#932). Match setup's permission text to the team default (#916), and point prompt-weary users to the workshop team (#939).
• Refuse a rig send or wake to a Claude seat whose unrecognised screen follows a hook saying it is waiting for a person, and escalate the wake (#1001). Keep a seat waiting at an approval counted as needing attention after a daemon restart (#885).
• Add rig slack channel-map list|set|remove for a channel per rig or seat, checked by rig slack verify and shown in the TUI (#944). Deliver an emoji reaction on any message posted for an ask to the asking seat (#931, #947). Post a long ask as numbered thread replies, and tell the seat when it still can't be posted (#929). Route "Also send to #channel" replies (#910). Retry a Slack socket that fails or stalls while opening (#942).
• Ship a what-changed note for agents, rig context get reference/whats-new.md, read by the openrig-upgrade skill's last step (#934, #1010). Refresh the capability map for 0.6.6 (#905) and 0.6.7 (#1010).
• Let rig seat handover run again on the same seat (#987). Teach seats to write their recap with rig context recap-write before a handover (#1002), and include a Codex predecessor's messages in the recap (#848). Deliver refocus with the restore request, also when wrapped as pasted text, and post one stream issue after three failures in a row (#928, #972, #975). Move a finished restore map into place from the daemon (#965).
• Publish the built-in starter and factory leads' rosters at first start (#918). Show each first-team choice's graph in the shared TUI (#948). Name the file in each rig bundle check finding (#985). Retrieve shallowly by default in rig context add --git, falling back to a full clone with a warning when the server refuses, and name openrig-registry for submissions (#951).

Behaviour changes

• Back up and replace conflicting files on a bundle reinstall only in the team's recorded install folder (#901). Always run the bundle safety check, even with --skip-version-check --force (#876). Return HTTP 400 with a code for a conflicting-file install refusal, and 409 with codes for the others (#926).
• Clear a claimed task's blocker; rig queue update <id> --state blocked without --blocked-on reuses it (#761). Show a parked task's real wake time, never 1970 (#946). Print an error for an invalid --wake-after such as 7d (#945).
• Rerun the steps that depend on a sent-back step when it completes again (#817). Refuse rig workflow resume --occurrence with no matching failure (#757). Exit 3 from rig workflow run and watch for an aborted run (#847). Use the workflow file in the caller's folder (#845).
• Exit 2 from rig down --host when the remote teardown reports errors (#756), and print each agent's last known activity before human-mode rig down stops them (#922). Exit 1 from rig chatroom wait at its deadline (#968). Refuse a rig chatroom history --since value SQLite can't read (#930), and escape C1 control characters in its error (#991). Pass rig skill audit on a clean install, with new --json fields (#807). Report malformed pods, members and edges as validation errors (#846). Say OpenRig supports one configured human in rig gateway human messages (#961).
• Read attention_required for a running seat whose pane fails its identity check, keep the stored result in storedStartupStatus, and name the verdict in rig restore-check (#940).
• End a context section at an empty heading, and stop an inline triple-backtick span from hiding later headings (#962).
• Check a mission's folded rung against arrangement.source.integration_ref when mission.yaml declares it (#682).

Dependency and install-script changes

• npm dependencies: none added, removed or changed; only OpenRig's own versions moved to 0.6.7 (#1005). Node requirement unchanged (node >=22).
• Install scripts: unchanged (postinstall: node scripts/check-abi.mjs).
• rig setup runs herdr's installer (curl -fsSL https://herdr.dev/install.sh | sh) unless --no-herdr, runs brew install --cask ghostty only with --ghostty, and no longer installs cmux (#936).
• The repository's scripts/install.sh (not in the package) is published with a stable link (#917); its closing and plan text changed (#916, #950).
• Database: migrations 096_rig_install_root (#901) and 097_thread_part_map (#947).
• Bundled plugin: openrig-core 0.1.8 (#928, #965, #972, #975).
• Files written outside the project: the rigs and refocusing skills (#967, #928), a refocus health file under $OPENRIG_HOME/refocus/ (#928), the Claude activity relay under $OPENRIG_HOME/state/claude-activity-hooks/ (#870), and a private herdr config only when you have none (#998). Exclude generated .codex/plugins/shared:openrig-core/ files in .git/info/exclude (#919).

Kernel, setup and first run

• Explain a Codex seat that needs a newer Codex and offer to update it (#916). Give the order for stopping everything, kernel last, then rig daemon stop (#932). Drop retired team names from help and guides (#935).

Claude, Codex and Pi

• Read a Claude seat's session correctly with inline permission settings, fixing 0.6.6's known issue #921 (#933). Quote the Claude resume token (#798). Keep $$ and similar literal in rewritten managed blocks (#908).
• Report a late Codex sign-in or client notice at restore, and retry fresh on a late "no saved session" (#759). Find a Codex conversation when its home path has spaces (#851).
• Report the Pi version and a seat's credential readiness before launch (#938). Forward MINIMAX_API_KEY to minimax/<id> Pi seats when allowlisted (#891).

Launch, seats and terminal

• Restore a fresh-launched seat after a clean rig down (#955). Keep a plugin skill copy whose remembered source can no longer be projected, with a plugin_skill_kept warning, instead of failing the launch; a seat selecting that plugin refreshes it at its next launch (#819). Look up names containing % correctly (#844). Keep tmux session names with | or edge spaces (#752), and read launch settings from the exact session (#755). Wait up to 45 seconds for rig terminal open (#758). Close a failed terminal attach without stopping the daemon (#907).

Chat, usage, transcripts and retention

• Keep rig chatroom watch messages in order (#760). Scope rig usage top to each seat's own run (#835) and compare rig usage series cutoffs as moments (#840). Read a consistent transcript copy during replacement (#843). Keep the right watchdog history entries at tied timestamps (#753), and prune long snapshot histories in one query (#836).

Scope, projects and TUI

• Handle workspace paths starting with - (#974), keep mission membership on failed moves (#976), check slice edits by literal path (#1003), copy text literally into new missions and slices (#977), update frontmatter by its real YAML key (#979), and resolve a hinted slice past an unrelated folder (#1004).
• Prefer the deeper project over one declared at / (#857).
• Resolve a rig, host, pod or agent address from any TUI page (#984).

Docs

• Bring the reference guides (#903) and architecture docs (#902) to 0.6.6, and add the 0.6.6 changelog section (#906). Cover kernel seats failing at first start on a crashing tmux (#999). Name WSL2 as the Windows route, with one user's working setup and both Pi credential routes (#960, #963). Bring the README and reference guides to 0.6.7 (#1009).

[0.6.6]

0.6.6 is about getting to your agents fast: after install, the kernel's operator asks what you want to build, offers three teams and launches one, and teams can be shared and installed from a GitHub folder link. It is built from main at 2620dea8 (after #900). Work merged to main after that point isn't included. The changes since 0.6.5:

Before you upgrade

• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start). The first start adds the saved non-interruptive choice to rigs (#737) and installs openrig-core 0.1.4, which running seats pick up at their next launch (#685, #829).
• Rename the built-in teams: starter (a Claude Code builder and a Codex reviewer; first-project is an alias), factory, code-review (was adversarial-review), research (was research-team) and pm (was pm-team), with no alias for the last three. Remove conveyor, demo, implementation-pair, product-team, first-project-claude, first-project-mixed and factory-rsi from the shelf; keep secrets-manager and the kernel. Existing rigs created from removed specs keep restoring. Stop loading test-driven-development by default (#864, #866, #868).
• Give Claude Code and Codex seats outside the kernel, with no member or rig permission_policy, no saved seat choice and no named Codex profile, a team default at their next launch: Claude Code runs rig, project reads and common test commands without prompts and asks before lifecycle commands; Codex can also write the workspace folder and its pod's state folder. Set an explicit policy, such as permission_policy: none, to keep the old behaviour (#893).
• Give seats of the rig named kernel, with no explicit choice, policy or Codex profile, an operational default: Claude Code in acceptEdits with an allow list for file tools, reads under home and operational commands; Codex with -s danger-full-access -a never (#820, #858).
• Derive a new rig's default Docker Compose project from its rig ID, not its name; existing rigs keep theirs. Bring a newly started project down (never with volumes) when boot fails, refuse conflicting replaced generations with compose_project_conflict, and exit 2 from rig down when it keeps a project a live same-name rig still uses (#481).
• Leave a launch-created AGENTS.md or CLAUDE.md visible to Git, with a warning naming the exclude line, and exclude new files under .codex/plugins/openrig-core/ in a marked info/exclude block (#721, #727).
• Set a once-only Slack recovery checkpoint per channel on the first start, and deliver top-level messages missed during a gap as "Recovered after a gap" tasks (#742).
• Write managed compaction restore maps in the seat's launch folder under .openrig/compaction/, git-ignored, with the OpenRig home as a fallback (#685).

Highlights

• Have the kernel's operator greet first, ask the goal once, offer starter, workshop and factory with one recommendation and a drawing, adapt the team to the providers present, launch on a yes, show the team and hand the goal to the lead (#858, #862, #880, #884, #890). Read the workshop pin fresh from the registry's raw file (#900). Start the lead from that goal, with one light mission and slice for continuing work (#865). Keep the kernel when an agent installs OpenRig and pass the goal to the operator (#873); print the operator handoff after every setup result (#859, #886). Stop assuming macOS in the advisor's startup context (#770).
• Open a new terminal space with the kernel's TUI, advisor and operator after install (#821). Provide a default saved:kernel view showing all three for every kernel runtime mix (#830, #854). Give exact tmux or ssh -t attach commands when herdr or cmux isn't available (#831, #833, #878). Open the TUI's work views without a running rig (#818), and show rig specs as graphs with Launch (#867, #874).
• Accept public GitHub folder links in rig up and rig bundle create, inspect and install, pinned to one commit (#708). Declare and pick bundle configurations with rig bundle configurations, --preset and --seat (#704). Show what a bundle will do before install: posture, files, startup actions, writes, domains, preconditions and per-seat facts (#710, #717, #723, #738, #892). Route bundle contents before seats launch, add rig bundle install --cwd (#692, #705, #720, #722), check bundles with rig bundle check (#708), and carry a context pack or a project with --context-pack and --project-dir (#694, #700, #716). Record the real assembler version (#718). Offer use, replace or cancel when a team is already installed, backing up a stopped team's edited files (#877). Install .rigbundle files through rig bootstrap (#709). Document the v1 bundle formats and the publishing guide (#702, #750, #751, #777, #810).
• Save --non-interruptive on the rig for full-bypass seats, clear it with --no-non-interruptive, default it with launch.non_interruptive, and accept non_interruptive: in a rig spec (#737, #741, #892). Continue a Claude seat's startup after its bypass warning with rig seat continue (#740, #748). Add the builtin:auto policy (#680, #733) and describe every built-in policy (#713). Accept --operator on rig seat set-permissions (#689).
• Copy a selected plugin's skills into Claude Code and Codex seats' skill folders (#815, #823).
• Add rig roster list, show and find (#697), and rig telemetry events, transitions and tenures (#696).
• Pick the rig context work-install project by rig, then working folder, then the only unclaimed project, with candidate commands when still ambiguous (#690, #688, #772), and list a project's declared worlds (#691). Use the same catalog and selection in operating posture (#693, #712).
• Type rig send --dangerously-interact answers as keystrokes, so numbered menus get the digit (#663).

Behaviour changes

• Return rig queue create, handoff and handoff-and-complete once saved; the wake follows, and --verify waits for it (#776).
• End rig doctor by naming what it didn't check instead of "System checks look good." (#855).
• Print setup's next steps before the permission menu and add nextSteps to --json (#886); list each failed step with its fix (#842); report macOS-only steps as skipped in a Linux dry run (#769).
• Report attention when a bundled prompt reveals a provider gate (#684), and bypass_consent_gate until rig seat continue (#740).
• Send Claude seats a short startup-proof line after their startup text (#719, #743, #747), check later Claude startup files the same way, and surface staged or unverified startup text as warnings (#736).
• Read idle Claude panes under warning rows in every permission mode, and live work beside the mode bar as working (#735, #814); recognise tall question pickers (#745).
• Never merge a bundle's context pack into an installed one (#694); refuse unsafe entries in rig bundle inspect (#695); record the configuration ID and assembler in every bundle.yaml (#708); refuse an escaping legacy project block (#716); prefer a profile's selected skill over a differing catalog copy, with a warning (#720, #722).
• Refuse package skill or agent names that would write outside the install target (#725).
• Warn instead of failing preflight when pi isn't on the daemon's PATH (#655).
• Pass an allowlisted provider base URL to OMP seats of that provider (#744).
• Keep guidance files a surviving seat still uses when rig down can't stop it (#662).
• Delete service volumes through the API only for a JSON boolean volumes: true (#668).
• Cap an infinite or overflowing rig host pair --timeout at about 25 days (#734).
• Open rig specs on the TUI's graph tab (#867).
• Split rig seat set-permissions errors (#689), and print the permission source in rig seat status (#680).

Dependency and install-script changes

• No npm dependency changes; node >=22 and the postinstall check are unchanged.
• Add the optional repository script scripts/install.sh, not in the package and not yet documented (#832, #841, #853).
• On macOS, the daemon may run /usr/bin/osascript to verify a version-named Claude process (#724, #730).
• Run the user's git for GitHub link import (#708) and generated-file hygiene (#721, #727).
• Add one database migration (#737), and ship openrig-core 0.1.4 (#685, #829).

Kernel, setup and first run

• Say --no-kernel skips the operator too (#873); offer the kernel view before a team (#859); use the new team names in shipped text (#866); explain what stopping or restarting a live team does (#895).
• Document rig seat continue, startup attention, readiness timeouts, Claude's bypass warning and builtin:auto in getting started and the help guide (#779); document Node 22 or 24 on Linux, npm 11's postinstall warning and macOS-only cmux (#839).

Claude, Codex, Pi and Oh My Pi

• Verify shell-wrapped, version-named Claude processes by executable path (#724, #730). Keep Claude activity hooks across rig up --existing (#731) and warn when a restore can't reapply them (#746). Quote the fork parent ID (#773).
• Recognise Codex 0.160's update menu header (#861).
• Keep Pi seats' daemon routing (#666), explain Pi credential errors (#667) and incompatible flags (#655), and report how OMP exited at startup (#646).

Launch, queue and Slack

• Add runtime.readiness_timeout_seconds (#643). Name the reached daemon when rig whoami can't find the seat (#660). Trace inventory requests that carry a diagnostic header (#726).
• Clarify rig queue block --on and external gates (#664). Sort less for the TUI's recent queue activity (#816).
• Keep Slack gateway records after an interrupted write (#669), and show live connection and recovery state in rig slack status (#742).

CLI, services and terminal

• Start a stopped local daemon for rig context add (#784); find a context-pack folder created after startup (#686); accept .mjs and .py pack helpers (#706).
• Accept --actor on rig project shadow-drain and shadow-stop (#665); refuse FIFO inputs in rig project experimental (#670); show empty rig capture panes as empty (#671); close rig mcp serve at end of input (#674) and keep its reached daemon address (#676); quote mission names in NOTES.md (#768).
• Keep rig env logs --tail 0 (#673); survive a corrupt cached service receipt in rig env status (#675); start terminal tiles with the daemon's tmux and report panes that exit at once (#715); apply backspace runs in transcripts (#677).

Skills

• Point rig compact-plan at claude-compaction-restore and drop dangling skill references (#683); send agents changing OpenRig to developing-openrig (#829).
• Add the rigs skill to the repository, for npx skills add mvschwarz/openrig --skill rigs (#872, #881).

Docs

Refresh the developer documentation for this release, checking each claim against the code at the time; a final pass against the release commit lands separately.

• Refresh the README, CONTRIBUTING, SUPPORT and SECURITY (#782).
• Refresh the reference pages for specs, projects, bundles, operations and process (#777, #783, #785, #788, #789, #791, #795, #797, #823, #825).
• Refresh the architecture pages and regenerate the CLI reference (#775, #778, #781, #787, #790, #792, #793, #794, #799, #804, #805, #826, #856), and update ARCHITECTURE, DESIGN and the TUI README (#796, #803, #806).
• Use npm ci in contributor setup (#714); ask contributors whether an agent could do a behaviour before adding code, and point them at the capability map (#827, #828).

Thanks to everyone whose pull requests are in this release; they are listed in the release notes. See 0.6.6 release notes for how it was tested and known issues.

[0.6.5]

0.6.5 collects what was merged to main since 0.6.4. It is built from main at b345706b (after #651), plus eight changes merged to main afterwards: #652, #653, #654, #656, #657, #658, #679 and #681 (ported as #687). Work merged to main after that point isn't included. The changes since 0.6.4:

Before you upgrade

• If your shell rc sets a CODEX_HOME different from the daemon's, align them (or unset the daemon's explicit selection) before upgrading. Managed resume now uses the daemon-selected home and does not search the other home for an earlier thread. With CODEX_HOME unset, a second install still shares ~/.codex; set an absolute CODEX_HOME when starting a daemon to give it its own Codex home (#638).
• Restart the daemon after upgrading the CLI (rig daemon stop, then rig daemon start); the running daemon keeps its old build. The first start updates the database, including two new usage-sample indexes whose build time on very large histories hasn't been measured (#569), and installs openrig-core 0.1.3, which running seats pick up at their next launch (#568, #591).
• Give Codex seats on the default workspace-write sandbox network access inside the sandbox unless your Codex config or a managed requirement says otherwise; set network_access = false under [sandbox_workspace_write] to keep it off (#608).
• Re-apply the daemon's OpenRig settings and its matching rig at every seat launch, so shell startup files can't redirect a seat (#618).

Highlights

• Set reasoning effort per seat with effort on a pod member, in profile preferences or in agent defaults; passed to Claude as --effort and to Codex as model_reasoning_effort, unchecked, and ignored by Pi (#320). Recognize --effort in Claude identity proof, so an effort-set seat passes the exact identity check without an unverified-identity warning (#681).
• Let Codex seats reach the local daemon under the default sandbox, after a short read of the Codex configuration (about 0.1 to 1.5 seconds; network stays off if it takes over 4 seconds). Not checked with real logins, managed policy bundles or on Linux (#608, toward #275). Name a blocked daemon connection as blocked instead of advising a new daemon (#504).
• Save the current Claude conversation before shutdown, so rig down and rig up after /clear restore it. For an archived rig, the refresh skips another rig's live namesake and the archived row keeps its own saved conversation. Shutdown adds two process checks and a small file read, and a stalled process listing or file system can delay it. /clear followed immediately by rig down with no new message was checked with a real Claude session on Linux; a change between that read and shutdown is unverified (#658).
• Record the assigned session ID for fresh Claude launches (#656); confirm wrapped and natively installed Claude seats from the native process and the saved conversation ID during restore, readiness, identity checks and rig seat clear-attention (#264, #335, #520, #554); show acknowledged continuity as unverified without strict restore proof (#652, #651); deliver to Claude launcher shim chains (#567).
• Wait for an attempt-specific restore map before managed Claude compaction sends /compact: up to 25 minutes for automatic compaction, after which that attempt stops and automatic compaction stays off until rig compact runs again. Add rig compact --state, --cancel and --skip-map (#610, #633). Stop with occupant_generation_unavailable when the occupant is unknown (#645). Teach the bundled restore skill a ranked restore map (#591). Load a post-compaction profile without a seat recap, with a warning (#597). Act only on fresh context readings (#464). Not tested against a real Claude compaction.
• Add rig ps --resources for host load and transcript capture cost, back idle capture off to once every 6 seconds, and apply transcript line and interval settings to running seats without a restart (#556, #624, #536).
• Batch tmux reads in the activity, identity and structural sweeps (#293, #309). Defer full queue views in Slack sweeps until an item needs a post: much faster on a synthetic 200-row queue with few posts, about 11% slower when none had been posted, and still a scan of active rows. Based on korallis/agent-stack#139 by korallis and Lee (#642). Find the latest usage sample through an index, based on korallis/agent-stack#137 (#569). Run execution-view Git checks without blocking the daemon (#557), start fewer processes in the refocus hook (#499), and keep each session-boundary marker once (#545).
• Add clickable Slack questions on human decisions; older Slack apps must turn on Interactivity by hand (#195). Thread follow-up updates with rig queue create --human-intent update --reply-to <id> (#155). Upload local evidence files again, and attach video and PDF up to 50 MiB (#298, #305). Tested against a simulated Slack only.
• Add the Oh My Pi runtime (runtime: omp) with per-seat state; no live provider session was run, and full-restore recovery of OMP seats is still open (#35, #41).
• Check the real queue store and selected Claude hooks in rig restore-check (#328), run restore's own pre-checks against the snapshot it would use (#636), and report an unlocated rig spec as yellow "not checked" (#631).
• Pick and print the queue create ID before sending, and warn when a same-ID retry's body wasn't saved (#495). Accept --source outside a seat as a self-declared source (#440). Name the daemon asked when a queue ID isn't found (#654).
• Teach the route to the current project's context in onboarding and the bundled restore and reorientation skills: rig context work-install lists what the project declares, --deliver prints it all, and with several projects it stops with project_required until --project <id> picks one. Add placement guidance for project knowledge (#679).
• Validate rig specs locally without a daemon (#566).

Behaviour changes

• Deliver a Claude send with an "unverified conversation" warning when the only objection is one mismatched launch token, such as after /clear (#607).
• Refuse @ in pod and member IDs; rig spec validate can still pass such a spec, so run rig spec preflight (#473).
• Print a request-ID line to stderr on every rig queue create (#495).
• Exit 1 or 2 on failed daemon reads in rig bootstrap, rig requirements (#202), rig env status (#382), rig plugin list, rig agent-image list, rig context list, rig specs ls (#577), rig start --all (#578), rig mode cite (#426), rig chatroom history and wait (#476), rig config reset (#284) and rig compact-plan (#579); refuse rig gateway human remove when its queue lookup fails (#531); exit 1 from rig plugin used-by for an unknown plugin (#262).
• Refuse blank, non-numeric or negative rig chatroom wait --timeout values; a suffix is not a unit, so 30s is 30 seconds and 2m is 2 seconds (#355, #650). Validate rig ask --wake-timeout (#356).
• Keep the rig record and block --delete when rig down can't confirm a session is absent (#513).
• Detach terminals viewing a seat session that ends, even with detach-on-destroy off (#187).
• Write Claude onboarding and trust to <CLAUDE_CONFIG_DIR>/.claude.json for permission-mode launches (#565) and to both files for classic launches when the daemon has CLAUDE_CONFIG_DIR set (#592); leave an already-provisioned file unwritten (#595) and a malformed one untouched (#565).
• Keep a user's own Claude status line and an unparseable settings file; such a seat reports unknown context usage and skips resume-token capture (#497, #500).
• Take Claude terminal and locale variables from the seat's pane (#326), and pass USER and LOGNAME to seats (#564).
• Rename restore-check seat.<s>.queue-file to seat.<s>.queue-store (#328); move an unlocated spec from red to yellow (#631); add the rig.<name>.restore-preconditions check (#636).
• Flag handed_off_to closures to a seat with no linked successor in a fixed 24-hour window (#604, #341); record one closure-overdue transition per claim (#593); warn on queue writes to unknown local seats (#337).
• Evaluate the 200 busiest families and mark rig health PARTIAL instead of failing (#357); name failed health sources as unavailable (#626).
• Turn notifications off with a warning for an invalid ntfy or webhook URL, and move URL credentials into a Basic Authorization header (#149).
• Refuse rig files that resolve outside the rig folder through a symlink when bundling (#507); refuse backslash-traversal and drive-letter entries and skip links when unpacking (#292); warn about missing or unreadable declared skills (#259, #274).
• Bind a second TUI's control socket separately (#205); activate TUI controls on primary clicks only (#549).
• Parse local context pack names as YAML (#370); treat my.host:/path as remote for registered dotted hosts (#368); resolve single-quoted Slack secrets (#376); give colon-version workflows new Library IDs (#441); stop writing kernel seat roles into shared CLAUDE.md or AGENTS.md (#562); keep blank lines in rig transcript (#639); print full rig names with rig ps --full (#600).

Messaging and delivery

• Submit with tmux's named Enter key instead of C-m (#540).
• Retry an unreadable observation until the wait-for-idle deadline (#603), and report only observed facts in the producer-link: advisory (#606).
• Write pasted text through an owner-only temporary file (#292).
• Find panes whose working folder contains | (#216).
• Deliver subscriber-generated events once and in order (#527).
• Answer malformed JSON request bodies with 400 (#587).
• Compare rig chatroom history --since as instants (#208), and keep truncated ntfy titles ASCII (#217).

Queue

• Escalate prompt-blocked work as one operator alert and resume wake retries once the prompt clears; keep unresolved operator routes for re-resolution instead of exhausting them (#619, #644).
• Keep the retry path for an unclaimed baton whose wake the typing guard held (#623).
• Preserve shared watchdogs across park transitions (#505), and record fired receipts only for the latest park (#210).
• Skip stuck findings for asks already posted to their person (#518).
• Report unverified handoff custody on rows closed without a local successor (#341).
• Report a remote body cut off mid-response as an unknown outcome (#336).
• Keep writes addressed to this daemon's own host ID local (#588).
• Report a human-closed alert's real delivery outcome (#296).
• Retire stopped-session activity evidence (#288).
• Answer a non-numeric whoami recent limit with 400 (#647).

Seats, launch and restore

• Skip damaged snapshots (#207), and order same-second snapshots and checkpoints by insertion (#206, #601).
• Use the whole readiness allowance before timing out (#530).
• Relaunch a rig's last seat after rig seat stop ended the tmux server (#325).
• Remove members whose session already exited in rig shrink (#431).
• Address tmux sessions by exact name (#449, #614, #625), including sessions literally named =name (#515).
• Report failed Compose teardown (#533), and keep capture until a seat's termination is confirmed (#538).
• Keep periodic snapshot intervals longer than about 24.8 days (#548).
• Report a mutating handover's timeout as an unknown outcome (#198).
• Resolve rig seat status by canonical name (#340).
• Skip non-object transcript lines in rig restore-packet write (#291).
• Keep the previous recap when a recap write fails (#209).
• Report the identity hook's tokenPersisted from stored state (#40).

Claude, Codex and Pi

• Press Enter once more on a visibly staged Claude startup prompt, and start with a warning instead of failing (#598); distinguish an unrecognized input box from a text mismatch (#634, #617).
• Report the later reset when both Claude limits are used up (#455).
• Recognize the Codex 0.157 and 0.158 empty composer as idle, and a far status row as active (#295).
• Stage long Pi commands outside the terminal line limit (#212), reject failed Pi startup responses (#213), and run runtime version probes from a valid folder with a stated failure reason (#471).

Slack

• Render ordinary https evidence links as links (#89).
• Search up to 10 history pages before re-posting an ambiguous post (#395).
• Warn about missing optional scopes in rig slack verify (#334), and explain an unavailable person registry in rig slack enable (#332).
• Redact upload titles (#302), and stop private downloads at their size bound (#333).
• Scope inbound deduplication by channel (#452), keep concurrent dead-letter work (#377), and settle a stopped socket loop (#387).

TUI

• Back off repeated stream drops (#380), bound stream header waits (#546), follow standard SSE framing (#535), and close refused or late streams (#204, #543).
• Recognize application-cursor arrow keys (#429), keep command argument whitespace (#443), and decode control-socket UTF-8 across chunks (#203).
• Keep the local reader's selection in range (#434).
• Label retired and deferred slices (#350), show the served wave-map source (#428), show daemon adoption as N/A for a selected project (#552), and list current evidence before retained proof rounds (#553).

CLI and hosts

• Count pane-only permission prompts in the rig ps attention total (#180).
• Say the daemon didn't respond, instead of calling it stopped, in rig status (#349), rig start (#437), rig bootstrap, rig discover, rig workflow and rig workspace (#439).
• Bound kernel readiness waits (#363) and workflow stream connection waits (#381).
• Keep remote daemon health verdicts in rig host doctor (#396), render remote rig up errors (#329), print rig terminal open HTTP errors (#229), and keep remote terminal session quoting (#369).
• Refuse out-of-range rig usage top windows (#483), and report seats with missing counters as unknown (#582).
• Refuse self-dependencies (#286) and stale mission composition plans (#339), warn about dangling dependencies after a slice move (#263), read CRLF frontmatter (#378), and stop seeding progress checkboxes (#338).

Files, transfer and context

• Write config files atomically where the folder allows (#576), and keep the saved rig.yaml when rig export fails (#640).
• Stage local context packs before publishing them (#583).
• Recognize headings indented up to three spaces (#584), and keep fenced examples intact in the shipped address script (#388).
• Canonicalize context root aliases (#436), and report dangling symlinks only when they are (#585).
• Publish complete agent images, manifest last (#580).
• Make transcript tail reads progress on damaged UTF-8 (#581).
• Explain an unresolved refocus work node and fall back to the project chain (#484), and use topology.root in the shipped compose.py (#486).

Specs, bundles, proof and workflows

• Preserve file modes (#321), handle read-only sources (#575) and create output folders (#258) in rig bundle create.
• Include built-in libraries in rig plugin used-by (#262).
• Resolve openrig-home: plugin paths (#620), and load the built-in core plugin from a custom OPENRIG_HOME (#627).
• Add orientation: role startup files and a role line in rig queue whoami --json and the refocus hook (#562).
• Support nested mission folders in lifecycle compilation (#211), proof evidence (#394) and the proof watcher (#373); include mission status in readiness revisions (#366); count slice-local review records (#427); include README.md nodes in execution views (#438); remove temporary receipts after failed proof writes (#383).
• Keep cached workflow versions through parse errors (#508) and while unfinished work uses them (#512), recover repaired rows in place (#442), detect same-second edits (#435, #572), and keep cache removal within the scanned folder (#433).
• Probe bracketed IPv6 service targets (#215), and require every Compose replica to be healthy (#218).
• Treat folders starting with two dots as inside their parent (#459, #524).

Platform and setup

• Bracket IPv6 daemon hosts in CLI (#461) and daemon (#509) URLs, and probe IPv6 registered hosts (#398).
• End open event streams after a short grace period in rig daemon stop (#324).
• Sanitize pairing requester names and prune expired pairing requests (#149).

Docs and skills

• Ship the README in the npm package (#272), and describe OpenRig as a network of agents (#297, #304).
• Correct the help guide's known problems, the capability page and the rig-spec runtime list (#468); document Pi seat folders, models and environment (#469) and HTTP readiness (#214).
• Remove unshipped references from shipped skills (#467, #510), route simple seat additions to rig grow (#406), and explain attention checks and token correction (#651).
• Clarify help for rig seat handover (#351), rig gateway human add (#354), rig broadcast --pod (#322) and rig context trace --seat (#323).
• Explain cmux's socket mode change in the README (#609).
• Add contributor architecture maps, a developing-openrig skill and a roadmap (#282, #539).

Web UI

• Keep terminal UTF-8 intact across reads (#456).
• Write metadata.status: complete when completing a mission (#386).
• Show the newest recent observations (#506), report unobserved CLI versions as unknown (#523), and return 400 for unknown audit verbs (#501).

Thanks to everyone whose pull requests are in this release; they are listed in the release notes. See 0.6.5 release notes for known issues.

[0.6.4]

0.6.4 is the code tested and published as the 0.6.4-rc.1 release candidate, now the normal release. Only its version and these notes changed.

npm install -g @openrig/cli

It was cut from main at afde814f, and since then it has changed only by the bounded changes described here: the repairs below, the web UI default, and browser access with its docs page. If something breaks for you, please open an issue.

Two changes you might notice

The web UI is off by default. The daemon no longer serves the web UI's pages or its terminal connection unless you turn it on with rig config set ui.enabled true and then stop and start the daemon. While it's off, opening the page shows those steps, and rig ui open prints them. The web UI is in maintenance mode; the CLI and the TUI are the supported ways to use OpenRig.

The daemon checks which address and which web page a request comes from. Nothing changes for the CLI, the TUI, agents, the queue, Slack, or other OpenRig hosts that reach this machine by its IP address, its own hostname or its own Tailscale name. Two cases now need one setting:

• If you reach the daemon by a custom DNS name, an /etc/hosts alias or a reverse-proxy domain, add that name to OPENRIG_ALLOWED_HOSTS.
• If a local app or development server on another port calls the daemon from a browser, add its origin to OPENRIG_ALLOWED_ORIGINS.

Each refusal says which setting to add, and both need a daemon restart. The details are in Browser access and allowed addresses (#358, #372).

Repairs made after the candidate was cut

These repairs went into the candidate after it was cut.

• Bundles keep binary files intact. rig bundle create re-encoded binary files in agent packages (#245, #257).
• Local commands reach the daemon you started. A daemon started with rig daemon start --port is now the one other commands talk to (#246, #266).
• A rig's only seat can be relaunched fresh. rig seat launch --fresh --stop on a single-seat rig no longer refuses after stopping the seat ended the tmux server (#265, #267).
• More time for Claude's capability check. A managed Claude launch with an explicit permission mode first reads claude --help. That check now gets five seconds instead of one. Answers arriving within the longer budget can succeed; a timeout can still refuse the launch. Slow answers were reported when several seats started at once (#260, #271).
• Seats launch after an upgrade removes the old version. Fresh launches and restores use the running version's built-in startup files instead of failing on paths into the removed install (#261, #269).
• Claude seats take messages after a full down and up. When a managed Claude seat resumes in auto mode, it accepts ordinary messages again once OpenRig confirms the same Claude process is running in its pane. A resume it can't confirm asks for your attention instead of starting a fresh conversation (#287, toward #273).
• Natively installed Claude is recognized. OpenRig recognizes a native Claude install behind its managed shell wrapper, including versioned install paths. When it can't observe the runtime, ordinary delivery goes ahead with a warning; a pane that is plainly an idle shell, or the wrong recipient, is still refused (#310, a follow-up to #197).
• Restoring an older Claude seat keeps an uncertain launch. If the resume check can't tell whether the conversation came back, the restore keeps the new session and asks for attention instead of closing it (#345, #346).
• Replacing proof files doesn't write through links. rig proof add --replace now swaps in a new file, so a symlinked or hard-linked artifact no longer overwrites the other path's contents (#307).
• Slack keeps long messages, and retry errors stay contained. A message from a registered person is stored with its complete text; before, anything past 1,800 characters was lost. A storage error while the gateway retries undelivered events is now logged instead of escaping (#361, #375, #404).

Everything else since 0.6.3

Messaging and delivery. An unverified runtime is reported separately from a stopped agent (#240). tmux reads use printable separators and a shell-free command path (#179, #167). Native process checks no longer depend on your locale (#239). Event subscriptions cancelled during replay are released (#233). CLI request deadlines cover the whole response, and a body that fails after its headers is reported as an unknown outcome (#201).

Queue, seats and rigs. A blocked row keeps its park timer through a seat handover, and a rerouted row's periodic timer is retired (#242). Closed queue items show the right pickup state (#176). Discovery claims survive background rescans (#237). A seat launch that times out reports an unknown outcome (#191). Attaching accepts runtime guards for existing nodes (#228). Kernel Claude seats get the shared activity hooks (#178). An unset native Claude config selection stays unset (#225). Importing YAML over a stopped rig with the same name archives the old one and shows its ID and unarchive command (#196).

Files, transfer and context. SSH, rsync and Herdr output keeps UTF-8 intact across chunks (#230, #241). Local rsync directory operands are preserved (#231). Atomic file edits keep the executable bit (#235). File-shaped entries are projected instead of failing (#185). Oversized suffix ranges are clamped (#234). Headings inside fenced examples aren't treated as context addresses (#236). rig env status says when a service receipt is stale (#232).

Platform and setup. Codex readiness works with providers other than OpenAI (#222). Removing Codex activity hooks leaves the rest of your config untouched (#186). Daemon liveness on Windows no longer uses ps (#173). Module URLs and transcript paths are portable (#168). ps rows whose command name contains spaces are kept (#82).

Onboarding and repository. The onboarding text that new seats read now covers both ways a build goes wrong, and the skills router says a project, rig or machine may add its own skills (#303). Release checks skip tag diffs when old tags are absent (#152), and security and integration PRs are asked for practical scenarios (#224).

Fixes merged to main after this candidate was cut, including many community contributions, aren't in this release. They'll ship in the next release, with their credits.

How it was tested

Most installed and real-agent results below come from earlier builds of this candidate. The final package received the package-content/stock check and the affected Slack component checks; unchanged-path evidence was carried forward through checked package deltas.

• Required checks: the integrated release changes passed their recorded CI runs. The release checks cover build and packaging, types, repository checks, package test suites and an installed-package scenario.
• Scripted checks without real agents: installed copies of candidate builds ran the repository's scripted checks. Three known failures remain: two cases in plugin usage reporting (#251, fixed on main for the next release), and rig proof add --file dropping a leading byte order mark from the stored file (#250).
• A fresh first-time install ran Claude-only, Codex-only and mixed teams through useful work, with seats handing work and review results to each other, then a warm resume and a graceful reboot. The tester approved the providers' ordinary permission prompts as a first-time user would.
• Real Claude Code agents on a test server: after a full down and up, a Claude seat took and answered an ordinary message, carried on with its own queue work, and kept its conversation through a daemon restart.
• The final package's Slack checks: tests of the installed Slack components kept long inbound messages whole. In both retry-fault cases, the gateway logged the error, kept running and delivered the event once on the next automatic retry. These used synthetic connections on Linux with the package's existing dependencies. They aren't a live Slack test or a fault trial of the whole daemon.

Tested environments, from the run receipts. Unlisted versions are not established by this summary.

Run	Platform	Versions
Fresh install	macOS on Apple silicon	Claude Code 2.1.286, then 2.1.287 after the warm resume (the launcher version changed between phases); Codex 0.159.3; Node 24.21.0
Test server	Ubuntu Linux, x86-64	Claude Code 2.1.220, Codex 0.145.0
Final Slack checks	Linux, x86-64	Node 22.22.1; no providers

The tested release-candidate package's SHA-256 is 5344a48a747629f71d4427ce52d24e6e1034e9097b4d5d34ec125d5396fa66b6; 0.6.4 differs from it only in its version and release notes. The 0.6.4 package SHA-256 is 251f3622587eef7f84289292a90547dec3cc5b53a89c93600c3296da91d7445f.

Known limits

• A restore can report a problem with a seat that works. In the test-server run, rig up after a full down exited with an error, reporting that the Claude seat needed attention, while that seat went on to take and answer an ordinary message. rig restore-check also reported a failure for that rig (#273).
• Codex under its default sandbox. In the test-server run, Codex 0.145.0 under its default workspace-write sandbox could not reach the local daemon, blocking its queue work (#275). That run did not prove cross-seat queue handoffs; its successful queue continuation was Claude working its own row.
• After a reboot the daemon doesn't come back on its own. Start it with rig daemon start, then bring your rig back with rig up <name>.
• Stopping the daemon can report a timeout while closing connections (#166).
• Setup's optional cmux step can report an error.
• Browser access protects against unknown web pages and names. It isn't complete browser isolation, so keep the daemon on loopback or your tailnet. The browser-access page lists its other limits.
• Windows wasn't tested.

Thanks

To the people whose pull requests are in this release: @rudycelekli, @nvtoan0201-swe, @MTG-Thomas, @hobostay, @hoklims, @mvdpoel, @oodadoudou and @Coder8124.

And to the people whose reports shaped it: @m3ac-AllbrittenJ for #260 and #261, @rudycelekli for #361 and #375 and their fixes, @korallis for the park-timer finding in korallis/agent-stack#61, and @dmelo for #197.

[0.6.3]

• Recognize running managed Claude Code seats behind OpenRig's shell wrappers using pane lineage, foreground process and native session identity checks. This repairs the 0.6.2 messaging refusal reported by @dmelo in #197 (#220).

• Clean up unusable snapshot helpers when their ownership is proven, instead of accumulating them on repeated attempts. Thanks to @z4cc for #188 (#189).

• Keep archived duplicate rigs out of seat-reference resolution and preserve another live seat's session and queue work when removing a stale node. Thanks to @Farkinell for #174 (#181).

• Protect proof media from artifact writes: reject binary artifact bodies and require an explicit --replace to overwrite an existing Markdown artifact (#177). Repository script tests also run serially to prevent interference from shared build outputs (#221).

See 0.6.3 release notes for the verification limits. Source regression coverage does not establish installed Claude/Fedora delivery.

[0.6.2]

• Start with two Claude Code agents, two Codex agents, or a Claude owner and Codex checker, using the same first-project task and review path. Agent-guided setup recommends a scoped rig command allowance after your explicit choice; broader permissions remain separate (#147).
• Install schema-version-2 bundles into --target and launch from those retained files. Local CLI bundle paths resolve from your working directory; conflicting target files are preserved (#146). Without --target, rig up <file>.rigbundle installs into your current directory, so run it from the project folder you want.
• Refuse message delivery into a bare shell where an agent runtime should be running (#150, fixes #142).
• Preserve the named target during managed launches after a tmux/host restart, instead of confusing it with an old bare pane binding; existing identity checks remain. Thanks to @diaztunjano for reporting #141, addressed by #151.
• Repair self-host sender identity, tmux window parsing, Codex hook-path canonicalization, Pi input editing, TUI health display and restore diagnostics; carry runtime hints to Herdr and allow configured Anthropic endpoint forwarding. See the community fixes and credits.

See 0.6.2 release notes for usage and compatibility. Installed first-use and reboot/power-loss verification remain pending; these source changes do not establish those outcomes.

[0.6.1]

• One version-matched agent help guide: rig context get help, also available inside the installed package when the CLI cannot run. It links setup, restart, permissions and instance guidance, with a support route at [email protected] (#113).
• rig view show execution --project <catalog-id> --mission <mission> selects a catalogued project's missions. Thanks to @dajiaohuang (#105).
• Recognize the Codex » conversation prompt during startup/resume checks, including after a dismissed hook-review panel. Unresolved menus remain gates. Thanks to @dajiaohuang (#111).
• Repair the bundled Vault skill's frontmatter and check shipped skill headers (#115); remove historical development evidence from the public source tree (#118) and the retired TUI drivability prototype (#119).
• Run eight PR test jobs, including the UI suite and one installed queue-durability scenario with an intentional failure control (#117). This does not cover all historical scenarios or every platform.
• Parse SQLite boot timestamps as UTC on non-UTC hosts so current identity and context readings are compared with the correct generation start time. Thanks to @Coder8124 (#124).
• Recognize headerless Codex conversations with custom status-line field order and mixed-case model names (#125); thanks to @Hexgunner69 for the report and @Aummadour for regression cases. The separate stale restore-warning issue is not fixed by this change.
• Resolve a linked worktree's Git metadata directories for Codex fresh launches instead of passing its .git file as a directory (#126); thanks to @mgall-ibizdigital for the report and suggested approach.

See 0.6.1 release notes for changes and compatibility limits. Slack manifest/setup assistance and Rig Stream classification remain experimental; no new validation of those experiments is claimed.

[0.6.0]

• Breaking: OpenRig requires Node.js 22 or 24 and uses better-sqlite3 13. Node 20 is no longer supported, and the install check refuses it; Node 26 is untested. Switch Node, then reinstall the CLI; existing data is migrated in place. See Moving off Node 20. Thanks to @jimallen for reporting the Node 26 install failure and proposing the upgrade (#16).
• Choose permissions per seat for future launches with rig seat set-permissions <seat> --mode <mode> --reason <text>. Codex full_bypass now also sets -a never; Claude Code modes such as auto are accepted only when the managed executable supports them. Rig-level verbs move to rig policy permissions …, with the old verbs kept as aliases. Thanks to @DoowanKang (#30) and @djogss (#33).
• Protect a seat where you type by hand with rig seat set-typing-guard. While it is on, automatic messages and wakes are held instead of typed in; the default is unchanged. Thanks to @some-marketing (#48).
• Experimental: rig slack manifest prints the Slack app manifest offline, with a prefilled create-app link, and a new setup guide describes the manual steps. Creating the app remains a step you do in Slack, and the steps have not been confirmed against a real app creation. The existing Slack connector is not experimental.
• Open a whole rig in Herdr from the TUI (term ▸ rig <name>), up to 16 seats per tab in a workspace named after the rig; the empty starting tab is closed only when that is confirmed safe. Thanks to @shintaii (#26).
• Pi seat activity reports carry the occupant generation and are accepted only for the seat's current occupant. Thanks to @DoowanKang (#29).
• The kernel starter summary identifies the library preview and explains automatic runtime-variant selection. Thanks to @tgrundtvig (#21).
• Codex seats launch with --no-daemon when supported. Thanks to @reisalbuquerque (#69).
• Missions without a metadata block no longer fail the readiness reader. Thanks to @shravansumanthanan for the fix and @kainne44 for the report (#72).
• Experimental and optional, off by default: a classifier seat can have Jev, through OpenRouter, label Rig Stream observations. Check, turn on or turn off with rig project experimental status|enable|disable --config <file>, then run one bounded foreground rig project wake … --experiment <file>. Labels are advisory, with no accuracy or reliability claim, and the feature may be incomplete. See stream classification.
• Report problems with either experiment through a GitHub issue or a pull request (CONTRIBUTING.md).

Includes #77, #84 by @mvdpoel, #91 and #94.

Release preparation: #109. An ordinary candidate-tarball install with real postinstall passed on fresh macOS 15 ARM64 / Node.js 22.22.1, including SQLite 13, all 89 migrations, write/reopen and unauthenticated daemon startup/shutdown. Fresh Node 24 install and authenticated native fresh/resume/fork permission enforcement were not completed. See the verification scope and known limitations. The final artifact will be separately bound to the merged release commit.

[0.5.17]

• Install the CLI with Bun as well as npm: bun add -g @openrig/cli. The package no longer depends on the unpublished @openrig/daemon; it imports the daemon copy it already ships, which also makes the package smaller. OpenRig still runs on Node.js, and Bun may block the package's postinstall check. Thanks to @drewpayment for reporting this (#66).

Includes #68. The Node support range and SQLite version are unchanged.

[0.5.16]

• Let a rig write Claude Code's managed instruction blocks to CLAUDE.local.md instead of a tracked CLAUDE.md, with managed_blocks: { claude-code: CLAUDE.local.md }. The default stays CLAUDE.md, and Codex stays on AGENTS.md. Blocks already written to CLAUDE.md are not moved; remove them by hand after switching. Thanks to @hvpaiva for reporting and proposing this (#25).
• Add an advisory portability report for pull requests. It lists added lines that contain machine-, network- or account-specific values. Findings never fail the check; operational errors, such as a git failure, still do.
• Show badges and a short demo of agents working in the README.

Includes #54 and #56 by @mvschwarz. The Node support range and SQLite version are unchanged.

[0.5.15]

• Recognize Codex through shell and Node launchers during startup and recovery, while keeping uncertain process identity visible.
• Skip recognized Codex update notices without installing provider updates, and give clearer startup recovery guidance, including rig up <name> --existing.
• Add the OpenRig Software Factory recipe and worked example for continuing reviewed work, with incremental team growth using rig grow.
• Guide agents through user-chosen command permissions, preserving existing rules and explaining project versus user scope. Permission defaults are unchanged.
• Explain provider hooks, workspace trust and other machine changes before the first launch.
• Show Pi replies and tool progress, retain managed OpenRig context in shell tools, and report bounded provider errors without exhausted-retry duplicates.
• Submit pasted Pi messages explicitly and handle input beyond the terminal's canonical buffer limit, including cancellation and oversized-input recovery.
• Add a guarded retry for an added seat whose first startup failed during resource projection; retain its complete original configuration for recovery.

Pi support remains qualified and supervised: controlled coding and continuity were verified, but ordinary useful-task completion and unattended teamwork remain unverified. Shipped permission defaults, the Node support range and SQLite version are unchanged; project work-policy features are outside this release.

Includes #37 by @danielkuykendall23-boop, and #38, #39, #45 and #46 by @mvschwarz.

Known compatibility limitation: on macOS arm64 with Node 24, SQLite dependency installation can fail when a suitable prebuilt binary is unavailable, and compiler-built SQLite has also shown runtime cleanup failures. Use Node 22 on that platform for now; the declared Node support range is unchanged. See the release notes for starting commands and guidance.

[0.5.14] - 2026-09-14

VM inspection was accepted: generally zero-to-two-second loading with occasional timeouts, formatting, icon colors and default views. This is an observed result, not a general latency or availability guarantee. The completed single-consumer Slack/phone exercise remains evidence for unchanged notifications.

• Enter a confirmed running rig directly, with responsive Help, Skip and Local during slow or unverified startup.
• Keep the navigator and labelled useful content during page/rig changes, slow reads and failures; preserve scope identity, passive prior content and confirmed removal semantics. Read the selected rig before unrelated fleet details.
• Send complete bounded human briefs with related thread detail, distinguish quiet FYIs from decisions, and retain delivery/reply correlation.
• Find instance-wide Human requests and delivered Updates in Feed; open Health, Configuration and Connections under System, with six top-level entries.
• Browse Feed categories, explicitly expand Specs kinds and Derived terminal views, and find Saved views without expanding the whole catalog.
• Read mission outcomes, current or planned owner, blockers and next dependencies above slice boxes at both terminal widths. Native accepted judgments drive completion; assigned or reopened work and mission lifecycle remain distinct.
• Reduce repeated terminal inventory work while preserving saved-view preview and explicit Herdr Open; no general latency improvement is claimed.
• Keep primary queue facts readable when optional blocker descriptions fail; bound fleet reads across stages and avoid duplicate policy/receipt read work.
• Reduce restore/startup inventory scans with selective event indexes, preserving history and projection results; private replay is not a live latency guarantee.
• Preserve nullable identity provenance during queue-history archival. Shared history, RECENT and OWNER/receipt readers now include archived records; unknown historical provenance stays null rather than being reconstructed.

Root, CLI, daemon and web UI are 0.5.14; terminal TUI remains 0.1.0. Migration head advances to 084_inventory_event_indexes, following review read indexes in 083, archive identity provenance in 082 and explicit human-intent fields in migration 081. Private installed review and controlled notification checks retain their exact candidate and runtime attribution. See the release notes for operator guidance and verification limits.

Known limitations: the inherited CLI health-check deadline can reject a queue command before its request is sent; that defect and occasional server delay are not fixed here. Same-candidate recovery did not establish durable responsiveness. Bundled Workflow Specs can disappear from discovery when an upgrade changes the install directory; that fix is explicitly deferred beyond 0.5.14. Recorded shutdown/config-preservation uncertainties and the prior recorder-write failure remain disclosed.

[0.5.13] - 2026-09-10

Status: release candidate, unpublished. Exact-cut substance review, release verification and publication remain pending; live adoption is separate.

• Enter the TUI with useful Help, Skip and local intent reading even while the daemon is unavailable or its state is unverified.
• Choose a project, read its current sources and follow links, then return to the same place without confusing projects that share a name.
• Separate requests needing human action from updates in ATTENTION, and inspect their source without implying approval.
• Preview saved or derived terminal views before deliberately opening them; navigate CONFIG, Help and health with readable values at narrow widths.
• Choose scoped human-led or delegated oversight and retain current context, assessment and action evidence without claiming improved behavior.
• Update Git-backed context through an explicit merge that preserves local authorship, conflicts and the distinction between selected and consumed bytes.

Root, CLI, daemon and web UI are 0.5.13; terminal TUI remains 0.1.0. Migration head advances to 080_scoped_operating_posture. Natural behavioral effect remains UNOBSERVED and human time cost UNMEASURED. The default multi-client control-socket limitation remains disclosed and unfixed. See the full release notes for usage and proof limits.

[0.5.12] - 2026-09-09

Status: release candidate; exact-cut review, final verification and publication remain pending.

• Record authorized proof judgments and corrections once; derive affected slice, mission and project readiness with attributable evidence.
• Inspect authored versus running graphs, deliberately adopt supported revisions, and reconcile ambiguous operations without duplicate work.
• Discover exception ownership before failure; admit dependency-failure tasks/wakes atomically and recover one occurrence without hiding another.
• Keep healthy unchanged waits quiet while preserving change-driven wake, bounded recovery and explicit expansion of compact reads.
• Enter through bare interactive rig for normal startup and selective return, preserving conversation history or requesting an explicit fresh start.
• Browse general instance settings and provenance in CONFIG, with Slack as one subsection and passive, secret-safe inspection.

Root, CLI, daemon and web UI are 0.5.12; terminal TUI remains 0.1.0. Migration head remains 079_workflow_lifecycle_parallel. Accepted development and native evidence retains its original attribution; release preparation does not imply a new human usability study, full-platform run or public adoption. See the full release notes for operational guidance and known limits.

[0.5.11] - 2026-09-07

Status: release candidate; final verification and publication remain pending.

• Start useful repository work with the focused first-project owner/checker team and an attachable shared kernel TUI.
• Inspect workflow owners and waits, declared spec purpose, effective instance configuration, and human connection state in the ordinary TUI.
• Navigate with command completion, readable Recent activity, and persistent timezone selection. Unverified daemon probes no longer read as confirmed down.
• Reuse project release profiles that retain both the release ceremony and the actual post-release boundary, independently of successor scope.
• Preserve context delivery and generation evidence; honor authored startup proof selection; improve exception routing, bounded shutdown receipts, startup child identity, and cross-host origin attribution.
• Diagnosis show/list --json now return summaries; use --full --json for complete evidence. Queue previews also print an exact full-read command.

Root, CLI, daemon, and web UI are 0.5.11; terminal TUI remains 0.1.0. Migration head remains 079_workflow_lifecycle_parallel.

The health-agent experiment remains a POC, and the Herdr journey requires no plugin. Neither is a new cold-agent architecture or a plugin/adoption claim. See the full release notes for operational guidance and the retained verification limits.

[0.5.7] - 2026-09-01

Status: release-cut candidate. Final release-wide verification and public publish remain release-manager gates.

Summary For Installing Agents

• Package versions: root, CLI, daemon, and web UI are 0.5.7; the terminal TUI remains 0.1.0.
• Migration: head advances 076 → 077_node_session_source; normal daemon startup applies the ordered migration list automatically.
• Theme: elastic topology lifecycle and coherent work delivery.

Elastic topology lifecycle

• Create a rig without hand-authored YAML; grow existing or new pods in single or batch operations; and preserve faithful spec show/export, including a member's declared agent-image source.
• Refuse unsafe shrink while work is active. Explicit drain fallback preserves queue identity and state, checks that the destination session is live, and removes only the intended target; ordinary cleanup stays direct.

Coherent work delivery

• Compose product-journey SDLC context across world, project, mission, and slice layers, with useful non-overwriting scaffold defaults.
• Accept optional project YAML enrichment with explicit warnings and default fallback, load Markdown by section address, and support explicit project selection, switching, root isolation, and ambiguity refusal.
• Project the complete catalog of public plugin-only skills together with the helper files their instructions reference.

Deferred and post-release

• Restore honesty is deferred to 0.5.8.
• Cleaned parent-host two-project dogfood runs after release.

See docs/releases/v0.5.7.md for the full notes.

[0.5.6] - 2026-08-30

Status: shipped; "world-building as context engineering." OpenRig 0.5.6 ships the context system's next layer, makes long-running agents durable, and makes messages to humans trustworthy. Three themes: the context a seat runs on is structured, tagged, and verifiable; an agent seat can now outlive its own context window without a human managing the transition; and anything routed to a human carries proof of delivery. v0.5.6 contains v0.5.5 in full.

Summary For Installing Agents

• Package version: bumps from 0.5.5.
• Migrations: THREE new (apply automatically on daemon start; no manual steps). Head advances 073 → 076:
  • 074_context_usage_watchdog.ts
  • 075_context_usage_watchdog_generation.ts
  • 076_owner_notification_levels.ts
• Node engines: unchanged.
• API surface: existing commands remain; additive verbs and configuration below.
  • New verbs: rig view show execution, rig scope resolve-notes.
  • New watchdog condition: usage-threshold (rig watchdog).
  • New continuity policy: compaction_strategy in the AgentSpec (four modes) with a declared mechanic.
  • New reference docs at stable paths: docs/reference/sdlc-conventions.md, docs/reference/mission-install.md, docs/reference/lore-routing.md, docs/reference/planning-dial.md, docs/reference/wave-sdlc.md, docs/reference/release-boundary.md, docs/reference/product-management-pass.md.
• Context packs: 41 ship (up from 39).
• Delivery defaults: deliberately wide open (post at NOTICE and above, interrupt at ALERT and above). Tune down from measured volume with the two dials rather than pre-filtering.
• Continuity modes: opt-in per seat; unconfigured seats keep today's behavior exactly.

The context system: structured, tagged, verifiable

• The mission install. A documented five-layer convention (docs/reference/mission-install.md) for installing project context into a seat: the pieces, their arrangement, the seat's own position, the current contract, and a derive-your-own-delta step that proves the install was consumed rather than skimmed.
• Lore routing. What a seat learns locally routes into addressable, rig-local lore packs (docs/reference/lore-routing.md) — carried with a maturity stage from birth, and structurally excluded from anything that ships.
• Taxonomy everywhere. Every pack entering rig context carries its class — WORLD / LORE / SKILLS / MISSION — surfaced in listings, with a loud refusal for untagged packs.
• A public world pack with checkable claims. The public onboarding pack is authored as atoms whose claims each carry a check that can fail, with the verifier shipped inside the pack — public content that cannot rot silently.
• A complete, self-retrievable skill index. The skill router's index now covers the full shipped set, is retrievable through the routes it teaches, and carries a recurrence test so coverage gaps stay found.
• A substance gate for what ships. A whole-surface review pass over every packaged file (bundle and npm surfaces included) runs as a named release step; this release shipped with all 5,316 packaged files passing.

Continuity: seats that outlive their context windows

• Continuity policies in the agent spec. compaction_strategy is now live configuration with four modes: default-compaction, managed-compaction, handover, and apprentice-handover. Modes apply to Claude seats (positive runtime matching — Codex seats keep their native behavior) and resolve through the same spec-default < profile < member precedence as the rest of the agent spec.
• The apprentice handover, automated. A seat declaring apprentice-handover gets two armed triggers: near its context threshold, the system creates a fresh successor seat and runs its onboarding install; nearer the wall, it mints an owned handover work item for the seat that executes the swap. The executing seat is declared configuration (mechanic: on the policy) — never inferred from topology, and arming refuses loudly if it is missing.
• Managed compaction with honest restores. Seats in managed-compaction mode get a pre-compaction prep nudge (deposit your state before the window closes) and, after a configured restore, a durable receipt recording how much usable context the restore actually recovered — so a restore that silently refills the window instead of recovering width is visible.
• Context-usage triggers as a primitive. rig watchdog gains a usage-threshold condition: fire any command when a seat's context usage crosses a calibrated per-seat threshold. The continuity modes are built on it; your own automation can be too.

The human layer: delivery you can prove

• No more silent fall-through. One destination resolver classifies every dispatch: terminal-bound seats use the terminal; registered humans and virtual seats route through the gateway; nothing falls through to a terminal lookup that cannot succeed. Unregistered external addresses get a structured, teaching refusal.
• Delivery receipts on the work item. Every gateway post writes its receipt atomically on the queue row: posted (with the message timestamp and channel), transport-failed (with the error), or — derivably — never-posted. rig queue undelivered now consults that ledger first and returns only genuine failures. "Did this reach them?" is one read.
• Notification levels, one vocabulary. Queue transitions classify as RECORD < NOTICE < ALERT at write time — a human-required decision is ALERT; system ceremony events are NOTICE; the rest is durable record. Two independent dials configure the minimum level that posts and the minimum level that interrupts.
• A delivery-rules engine. Stored per-human preferences and availability decide how each message class is delivered. An off preference suppresses interruption — never the durable record, the post, or the receipt. Away windows defer routine traffic into digests (4-hour and daily), with exactly-once delivery by construction: durable episode identities, retry until a real receipt, and structurally non-overlapping digests.
• Files dropped in Slack become work. A file or image upload lands as a work item with the file transferred to local storage and referenced by path — authenticated download, size-bounded, per-file failures named, and no URL or token ever written to a row. A park blocked on a registered human automatically enters the alert path and posts exactly once per episode.

Operational honesty

• A rate-limited seat gets exactly one timed wake at its stated reset.
• A seat holding claimed live work while sitting idle gets woken by the system, consuming the arbitrated activity oracle — with exactly one wake per park episode.
• Refocus state keys to the current occupant of a seat; a fresh occupant never inherits a predecessor's baselines.
• rig ps counts claimed in-progress work as assigned work.
• Sends refuse empty bodies; unknown daemon API routes return JSON 404s.
• Stuck-sweep findings stop re-minting after closure; cross-host custody verification completes durably instead of refreshing forever.
• Blocker actuation is unified: one helper, cross-host closure honest, delivery after the transaction commits.
• Rig expansion and serialization preserve what they were given: session_source versions, services, and member overrides survive round-trips; fork forwards model, role, restore policy, and label.
• rig view show execution derives who is building what, what is next, and each item's completion rung (locked / built / reviewed / folded / adopted) at read time — unknowns render as INDETERMINATE, never as idle or done.

Process and reference

• The SDLC conventions document is now a component menu: choose per mission from the simple flow, the wave model, or the rigorous overlay, with planning rigor as a dial. Four full references ship at docs/reference/: planning-dial.md, wave-sdlc.md, release-boundary.md, and product-management-pass.md, joined by mission-install.md and lore-routing.md.

---

[0.5.5] - 2026-08-27

Status: shipped; "the ambient-attention release" — the fleet notices, retries, escalates, diagnoses, and onboards on its own so you can stop hand-babysitting the work in flight. v0.5.5 contains v0.5.4 in full — one reconciled lineage.

Summary For Installing Agents

• Package version: bumps from 0.5.4.
• Migrations: TWO new. Head advances 071 → 073:
  • 072_thread_seat_map.ts
  • 073_queue_transition_wakes.ts
• Node engines: unchanged.
• API surface: existing commands remain. New verbs: rig parked [seat], rig seat handover --source fork:|rebuild (execute path, was dry-run), queue block --on <blocker> (park-with-wake), rig gateway human fragment-lifecycle verbs, rig view show escalations. rig ps gains a typed ACTIVITY column.

Headline

Stop babysitting the work. rig parked <seat> diagnoses "is anyone silently stuck" with confidence and teaching inline; the standing stuck-sweep runs without you and routes findings. Baton wakes retry, aggregate, and escalate on their own — hand off the row and stop chasing nudges. Parks carry their own wake and read HEALTHY. rig ps gains a typed ACTIVITY column from one oracle. The Slack human layer is live end-to-end, and fresh installs onboard themselves.

What you can now do

Diagnose silent-stuck without capture arithmetic

rig parked [seat] answers "is anyone silently stuck" as a derived diagnosis — activity × open obligations, with per-input confidence and remedy taught inline. Reach for it when: a seat looks idle and you suspect dropped work; before any claimedAt arithmetic or pane capture.

Hand off work; stop babysitting nudges

Failed baton wakes retry, aggregate, and escalate on their own (transitions ARE the ladder state, restart-safe; per-destination aggregation; rungs deliver-and-advance; unconfirmed-with-no-pickup escalates without re-send). Reach for it when: you hand off work — the row is enough. Watch rig view show escalations for the aggregates.

Consume the standing stuck sweep instead of running it

Overdue + undelivered become routed findings with derived evidence inline. Reach for it when: you used to hand-run queue overdue / undelivered on a timer — stop; consume its findings instead.

Caveat (5.6 backlog): cross-host successor visibility is a proven false-positive class; treat cross-host-lineage findings as unverified until the 5.6 detector fix. Contained fleet-wide one-per-condition; delta teaches the caveat.

Park a row on a real blocker without waking the attention machinery

queue block --on <blocker> records the wake; held-with-live-wake is not flagged; auto-unparked owners get an honest wake. Reach for it when: imminent-but-blocked work; for not-imminent work use the workspace instead (the queue is a conveyor).

Read seat activity from one oracle

rig ps carries a true ACTIVITY column — typed taxonomy (working / idle-at-prompt / needs-input-as-count+reason / unknown) with evidence ladder + visible rung degradation, seat-keyed across swaps. Reach for it when: any "is it thinking or stuck" question — the oracle beats capture; the TUI reads the same truth.

Execute seat handover, not just plan it

rig seat handover --source fork: (carries live context) or rebuild (primes from the durable chain and names its priming artifacts). Mid-swap failures record honestly. Reach for it when: replacing an occupant — no more dry-run-only planning surface.

Reach human decision owners directly through Slack

Gateway running, thread-per-seat, exactly-once inbound reconciliation, escalation loudness (mention) distinct from routine. Humans are addressable members; rig gateway human has full fragment-lifecycle verbs. Reach for it when: anything must reach a human decision owner — an escalation-class send arrives loud on their phone.

Onboard fresh installs without hand-walking

Fresh installs get focused onboarding packs by default (config off; existing rigs untouched). Reach for it when: standing up a new rig or seat — stop hand-walking the eight pieces.

Trust refocus to fire only when it should

Refocus fires at a context threshold or on demand — NEVER at session start (post-compaction both runtimes; usage threshold Claude-only). Reach for it when: a long session loses the plot — trigger it. A fresh seat getting a refocus is now a bug to file, not noise to ignore.

Author scopes with the one-file convention

scope mission create → NOTES.md + intent-bearing SPEC; slice create → SPEC-only (no IMPLEMENTATION-PRD) + acceptance PROGRESS; release missions get a capability-delta scaffold. repair is ADDITIVE — stamps append, never rewrite author frontmatter. Reach for it when: creating any scope node — stamp verification is a mechanical strip again.

Bind daemons safely from any managed environment

Daemon bind intent has provenance: an inherited OPENRIG_HOST never selects single-bind; adoption gates test ALL required listeners. Reach for it when: daemon maintenance from any managed environment — no more env -u ceremony.

What to STOP doing (each was correct under 0.5.4 and is wrong now)

1. STOP the per-lock author-reconstruction protocol. scope repair/approve used to rewrite author frontmatter; now stamps APPEND — strip-reconstruction is mechanical; the protocol is retired.
2. STOP diagnosing parks by claimedAt arithmetic + capture. rig parked derives the diagnosis with confidence and teaching; capture is a fallback glance, not the method.
3. STOP storing deferred work as queue rows. The queue is a conveyor for imminent sequential work; deferred work lives in the mission workspace and re-mints when due.
4. STOP authoring IMPLEMENTATION-PRD.md and MISSION_NOTES.md on new work. SPEC.md is the one spec file; NOTES.md is the chain name; locks bind SPEC-only.
5. STOP routing contact through an orchestrator by default. Any agent escalates directly; orchestrators/PMs also send judgment-worthy updates.

Landed, not yet drivable (recorded so nobody reaches for it)

• Delivery preferences + availability (stored, validated) — no rules engine consumes them yet (0.5.6 slice 01).
• S01 operator rung — human-layer connector delivery leg lands in 0.5.6 (S11 territory). Escalation view + daemon health carry the floor now.
• @external addresses on the direct send path fall through to tmux (routing fix in 0.5.6 wave-2). Reach humans via the gateway path (queue/escalation), not raw rig send to @external.
• Multi-human topology — single-human ships as an honesty marker; multi-human is 0.5.7.

Known Limitations (0.5.6 backlog)

• Cross-host successor visibility false positives in the stuck-sweep detector — 39 active findings at census (20 proven FP, 19 unverified); contained fleet-wide; fix lands in 0.5.6 wave 1.
• @external direct-send routing — 0.5.6 wave-2 routing fix.
• Delivery preferences → rules engine — 0.5.6 slice 01.

---

[0.5.4] - 2026-08-26

Status: release candidate; "the honesty release" - commands distinguish absence, uncertainty, staging, and completed effects instead of collapsing them into reassuring output. v0.5.4 contains v0.5.3 in full - one reconciled lineage, no product divergence.

Summary For Installing Agents

• Package version: bumps from 0.5.3.
• Migrations: none in this release. Migration head stays at 071 (matching 0.5.3).
• Node engines: unchanged.
• API surface: existing commands remain; new seat lifecycle verbs are rig seat set-model, rig seat stop, and rig seat clean.

Headline

Trust what the command says, including when the answer is uncertain. Transport probes now classify found, absent, and indeterminate outcomes through one resolution path. Delivery verification distinguishes text staged in a prompt from text consumed by an agent. Queue, refocus, preview, import, and lifecycle surfaces preserve the state and refusal that actually occurred.

What you can now do

Resolve transport failures without inventing a missing seat

Send, capture, nudge, and walk use one classified session probe. A transport blip is reported as indeterminate rather than Session not found, while genuine absence remains explicit. Recovery output names what was checked and what action is available.

Tell staged delivery from consumed delivery

rig send --verify classifies the pane effect instead of equating typed text with a completed turn. Single-recipient, fan-out, and JSON results derive from the same outcome model, so a staged prompt is not reported as consumed.

Deliver unknown-sender messages honestly

An unattributable message is delivered with an unknown-sender notice instead of being refused. Where a reply path exists, the sender is told that attribution was unavailable and should follow up with a signed message.

Manage one seat through supported lifecycle verbs

rig seat set-model, rig seat stop, and rig seat clean provide audited, single-seat operations. Stop and clean refuse when any affected session is live or indeterminate; set-model is proven against a real managed successor rather than only stored configuration.

Trust state-preserving queue and refocus behavior

Adding a queue note no longer changes terminal state. Envless owned queue listing refuses instead of silently changing scope. Refocus keeps due state until delivery is visible. Bounded previews say they are bounded.

Refuse duplicate running rig names at every import path

Create and import routes now share one running-name guard. A duplicate running name returns a teaching 409 rig_name_running refusal instead of spending resources or degrading into a generic server error.

Stability and authority fixes

• Startup boundaries are hermetic across scratch/test environments.
• The bundled openrig-core plugin has an explicit advancing authority, so an older runtime cannot silently overwrite newer installed guidance.
• Stale lab refocus registrations are retired.
• CLI and daemon refusal codes survive route and import boundaries without fallback noise.

Known Limitations (0.5.5 backlog)

• Writer-layer disk cap - the one-time VM cleanup recovered headroom, but the permanent cap at the layer that writes snapshots is unfinished.
• Repair/approve frontmatter rewrite - the known rewrite defect remains outside this release.
• Observation pipeline performance - shared pane/process observation remains measurement-gated; 0.5.4 does not claim the broader polling/census redesign.

---

[0.5.3] - 2026-08-26

Status: shipped; "the context release" — pull exact context by address instead of reading files. v0.5.3 contains v0.5.2 in full — one lineage, no divergence.

Summary For Installing Agents

• Package version: bumps from 0.5.2.
• Migrations: none in this release. Migration head stays at 071 (matching 0.5.2). Nothing to apply on a v0.5.2→v0.5.3 upgrade.
• Node engines: unchanged.
• API surface: preserved from v0.5.2; no CLI-command or flag removals or renames.
• New CLI verbs: rig context get, rig context list, rig context profile, rig context recap-write.

Headline

Pull exact context by address instead of reading files. rig context get <pack-ref>/<file>#<H2-slug>[/<H3-slug>] returns the exact span bytes of one section. The openrig-skills router teaches the three-step: ask → ref → load. Refocus resolves refs automatically. Handovers write a durable, superseded-chain seat recap. Composition is by reference, so there is no second copy to drift.

What you can now do

Pull exact context by address, not by reading files

rig context get <pack-ref>/<file>#<H2-slug>[/<H3-slug>] returns the exact span bytes of one section. The /<file> component is required even in a one-file pack. A bogus slug fails loud and lists the addressable sections. rig context list shows every shipped entry's ref and name; rig context show inspects one. Refs are canonical full paths (e.g. skills/<namespace>/<name>). Cross-source access (seat: / mission: atoms) is an authoring affordance: declared in pack manifests and granted via rig context profile --rig/--seat/--mission during composition — not an ad-hoc argument to get.

Reach for it when: you need one section of a shipped skill or library entry and would previously have read or copied the whole file.

Discover context by asking, not by guessing paths

The openrig-skills router teaches the three-step: ask → ref → load. Run rig context list for refs, match your moment to an entry's when, load by ref.

Reach for it when: you don't know which skill or context applies, or nothing is projected after a cold boot.

Write a durable seat recap

rig context recap-write maintains a seat-scoped RECAP.md beside LEARNED with a collision-safe superseded chain; restore packets carry an authored-recap pointer.

Reach for it when: handover, compaction boundary, or any moment your successor would otherwise re-derive your state from scrollback.

Trust refocus to resolve refs

The refocus hook resolves library refs automatically (ref beats file), fails loud but non-blocking, and delivers pointers — the shipped channel for pointing running seats at new content.

Fetch bounded domain expertise on demand

rig context get serves expertise packs by path-like ref, e.g. skills/process/context-engineering. The old context-pack: colon form was removed and the CLI says so.

Caveat that pack: it is titled "Traditional Context Engineering — 2024-2025 Snapshot" for a reason — provisional, historical, non-normative by the project owner's ruling. Current OpenRig skills, explicit user rulings, and measured practice outrank it on any conflict.

What to STOP doing (each was correct under 0.5.2 and is wrong now)

1. STOP copying library content into seat or mission files to compose context. Compose by ref — addressing means there is no second copy to drift. Nothing catches the copy automatically; it is still a defect by rule.
2. STOP treating a MODEL DIVERGENCE proclamation as alias noise. The canonicalize-then-compare fix ended the pinned=fable / effective=claude-fable-5 false-positive class, and the monitor now isolates per-seat throws. A proclamation on this runtime is a real escalation — act on it.
3. STOP confusing explicit-path requirements with permission. The guards described in this release demand explicit paths (e.g. OPENRIG_SKILL_CANON_ROOT); that mechanism does not grant authorization. Historical guidance correction (2026-09-10): the earlier approval statement was project-specific, not a universal rule. Current project and mission authority determines whether local commits, apply operations, pushes or PRs require approval.
4. STOP hand-placing evidence or trusting a placeholder PRD as the proof contract. rig proof add pairs evidence to the contract, and a pristine scaffold PRD can never silently become that contract: the authored SPEC serves with a named advisory (contractSource in the echo tells you which source bound).

Landed but not yet drivable (recorded so nobody reaches for it)

Eval CASES ship (14 selection/loading cases), but no runnable grading pass exists today. --provider rig is the live proof-contract door and is NOT YET DRIVEN — it says so itself and redirects to fake (the wiring is exactly the convergence-test driver work in flight). --provider fake replays only transcripts supplied via --transcripts <map.json> and errors every case without one. When the live door is driven, the next release promotes this to a capability.

Known Limitations (5.4 backlog)

• Reply-hint self-qualify — still open from 5.2; reply-hints on some cross-host messages address themselves via machine-ID rather than registered host name; substitute the registered host name from rig host list. Fix in 5.4.
• Eval grading pass — CASES ship; no runnable grading pass yet. Driven --provider rig lands in 5.4.
• rig send --verify does not detect staged-unsent for multi-line sends toward Claude seats — carried from 5.2 backlog.
• Claude transcripts thin under fullscreen upsell — carried from 5.2 backlog.
• Plus internal debt items ledgered for maintenance.

---

[0.5.2] - 2026-08-22

Status: shipped; test system exercises for real, crash-cart fleet-restore conductor, reliability fixes shipped through the test system. v0.5.2 contains v0.5.1 in full — one lineage, no divergence.

Summary For Installing Agents

• Package version: bumps from 0.5.1.
• Migrations: none in this release. v0.5.1 shipped migrations 068-071 (068 CREATE + 071 DROP-IF-EXISTS pair, net no-op for any v0.5.0→v0.5.1 upgrader); v0.5.2 stays at 071.
• Node engines: unchanged.
• API surface: preserved from v0.5.1; no CLI-command or flag removals or renames.
• New bundled skills: none (this release is crash-cart + reliability focus).

Headline

A test system that catches real bugs on its own product, plus a crash-cart fleet-restore conductor. The reliability fixes in this release were found and validated by scenarios that drive the real product through the same commands a person uses. Type bare rig at a dead daemon and you now reach a truthful cockpit; one Enter restores the fleet kernel-first with surviving tmux panes adopted.

Crash-cart fleet-restore conductor

Type bare rig at a dead daemon and reach a truthful cockpit — no cryptic error, no silent failure. One Enter restores the fleet kernel-first, adopts any surviving tmux panes (never clobbers them), and presents an exact per-seat remediation walkable in one keystroke. Cancel is honest. Destructive restore is only offered when adoption cannot succeed. Ten build rounds, four independent gates, non-author QA door test.

Daemon event-loop no longer hangs under load

A class of daemon event-loop freeze under load is fixed and measured. If your daemon was going unresponsive under fleet-wide activity, that's this class.

Unattended Claude seat handover

Outgoing Claude seat writes a recap and submits its packet automatically at handover (compaction, session boundary, explicit handover); incoming seat picks up with the recap in hand rather than a cold start. Door-proven end-to-end.

rig policy honest under adversarial input

Malformed or hostile policy input now produces honest structured errors rather than silent failure or unexpected behaviour. Three review rounds.

Cross-host messages carry their machine of origin

Messages sent across hosts now include the machine they came from, so multi-host coordination reads correctly at the receiving end. Enforced end-to-end via door tests.

Codex model-config drift detector

A new detector for a class of Codex model-config drift that would previously go unnoticed. Caught real cases on landing.

Test-integrity

• Test runner refuses to run against a dirty tree — a green run means green source.
• Hermetic test roots.
• Flaky fixtures isolated.

Governance in code

• Plan locks are explicit (chosen when you ask for one), not inherited from ambient state.
• Wake is opt-in.

Container tar-file hang eliminated at the seam

A class of container tar-file hang is dead by construction — not worked around, but the seam that made it possible is closed.

Known Limitations (5.3 backlog)

• Reply-hint self-qualify — reply-hints on some cross-host messages address themselves via machine-ID rather than registered host name; using the reply-hint directly may fail with "no registered host X". Substitute the registered host name from rig host list. Fix in 5.3.
• rig queue handoff --summary warns yet the field is unsettable on its own output. Fix in 5.3.
• rig send --verify does not detect staged-unsent for multi-line sends toward Claude seats. Multi-line sends can stage silently.
• Claude transcripts thin under fullscreen upsell — upstream fullscreen upsell writes "tui":"fullscreen"; one accepted prompt can re-flip a fleet. Fix + pin + prevention in 5.3.
• Test runners can silently skip on unbuilt trees — a final-gate rule (build CLI + assert zero skips) is adopted for the release ceremony; product-side fix in 5.3.
• seat-handover model-fidelity real-Codex end-to-end fails identically on main (environment-vs-product distinction unrooted). Isolation fix in 5.3.
• Plus internal debt items ledgered for maintenance.

---

[0.5.1] - 2026-08-12

Status: shipped; a test system for the product, plus reliability fixes shipped through it. v0.5.1 contains v0.5.0 in full — one lineage, no divergence.

Summary For Installing Agents

• Package version: bumps from 0.5.0.
• Migrations: additive only. Existing v0.5.0 databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged.
• API surface: preserved from v0.5.0; no CLI-command or flag removals or renames.
• New bundled skills: none (this release is test-system + reliability focus).

Headline

A test system for the product, plus reliability fixes shipped through it. Scenarios drive the real product through the same commands a person uses, so it can prove its own behaviour without a human checking by hand. The reliability fixes of this window ship through the test system — proving its value on its first cycle.

Test system

• Stub runtime for tests — a fake agent runtime that scenarios can drive. Lets scenarios exercise the daemon end-to-end without needing a real Claude or Codex process.
• Scenario format + runner — a text-based scenario format and an executor that runs scenarios against the real product. Includes a real fix that surfaced from writing the runner: text-matching against a pane or transcript could never match its two intended surfaces; now it does.
• Seed scenarios — three seed scenarios that run green end-to-end against the real product. See Known Limits for the seed-scenario one that could not be built.

Container test bed — scaffolding

• Scaffolding for container mode — argument builders, image-identity stamping, runbooks, and a unit suite. The runner does not yet execute in containers — this is scaffolding you will see in the tree but that no test currently drives. Container-mode execution is scoped forward.

Reliability fixes shipped through the test system

• Honest render for daemon transport failures — the operator sees the actual failure rather than a silent no-op or generic error.
• Queue-persistence — two fixes ensuring queue records reflect what actually happened after they were written.
• Cross-machine send regression — found and fixed during verification. The test system doing its job: proving product behaviour across machines and catching a regression before release.

Small features

• Per-agent model from spec — each agent's model comes from its spec rather than a fleet-wide default, so different agents can run on different providers or models.
• Token usage tracked over time — the daemon records token use so operators can see trends and predict when a seat is approaching a usage limit.
• Machine-of-origin on messages — messages carry the machine they came from, so multi-host coordination is legible.

Other

• UI timing hardening — UI tests no longer fail on load-timing flakes.
• Queue records tell the truth after they are written — a class of wrote-it-and-it-did-not-stick issues closed.
• Unreached-message visibility — show messages that never reached an agent. On landing, this surfaced nine real handoffs that had been silently lost since 8 August.

Known Limits

• Container mode is scaffolded but not driven — no test currently executes in a container. Scoped forward.
• Seed scenarios: three of the intended set run green — the tenth cannot be built without two capabilities that do not yet exist in the product (a scenario cannot mutate the running system's shape; the terminal interface exposes navigation state rather than fleet inventory). Both scoped forward.

---

[0.5.0] - 2026-08-06

Status: shipped; mission control TUI + context library + permission-policy built-ins + provider usage observability + plan amendment + honest CLI + build discipline. v0.5.0 includes everything from v0.4.8 — there is no divergence between the two releases.

Summary For Installing Agents

• Package version: bumps from 0.4.8.
• Migrations: additive only.
• Node engines: unchanged.
• New bundled skills: applying-a-permission-policy and delegating-work join the shipped set alongside the v0.4.8 skills. Two additional skills (retiring-and-inheriting-a-seat and oversight-team) are still at draft stage and will land in a future release once they mature.
• Behavior change: rig.yaml startup context_pack entries are no longer delivered at instantiation — they are rejected with a teaching error pointing at rig context compose + a delivery command.

Headline

Mission control in the terminal + context library + permission-policy built-ins. Typing rig (or rig tui) opens the new TUI: file-tree navigator, dense agent detail (working directory, runtime, context %), a topology graph with the whole fleet on one screen, honest status/activity language, motion design, working scrolling, and honest width-clip indicators throughout. The context library ships as a first-class store-and-compose noun (rig context) with paced delivery via rig walk and attached-context on rig send / rig broadcast / rig queue create via --context / --body-context. The v0.4.8 permission-policy foundation gets its four built-in templates (locked, standard, open, yolo) plus none as a deliberate no-policy choice, plus an agent-driven translator skill.

Permission policies — built-in templates + custom + agent-driven translation

Building on the v0.4.8 permission-policy foundation, v0.5.0 ships the built-in policy templates plus the skill that applies them:

• Four built-in policy templates: locked, standard, open, yolo. Read-only from the package; copy to customize. Plus none as a deliberate no-policy choice.
• rig setup --policy <name> — records the chosen policy into a rig spec. Takes a built-in name (locked | standard | open | yolo | none) or a path to a custom policy file (custom policies live as .policy.md files you author).
• applying-a-permission-policy (bundled skill) — reads the policy spec at rig setup / preflight, checks the seat's current harness version, shows the concrete diff before writing, and lands the config into Claude ~/.claude/settings.json and/or Codex config.toml. Never blind writes. Agent-driven on purpose — harness permission formats change frequently across versions, so a deterministic writer would break the moment the harness surface shifts.
• Two surfaces: the launch-flag surface (Claude --permission-mode, Codex sandbox/bypass, Pi --approve / --no-approve) is stable and OpenRig-set for you — the floor (Claude acceptEdits, Codex workspace-write) and the full-bypass YOLO mode live here. The config-file surface (Claude ~/.claude/settings.json, Codex config.toml) is where allow/ask/deny rules live and where the skill applies your chosen policy.
• Deterministic vs best-effort: the launch-flag floor and YOLO are deterministic. Fine-grained config-file rules are best-effort because harness rule grammars vary; the skill surfaces the caveats (prefix collisions, target-first leaks, Claude's lack of a native network gate) via the diff-before-write flow. If a translation is uncertain, hand-editing the harness's own settings file — or falling back to YOLO / floor as blunt instruments — remains a valid path.

Permission-writer guarantee, now test-pinned

• OpenRig writes zero permission entries into your ~/.claude/settings.json — pinned by a permanent guard test plus an empty-writer sweep. The one sanctioned exception is the project-local acceptEdits floor that v0.4.8 itself defines.
• Warning ordering during permission-policy discovery — pre-existing main-floor warnings emit first, then the permission-policy attachment warning. Presentation-only; semantic fence unchanged.

Context library

• rig context — stores and composes context packs. Nouns store and compose; rig context never delivers on its own.
• rig walk — delivers a stored context pack paced.
• --context / --body-context — attach a stored context pack (by reference) to rig send, rig broadcast, or rig queue create. Snapshot + provenance preserved.
• Grammar (strict): nouns store and compose; verbs deliver. The old v0.4.x context-window usage viewer is removed; the rig context name now belongs to the library.

Behavior change (v0.4.8 → v0.5.0)

• rig.yaml startup context_pack entries are no longer delivered at instantiation. They are rejected with a teaching error pointing at rig context compose + a delivery command (rig send --context, rig broadcast --context, rig walk, or --context / --body-context on rig queue create). The bundle router still stores the pack; it just doesn't auto-deliver it at startup. Users who adopted startup context_pack on v0.4.8 (shipped days ago; small window) should migrate to the compose + delivery-command pattern.

Provider usage observability

• GET /api/provider/usage + rig provider status — the daemon tracks account-level usage per host so operators can answer "am I about to hit a usage limit". Explicit-unknown when the provider doesn't report it; conflict-shows-both-facts when signals disagree. Codex account-switch flows are preserved.

Plan amendment done right

• rig scope slice approve --re-approve --reason "..." — re-stamps a locked plan with an append-only audit trail, replacing an earlier workaround where an already-approved status forced a Status-note edit.

Honest CLI output

• rig ps — says when it is showing one rig of many rather than silently limiting.
• rig send --json — returns structured errors as {fact, consequence, action}.
• Activity-hook fix — ends the fleet-wide "producer link stale" advisories that were firing on every send. Operator-facing quality improvement.

Build discipline

• Contributor gates and lanes have a single source of truth at docs/reference/developing.md.

UI status (unchanged from v0.4.7)

• Web UI remains in maintenance mode as introduced in v0.4.7 — still ships, still runs, no new feature work. CLI/TUI is the primary surface; v0.5.0's TUI (rig / rig tui) is where mission-control investment lands going forward. The UI is not deprecated and not removed; existing deployments continue to work.

Known Issues

• Codex HOME fix not landed in v0.5.0 — a permission-posture fix that ensures the daemon and Codex seats agree on the HOME environment (so the posture writes reach the seat) was accepted for v0.5.0 but was inadvertently omitted from the shipped build. It ships as an early bug-fix in v0.5.1. In the meantime, the v0.4.8 deployment note applies: the daemon's HOME must equal the seat's tmux HOME for the permission-posture writes to reach Codex seats — verify this on any remote-host upgrade.

---

[0.4.8] - 2026-08-05

Status: shipped; permission-posture fast-follow + permission-policy foundation.

Summary For Installing Agents

• Package version: bumps from 0.4.7.
• Migrations: additive only. Existing v0.4.7 databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged.
• Default launch posture changed: from hardcoded --permission-mode acceptEdits to configurable, default dontAsk. If a seat needs the prior behavior, acceptEdits remains selectable; a deliberate bypassPermissions is preserved untouched across writes.

Headline

Permission-posture fast-follow + permission-policy foundation. Launch posture is configurable, the deny set writes at a level project-local approvals can't override, and dangerous operations are gated by explicit prefix rules that actually hold under the current Claude harness. The permission-policy foundation (harness-neutral schema + rig setup --policy flag) lands as the framework the built-in templates + applying-a-permission-policy skill ride on top of in v0.5.0.

Configurable launch posture

• --permission-mode no longer hardcoded — replaced by a configurable posture defaulting to dontAsk. This closes the class of freezes where an autonomous seat could get stuck on a modal permission prompt with nobody to click through it. dontAsk is the default because it matches what an autonomous seat can actually respond to; acceptEdits remains selectable when a seat needs the prior behavior.

Deny set that project-local approvals can't override

• Writes go to user-level ~/.claude/settings.json instead of the project-local approval file — so deny wins over project-local approvals. Writes are additive (never destructive to sibling keys) and forward-migrate a legacy acceptEdits value into the new schema. A deliberate bypassPermissions value is preserved.

Bounded-dangerous deny set

• Four dangerous operations gated by default: git push, gh pr create, npm publish, and rig down.
• rig down gated via the prefix rule Bash(rig down:*) — the current Claude harness (2.1.220) only supports prefix matches on Bash rules, and flag-only patterns provably don't gate target-first forms such as rig down <rig> --force. The prefix rule is the only shape that actually holds. Plain rig down is gated in v0.4.8; selective allowance (e.g. rig down <rig> for a specific target) is deferred to v0.5.0 server-side enforcement.

rig up un-gated

• The prior release's ask-gate on rig up is removed — rig up is a reversible operation and doesn't warrant an interactive gate.

Permission-policy foundation (built-ins land in v0.5.0)

• Harness-neutral policy schema — the permission-policy spec is a harness-neutral surface with default_posture, floor, and allow / ask / deny expressed as semantic actions (push_to_remote, force_push, delete_files, read_secrets, create_pr, publish_package, and so on) rather than raw shell-command patterns.
• rig setup --policy <name> — a new flag on rig setup records a permission-policy choice into an existing rig spec. Takes a built-in name or a path to a custom policy file. The built-in policy files themselves land in v0.5.0; v0.4.8 ships the framework that consumes them.
• Two surfaces: the launch-flag surface (Claude --permission-mode, Codex sandbox / bypass flags, Pi --approve / --no-approve) is stable and OpenRig-set for you — the floor and full-bypass YOLO live here. The config-file surface (Claude ~/.claude/settings.json, Codex config.toml) is where allow/ask/deny rules live; because harness rule grammars change frequently across versions, this surface is applied interactively by an agent-driven skill (that skill ships in v0.5.0 as applying-a-permission-policy).

Deployment Note (operators read this)

• The daemon's HOME must equal the seat's tmux HOME for the posture writes to reach seats. This is a Claude 2.1.220 settings-path invariant that matters for the remote-host leg of any upgrade. Local-only hosts satisfy this automatically; remote-host upgrades should verify HOME parity between the daemon process and the tmux seat process before treating the upgrade as complete. (v0.5.0 documents this as a Known Issue for Codex HOME divergence; the product fix ships in v0.5.1.)

Superseded

• An initial v0.4.8 attempt was withdrawn on final review — it baked dontAsk as a platform default rather than an OpenRig-side default. The shipped v0.4.8 is a re-scoped permission-agnostic base plus a policy-spec system. Nothing from the withdrawn attempt shipped.

---

[0.4.7] - 2026-08-03

Status: shipped; recovery honesty + starter bootstrap + skills wave + Slack connector + UI maintenance-mode milestone.

Summary For Installing Agents

• Package version: bumps from 0.4.6.
• Migrations: additive only. Existing v0.4.6 databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged.
• Rig-spec starter behavior change: rigs instantiated before v0.4.7 need re-instantiation (or spec-level patching) to pick up the starter fixes — the loader and audit changes apply immediately, but starter-spec content lands at instantiation.
• Web UI: frozen in maintenance mode at this release (see below).

Headline

Recovery honesty is the through-line. On a resumed restore, the startup sequence now loads a seat's applicable skill preloads before the role-defining first message — so a resuming seat knows its skills before it starts working. Compaction recovery is honest: transcript ingest exposes degraded states explicitly, and a post-compact restore-and-audit is gated on the seat being idle so "restore-sent" actually means "delivered". Daemon liveness reporting is honest; CLI probes report uncertainty honestly. Alongside recovery, the release lands starter-bootstrap hygiene, a broad skills-inventory wave, a first-class Slack connector, tightened CLI contract honesty, and the UI maintenance-mode milestone (CLI is primary from here forward).

Recovery honesty

• Startup skill-preload ordering — on a resumed restore, applicable skill preloads are loaded before the seat's role-defining first message. The sequencing (not timing) guarantees the "load skills before doing anything" preload arrives first, before the seat starts working from its role.
• Claude transcript ingest — exposes degraded states explicitly so a stale capture no longer looks like a quiet transcript.
• Post-compact restore-and-audit is idle-gated — restore-sent actually means delivered.
• Seat-liveness API — consumers should key seat liveness off the honest lifecycle state (updated every few seconds) rather than the older session-status field, whose staleness cleanup is tracked for a subsequent release.
• Daemon rig ps + daemon-status — report liveness honestly: a dead seat drops effective running to 0 and reports attention_required; rig send and rig capture return an explicit "session missing" error when the seat is gone.
• CLI probes report uncertainty honestly — unconfirmable status returns UNKNOWN with no false start advice; confirmed-stopped fails with actionable guidance.

Starter bootstrap

• Product-team starter bootstrap hygiene — plus a skill-preload for starter seats on both fresh-start and restore.
• Default culture loads at startup — rig specs are audited at load time.
• Rig-spec migration path — rigs instantiated before v0.4.7 need re-instantiation (or spec-level patching) to pick up the starter fixes; loader and audit changes apply immediately, but starter-spec content lands at instantiation.

Skills wave

• Bundled skill layer — gains public routing + a default projection, plus public-skill strip and mirror controls, plus a plugin fix that keeps the documented skill count honest.
• Bundled skill inventory — grows substantially, from a handful to broad coverage across core, PM, pod, and process families.

Slack connector + human queue

• First-class Slack connector — CLI rig slack commands + supporting library. Hosted create crosses an inconclusive local probe to the real configured-daemon result.

CLI contract honesty

• --json errors, flag validation, and scoped overdue behavior tightened for machine-readable use.

UI — moved to maintenance mode (milestone)

• The web UI is frozen at this release in maintenance mode. Wording is CLI-primary — never "deprecated". The UI still ships and still runs; it is no longer receiving new feature work. CLI/TUI is the primary surface going forward.
• What lands in v0.4.7 to make this explicit:
  • A dismissible in-app banner in the web UI announcing the maintenance-mode status.
  • A rig ui open stderr notice at launch time, so operators driving the CLI see the status before they open the browser.
  • Documentation positioning updated across README and user-facing docs.
• Existing v0.4.6 deployments keep working; nothing is removed. The substantive product investment shifts to the CLI and, from v0.5.0, the terminal TUI.

Queue, topology, review polish

• Queue compact-list rows mark elided fields so "omitted" is distinguishable from "empty".
• Nested Approve posts a missions-root-relative scope path.
• Mission review card composition is polished.
• Unverified delivered items read "artifact-recorded" rather than "nothing delivered".
• The drawer file viewer resolves inline in-body images via the file-asset API.
• Proof-of-work Markdown links open in the in-app drawer.
• Docs guard encodes the root-placement rule for docs/DESIGN.md.

Host sizing guidance

• Swap + per-box seat budget — recommended: add swap on the host, and plan for roughly ~2 GB RSS per seat as an observed baseline.

---

[0.4.6] - 2026-07-09

Status: shipped; workflows + multi-host coordination + factory foundations theme. 0.4.5 was skipped (no cut).

Summary For Installing Agents

• Package version: bumps from 0.4.4. 0.4.5 was skipped.
• Migrations: additive only — 049_workflow_instance_version, 050_workflow_spec_json, 051_workflow_resume, 052_workflow_instance_bound_rig, 053_sessions_node_id_index, 054_queue_transitions_archive. Existing v0.4.4 databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged.
• New bundled skills: openrig-herdr and openrig-cmux ship in canonical shared source + bundled openrig-core plugin, byte-parity guarded.

Headline

Workflows + multi-host coordination + factory foundations. OpenRig gains a rock-solid deterministic workflow engine — spec language, CLI, web UI, exception + human-gate model — plus the self-driving factory starter that runs on top of it. Multi-host coordination lands the full happy path: hosts register + select, remote workspaces read, cross-host queue routing, cross-host direct coordination verbs (rig send / rig capture / rig transcript / rig broadcast), and a fleet-attention rollup. Terminal provider first-class treatment and daemon read-path hardening ride alongside; a new Pi agent runtime adapter joins Claude and Codex as a first-class runtime.

The rock-solid deterministic workflow engine

• Migrations: additive only — 049 workflow_instances.version (optimistic concurrency, default 0), 050 workflow_specs.spec_json (full parsed spec at cache time; legacy rows self-heal on next read-through and degrade with a visible advisory until then).
• Behavioral: loop_guards.max_hops is now ENFORCED at projection (exceeding converts the handoff to an honest structured failure — instances that silently looped will now fail loud at the guard); workflow spec validation is STRICT (unknown keys reject at parse; unreachable steps and unguarded cycles fail validation — declare loop_guards.max_hops to sanction a loop); waiting-exit replays are absorbed (exact duplicates return the stored outcome with zero writes); rig workflow continue is relabeled to its real read-only inspector semantics (the wire was always read-only; the label lied).
• New: per-instance workflow-keepalive watchdog jobs auto-arm in the routing transaction and disarm at terminal (deadline-gated: quiet while healthy, stuck-steering nudge when a step is overdue — 4h threshold on the routine-tier SLA); a startup sweep re-arms keepalives, reissues nudges lost to the commit-then-crash window, and surfaces stuck instances.
• Advisories (fail-open): declared-but-unenforced spec keys (invariants.* except allowed_exits, closure.*, gates[], skill_refs, next_hop.mode: prefer, spawn_budget) warn declared_not_enforced_v1 at validation; exit code unchanged.

The full-featured workflow spec language

• The workflow spec DSL the engine parses ships full-featured: step definitions with role/target.rig/preferred_targets, next_hop.on branch semantics, invariants.allowed_exits, loop_guards.max_hops, exception_routing, closure.*, gates[], skill_refs, spawn_budget. Strict-keyset validation at parse (unknown keys reject; unreachable steps + unguarded cycles fail); shipped-spec compat pinned by fixture round-trip. Composes with the workflow-to-rig binding + the exception model.

The workflow CLI

• Migrations: none.
• New verbs: rig workflow run <spec> (instantiate + follow live to a terminal state; exit 0 = completed, exit 3 = workflow failed — distinct from transport 1/2, so run && next-thing is honest) · rig workflow watch <instance> (read-only mid-flight attach; snapshot-first so fast early steps still render exactly once; drops reconnect then degrade to an announced poll fallback) · rig workflow status (the needs-attention rollup: counts + one row per failed/stuck/waiting instance with combined reasons and the next action; proven-empty on a clean fleet) · rig workflow route <instance> --to <session> (re-target the current frontier step: honest handed_off_to closure + successor recreate + frontier rebind in one transaction; the step does NOT advance; the old owner's stale project is structurally rejected with packet_not_on_frontier).
• Behavioral: trace/list/show human output is now formatted (per-step tree, columns, status glyphs, ATTN markers) — --json payloads are byte-identical to before; named daemon rejections render as what/why/fix in human mode (--json keeps the raw body).
• Guard: out-of-band TERMINAL closure of a live workflow-frontier packet (raw rig queue update, Mission Control route/handoff) now rejects with workflow_frontier_packet (HTTP 400) naming the correct workflow verbs. Non-workflow queue items are unaffected. The predicate is injected at startup (the queue layer does not import the workflow domain).
• Events: workflow.routing_table_changed extended additively with {instanceId, stepId, from, to} on route emissions; existing {rigName, cause} consumers unaffected.

The workflow web UI

• New pages + components: WorkflowsPage (workflow catalog + instantiate flow), WorkflowInstancePage (per-instance detail + trail), WorkflowInstancesBand (in-band rollup surface), WorkflowTopologyGraph (visual topology renderer), InstanceTrailTimeline (packet + step trail).
• New hooks: useWorkflow, useWorkflowSse (workflow SSE stream, unscoped by rig — never ?rigId=); workflow events cross-rig aggregate.
• Behavioral: workflow layout math is extracted as pure exports (buildLauncherViews / suggestLayout) for unit tests; permutation-invariant edge-handle assignment (computeStepDepths / assignEdgeHandles); post-merge borderRadius design-compliance fix landed. Twin fixture backfill for these routes is routed as a non-blocking 0.4.7 hygiene fast-follow; UI acceptance is carried by per-cut real screenshots + the two-host integration proof.

The exception + human-gate model

• Migrations: 051_workflow_resume — two additive columns on workflow_instances (resume_count, hops_baseline, both NOT NULL DEFAULT 0; no backfill; behavior byte-identical until the first resume).
• New verb: rig workflow resume <instance> [--decision <text>] — redrive a FAILED instance from its failed step: back to active, rebound, fresh packet to the step's RE-RESOLVED owner (a replaced dead seat receives the redrive — the recorded stale destination is never copied); completed steps never re-run; one fresh max_hops window per resume (hops_baseline); the resolved exception occurrence closes; a repeat failure raises a NEW occurrence-distinct item.
• Exceptions are durable attention items now: an unmapped failed close creates the item IN THE SAME transaction as the failure (no item-less failed window); stuck/overdue instances get their item at sweep/keepalive detection, occurrence-deduped. Items carry plain-language summary, a trace evidence pointer, the resume affordance, and structured tags (workflow:/instance:/step:/exception:/occurrence:) for query-side joins.
• The maturity dial: exception routing is configurable per class / per workflow (exception_routing: in the spec — strict-keyset validated) and per host (rig config set workflow.exception_routing orchestrator|human_only). Default = ORCHESTRATOR-FIRST: the item routes to the workflow's declared orchestrator_role target while the human band shows an AWARENESS row (holder + age — visibility, not a to-do). human_only classes/workflows route human@host first and gate there. No resolvable target = human@host, never lost. Orchestrator-routed items carry an ordinary tier — they never leak into the human attention legs; the shipped attention predicate is unchanged.
• The attention band is workflow-aware: failed/stuck instances with no item render a backstop row naming the missing-item anomaly; a frontier referencing a closed packet renders an anomaly row (the detection twin of the CLI close-path guard); healthy fleets render zero workflow rows.
• Happy-path guarantee unchanged: a healthy run creates zero exception items of any routing and involves no orchestrator — pinned by test and proof.
• Events: additive workflow.resumed ({instanceId, workflowName, stepId, resumedBy, decision, resumeCount}).

Add / select hosts — host registry + dashboard

• Host registry verbs (shipped at 0.4.4) gain the dashboard-side complement: HostConfigCard surfaces each registered host's declared transport, health, and identity; HostIndicator shows the current selection at the operator field of view. New hooks: useHosts, useFleet (registry read + fleet-wide rollup).
• rig host select persists a sticky selection consumed by the observe/interactive verbs (see cross-host coordination verbs, below); durable writes never follow the selection (deliberate asymmetry — see cross-host queue routing, below).

View remote workspace

• A remote host's workspace surfaces are readable from a local operator — the workspace observability tabs shipped at 0.4.1 gain --host <id> scope; the registry + bearer path fans out per-host reads. Read-only for this pass; cross-host writes are the queue-routing and coordination-verb sections below.

Cross-host queue routing

• A queue item can now be sent — and a hot-potato handed off — to a destination on ANOTHER host. rig queue create/handoff/handoff-and-complete gain --host <id> and the host-qualified destination form member@rig@<host> (both resolve to the same out-of-band hostId envelope; the session string stays member@rig). The local daemon forwards the write to the target host's daemon over the host registry + bearer (the shipped mission-control forward-then-strip WRITE, generalized); the qitem lives in the target host's DB and that host's own nudge wakes the destination agent on ITS tmux.
• Explicit-only routing: queue verbs never follow the persisted rig host select selection — a durable write does not silently re-home on a sticky selection (deliberate asymmetry with the observe/interactive verbs).
• At-least-once + idempotent, never exactly-once: the forwarding daemon mints the qitem id before the first forward; a cross-host handoff's successor id is derived deterministically (qitem-xh-…) from (source, destination, host) so retries absorb on the target's primary key. Cross-host handoffs create the successor FIRST and close the local source SECOND (never-drop); the source close records the opaque three-part closure_target=member@rig@<host> (audit metadata, never parsed) and the successor carries the continued chain_of_record (opaque lineage ids on the target). Re-drives absorb on a matching closure_target; a mismatch is a structured cross_host_close_conflict (409).
• Failure honesty: unknown / ssh-declared / unreachable / auth-failed hosts each surface a distinct structured remote_queue_write_failed error naming the host; nothing is written on either side. Transport is http-only (daemon→daemon); the rig send --host ssh shell-out is untouched.
• No migrations. Local (no-host) queue behavior is byte-identical. Claim/update/inbox stay local-by-principle; sender-side ops on a forwarded item are a named follow-up.

Cross-host agent coordination

• The direct coordination verbs now cross hosts — send, observe, coordinate JUST WORK. rig send and rig capture gain an http transport branch: an http-registered host (the kind the shipped rig host pair front door creates) is reached CLI-DIRECT via the shipped runRemoteHttpOp against the remote daemon's EXISTING /api/transport/send|capture routes — zero daemon-side changes; the ssh path stays byte-verbatim for ssh-registered hosts (the host entry's declared transport dictates the path; never a fallback). rig transcript and rig broadcast gain their FIRST cross-host affordance the same way (--host <id>, http-only): transcript reads the remote daemon's tail/grep routes with origin output verbatim; broadcast posts to the remote daemon's own fan-out engine, printing its per-target results verbatim (a partial fan-out exits non-zero, exactly as local) under its own named 30s deadline.
• The agent@rig@host target form is CLI-edge sugar, uniform on the session-target verbs (send/capture/transcript): the suffix is host-qualified IFF it matches a REGISTERED host id, else the target passes through unchanged with a loud host hint on failure (adopted/raw names containing @ keep working — deliberately different from the queue verbs' always-strip rule; both documented side-by-side in cli-reference). Precedence: explicit --host > target sugar > the persisted host selection; a --host-vs-sugar conflict is a structured error. Broadcast's positional is message text (never parsed as a target), so it takes --host/selection only. Every session string that reaches any daemon stays member@rig.
• Failure honesty per branch: the http branch names its own steps (unknown-host / permission-gate / remote-daemon-unreachable / remote-command-failed, with the remote route's own error text surfaced); the ssh branch keeps its shipped taxonomy. send --verify over http prints the REMOTE route's verdict verbatim — never a locally synthesized "Verified: yes". Named terminal-bearer posture: default/tailnet = pass-through; a remote enforcing a different terminal bearer surfaces as the structured permission-gate step (remedy documented; no new auth machinery).
• No migrations. No daemon changes. Local (no-host, no-selection) behavior of all four verbs is byte-identical. Durable cross-host coordination remains the queue; the coordination verbs add no queue surface.

Fleet-attention altitude

• A fleet-altitude attention surface — the attention band gains a fleet-wide altitude rollup (FleetBand + FleetPage): aggregates attention counts across every registered host, per-host status, drill-down to the per-host attention list. Composes with the host registry + the remote-workspace read. New hooks: useFleet, useReviewAgents.

The workflow-to-rig binding layer

• Migrations: 052_workflow_instance_bound_rig — one additive nullable column on workflow_instances (bound_rig TEXT; NULL = unbound = byte-identical prior behavior; no backfill).
• Point a workflow at a rig at INSTANTIATION: rig workflow instantiate|run … --rig <name> overrides the spec's target.rig DEFAULT; the binding persists on the instance (boundRig in --json, rendered by show/trace). Unknown-rig validation splits by provenance: an explicit --rig <unknown> is a hard bound_rig_unknown naming the registered rigs; an unknown spec-default target.rig DEGRADES to unbound with a loud instantiate advisory (surfaced in --json advisories + on stderr) — shipped/example specs that carry a descriptive target.rig and route via preferred_targets (e.g. conveyor) instantiate byte-identically to prior behavior (zero-regression).
• Roles resolve to SEATS by capability: pod members may declare role: <name> (rig.yaml, rig expand fragments, rig add fragments — opt-in per seat; charset-validated; rejected on terminal members; round-trips through export). On a bound instance, a workflow role with no preferred_targets resolves at step-close to a live capable seat on that rig: running agents declaring the role, managed seats only (adopted seats excluded loudly with adopted_seat_not_role_resolvable_v1), harness-pin-aware runtime match, least pending backlog, deterministic coordinate tiebreak. Declared preferred_targets stay the explicit override tier, byte-identical and never liveness-filtered; every previously-shipped spec behaves identically.
• Resolve-once, record-in-the-packet: resolution happens once inside the close+create transaction and records as the packet destination; replays consume the record (zero inventory reads); rig workflow resume re-resolves by design and is now capability-aware. Roles bind to the stable seat coordinate {pod}-{member}@{rig} — an agent handover behind the seat never strands the workflow.
• Honest failures: no live capable seat = structured next_owner_unresolved with per-candidate disqualifiers + fix line; zero-declaring rigs get a named message; instantiate hard-fails only on STRUCTURAL zero-role coverage (bound_rig_role_uncovered) — a declared-but-not-yet-running seat is fine (factory rigs warm up). Never a spawn, never auto-add_member, never a dead-seat route.
• Exception routing rides the binding: the exception model's orchestrator-role position resolves capability-aware on the bound rig (never-lost human@host fallback unchanged).
• Scale-out = add a member under a role (rig add fragments carry role); auto-scale-out is explicitly NOT built.

The self-driving factory starter (factory-rsi)

• New shipped starter: rig up factory-rsi — the single-rig recursive-self-improvement factory MVP. One rig, seven seats (plan-planner, build-implementer, check-qa, review-reviewer, dogfood-tester, release-manager, orch-lead), running the new factory-rsi workflow. A launch-tier product starter (a product-team sibling), workspace-agnostic — point --cwd <repo> at whatever the loop should improve.
• New builtin workflow: factory-rsi — the inner loop plan → implement → qa_check → review → release, with qa_check/review failed → implement (bounded remediation), engine-routed — never an orchestrator relay. Dogfood is decoupled from this gated loop: the dogfood seat runs out-of-band against the shipped product and feeds its findings into the next plan (the RSI edge, ungated — no loop-stop in the MVP; the continuous out-of-band runtime mechanism is refined in a later release). The remediation loops are sanctioned only by the enforceable loop_guards.max_hops; a trip is an exception routed orchestrator-first (exception_routing), and rig workflow resume grants one more bounded window.
• Recorded-state cycles: the next plan's input is the recorded dogfood findings (evidence_ref / the packet trail), never a seat's chat memory — the RSI feedback is durable recorded state.
• Publish stays a human act: the release leg is two steps — release_prep (the release-manager PREPARES notes/docs/PR and records the evidence; un-gated, runs first) hands off to release_signoff, which holds the ship decision at the configured human gate target. Prepared artifacts exist before sign-off; no seat pushes, tags, publishes, or upgrades a host.
• Rides the merged engine, no new machinery: runs on the workflow engine + spec language + exception model as shipped, with the v0 hardcode seam (target.rig: factory-rsi + preferred_targets pin each role 1:1 to a seat) — no binding-layer dependency, no engine change. Runtime config: seats inherit their runtime's default model (no per-seat pin); plan/build/release/orch run on claude-code, and qa/review/dogfood run on codex for cross-runtime diversity against the builder.
• No migrations. No breaking changes.

The member-exists instantiate advisory + cross-rig wrapping workflow

• Mis-routed workflow destinations are caught loudly at instantiate, never silently orphaned. A declared preferred_target that names a rig registered on this daemon but a MEMBER that does not exist (a typo or a stale seat name) now surfaces ONE loud, aggregated advisory on the shipped instantiate advisories list — naming the destination, every declaring step/role pair, the consequence (the work will not be claimed; it will surface as a stuck exception), and the fix hint (rig ps / add the member). Rendered exactly where advisories already render: the route body + CLI stderr. No new surface, no new flag — the shipped target.rig-degrade list simply gains a second producer.
• ADVISORY, never a deny: instantiate always proceeds; the queue transport gate stays rig-exists-only (unchanged). Scope guards: human-seat refs are classified before parse and skipped; raw/adopted (non-canonical) destinations are skipped (legitimate — the inventory cannot vouch for them); an unregistered rig keeps its existing loud transport rejection (no double advisory). Existence is structural — any lifecycle state, any member kind (a declared-but-not-launched seat or an explicitly named terminal member is a legitimate destination; liveness stays a projection-time concern).
• Cross-rig wrapping workflow: workflows declared on one rig may preferred_target a seat on another registered rig; the routing packet travels via the cross-host queue routing path (host-qualified destination form) and lands in the target host's DB. Local-rig-only workflows are byte-identical.
• No migrations. No CLI changes. No breaking changes. Advisory-free specs instantiate byte-identically.

Pi agent runtime adapter

• New runtime adapter: Pi — an agent runtime beyond Claude/Codex, joining the shipped runtime dial as a first-class option in rig specs (runtime: pi) and pod member declarations. The adapter honors the standard runtime contract (identity via rig whoami, startup guidance, hooks, transcript path). Pi runtime seats participate in all workflow / role / queue / send / capture surfaces exactly like Claude/Codex seats.

Terminal provider first-class treatment

• The terminal provider dial gets first-class treatment across the terminal-facing surfaces — the terminal launcher (TerminalLauncher), send/capture/broadcast surfaces, and the new openrig-cmux skill's --provider cmux seam honor a declared terminal provider per member with best-effort fallback. Existing seats using cmux keep their behavior byte-identical; declared-provider seats now route deterministically.

Daemon read-path hardening

• The daemon's read-path is hardened for the multi-host + workflow load — SSE stream backpressure guards, projection caches, and additive indices for read-side query performance. No functional behavior change — reads that returned correct results before return the same results now, faster.
• Migrations: 053_sessions_node_id_index (additive index) + 054_queue_transitions_archive (archive table for read-side query performance). Additive only.

New bundled skills (canonical + plugin, byte-parity guard)

• openrig-herdr — the full rig terminal open/views/status model: verbs, view grammar (rig | pod:<rig>/<pod> | mission:<id> | slice:<id> | saved), honest-partial/degrade reading, read-only policy (rig/pod interactive, mission/slice read-only-by-construction, saved per-member), scroll/copy + never-retroactive-flip honesty, same-size-only duplicate limit, terminal-views.yaml schema. AGPL clean-room rail — no herdr source text vendored. Ships in skills/_canonical/core/openrig-herdr/ + packages/daemon/assets/plugins/openrig-core/skills/openrig-herdr/.
• openrig-cmux — the provider-agnostic vs cmux-specific delta (--provider cmux) with shipped-integration open-or-focus rule, patterns only (no arm's-length constraint pointing at openrig-herdr for the shared model). Ships in skills/_canonical/core/openrig-cmux/ + packages/daemon/assets/plugins/openrig-core/skills/openrig-cmux/.

Known Follow-ons

• Save-verb — did not land in 0.4.6; rides 0.4.7.
• Twin fixture backfill for the new workflow + multi-host UI routes (WorkflowsPage, WorkflowInstancePage, FleetPage, FleetBand, TerminalLauncher, HostConfigCard, HostIndicator, etc.) — non-blocking 0.4.7 hygiene fast-follow; UI acceptance carried by per-cut real screenshots + the two-host integration proof.
• Carry-forwards from 0.4.4: openrig-user bundled plugin stale-copy sweep, whoami --all-hosts silent host filter, managed-stop SIGTERM-escalation brittleness (recurred at 0.4.4 cutover), post-cutover reconcile-settle-visibility signal on /healthz.
• iOS Safari (Living Notes composer verification) — carry-forward from 0.4.4.
• Wider mission-template prose sweep — post-cut sequencing.
• Continuous out-of-band dogfood runtime — the factory-rsi RSI edge ships ungated in the MVP; the continuous mechanism is refined in a later release.

---

[0.4.4] - 2026-07-06

Status: shipped; multi-host + Living Notes theme.

Summary For Installing Agents

• Package version: bumps from 0.4.3.
• Migrations: additive only. Existing v0.4.3 databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged.
• Backward compatibility: rig ps default view flips to a consolidated all-active-rigs compact projection (the v0.4.0 current-rig-only default is retired); progressive-disclosure via --full / -A / --rig <name> returns the v0.4.3 default shape. --json shape unchanged (scope-not-shape). rig host gains three new verbs (add / list / doctor); transport posture documented (no behavior change).

Headline

Multi-host + Living Notes. A shared rig topology can now span multiple hosts with staged whole-topology spin-up, real cross-host file movement, and a consolidated For-You feed that aggregates activity across every registered host. Living Notes ships as the durable INTENT → PLAN → DELIVERED signal layer with a one-structure review contract (single vertical stack, delete-not-demote) and cheap composer surfaces. Operator UX picks up rig ps consolidated default (with progressive disclosure), an agent-altitude coordination panel, and the operationalize-SDLC control plane. As-built docs closeout catches everything up.

The SDLC control plane ships in source (OPR.0.4.4.23 — release requirement)

• Conventions SSOT: docs/reference/sdlc-conventions.md (copied into the assembled CLI package) — the section names the Living Notes UI projects (## Intent / ## Mini-requirements / ## Proof contract), the proof-contract format + plannedRef mockup pairing, the two staged-approval locks, the C1 proof header + closed sets, the three role contracts, the curation rule, the elastic-middle doctrine, and the advisory fail-open audit posture. Once shipped, the repo doc is the living SSOT; the corrective-redesign spec it derives from is the historical design record.
• Scaffold: rig scope slice create emits the convention sections + proof/ + PROOF.md + an IMPLEMENTATION-PRD.md skeleton (elastic-middle note in its header) for EVERY template kind — enumeration-tested, so a future kind fails until covered. Mission templates carry the conventions pointer.
• Advisory audit: rig scope audit (both byte-identical classifier copies) gains missing_intent_section / mini_requirements_missing_or_malformed / proof_contract_missing_or_malformed / ui_slice_missing_mockup (mockup ref = a real image ref or plannedRef token, never bare prose) — low/info severities by construction (the exit code flips on HIGH findings only; records-and-advises, never gates). rig workspace doctor gains check #8 (sdlc_convention_sections, advisory warn) — the 7-check diagnostic is now 8.
• Skill: mission-slice-sop now ships in the canonical product skill source (+ skills/_canonical mirror), updated to teach the full flow: intent → mini-requirements + proof contract → mockups (UI slices) → plan-lock (--scope spec) → build the locked set → QA mockup↔delivered visual compare → rig proof add C1 drops → proof-lock (--scope delivery). The bundled openrig-core plugin's copy is now pinned by a CI byte-parity test. Census (verbatim): before this slice, mission-slice-sop was absent from the canonical shared skill source and skills/_canonical mirror; the bundled plugin carried a stale orphan copy (from c7f501a7) with no guard — that orphan is replaced and parity-guarded. KNOWN residue: the plugin's openrig-user copy remains a wholesale-stale older edition with no mechanical guard (routed as a follow-up candidate, not swept here).
• Bootstrap: the shipped openrig-start.md overlay (the CLAUDE.md/AGENTS.md floor every managed seat sees) + the product-team and pm-team rig-spec cultures point fresh seats at the SOP skill and the SSOT at boot.
• CLI help: rig proof, rig scope slice create, and rig scope slice approve help text teach the flow and cite the SSOT; cli-reference gains the SDLC control-plane verbs section (approve locks, rig proof add, the audit advisories).

rig host verbs + the documented multi-host transport posture (OPR.0.4.4.13)

• New verbs (capped at exactly three): rig host add (registry writes validated by the loader's own rules — no more hand-edited YAML for the standard path), rig host list (config pointers, never secret values), rig host doctor <id> (stepwise distinct errors: transport → remote rig binary → daemon health → identity) with --posture product-factory-vps — the ONE built-in security baseline, three-valued per item (UNKNOWN is never pass).
• Transport posture DECIDED + documented (no behavior change): ssh carries pane ops (send/capture), http-bearer carries daemon REST (up/down/launch), ps/whoami follow the host's declared transport, fan-out is http-only; NO cross-transport fallback; NO http parity for send/capture in 0.4.4. Per-command table in cli-reference §Cross-host execution.
• Product-factory bootstrap: scripts/bootstrap-product-factory-vps.sh (fresh Ubuntu VPS → factory-ready; smoke-tested VPS posture as encoded defaults).

BREAKING: rig ps consolidated all-rigs default + explicit disclosure ladder (OPR.0.4.4.21)

• Default scope flips: bare rig ps now shows every ACTIVE rig on the host as one compact O(rigs) row (the v0.4.0 current-rig-only default is retired — it hid running rigs from the operator's field of view). New display elements: the host rollup line ("N rigs · M seats · K need attention"), the archived/stopped count line, the drill-ladder footer, and an ATTN column (additive attentionCount JSON field).
• --json is scope-not-shape: still a bare array with the existing per-entry keys; scope widens to ALL non-archived rigs INCLUDING stopped ones (only the human table folds stopped rigs into the count line). Scripts that assumed current-rig-only add the existing --rig <name> flag — same schema, wider scope. One-line migration for the old fleet firehose: rig ps --nodes -A --full.
• -A/--all-rigs keeps exactly ONE meaning — the --nodes fleet widener. Bare rig ps -A is now a structured teaching error (all-rigs IS the default; archived history stays behind --include-archived).
• --nodes names its scope everywhere: session default applies locally only; rig ps --host <id> --nodes requires an explicit --rig or -A (implicit scope defaults don't cross host boundaries); multi-host fan-out is rollup-only by default; the full explicit ladder (--all-hosts --nodes -A, --full for complete records) fans out per-node with hostId-stamped projected rows.
• --all-hosts/--hosts --json shape change: emits the intra-P4 shared AggregatedPayload — items (per-host O(rigs) rows stamped with their origin hostId) + hosts (closed-enum per-host statuses: ok | unreachable | unsupported-transport | auth-failed).

Multi-host foundation (OPR.0.4.4.11 + 13 + 15 + 18)

• Shareable whole-topology staged spin-up (S11) — a rig topology can be brought up in stages across multiple hosts; the spec + the daemon coordinate to reach a green whole-fleet state without requiring single-host bring-up.
• VPS product-factory multi-host hardening (S13) — rig host verbs (above) + the documented transport posture harden the fresh-Ubuntu-VPS → factory-ready flow. Product-factory bootstrap script + runbook ship for the smoke-tested VPS posture.
• Multi-host consolidated For-You feed (S15) — the For-You feed aggregates activity across all registered hosts in the topology. Real-host feed-subscription capture is sequenced as a lifecycle-post-publish belt-and-suspenders proof.
• rig file cross-host movement (S18) — files move across registered hosts via the rig file surface. Real registered-host two-host round-trip proves the flow on top of the VM stand-ins already merged.

Living Notes signal layer (OPR.0.4.4.19 + 20 + corrective rebuild)

• Living Notes signal layer (S19) — durable agent-authored notes at mission and slice altitude; INTENT / PLAN / DELIVERED entries thread down the mission tree with agent authorship + timestamps.
• Living Notes composer surfaces (S20) — cheap authoring surfaces make Living Notes the first-class place agents record decisions, plans, and delivered work.
• One-structure review contract §3.1 (corrective rebuild) — the review surface reads left-to-right as a single vertical stack (INTENT above, PLAN + mockup in the middle, DELIVERED with paired proof at the bottom); a plan change deletes the old plan and writes a new one — never demotes / stacks multiple competing plans. Replaced an earlier three-column layout after human review.

Operator UX (OPR.0.4.4.22)

• Agent altitude coordination panel (S22) — a coordination surface scoped to the right altitude (workspace / mission / slice) so the operator sees actual coordination state without drowning in per-seat detail. Composes with the workspace observability tabs shipped at 0.4.1.

Docs closeout (OPR.0.4.4.24)

• As-built docs closeout (S24) — the as-built documentation family (docs/as-built/architecture.md, docs/as-built/cli-reference.md, codemaps) is caught up to what shipped through 0.4.4.

Known Follow-ons

• R2 — iOS-Safari S20 — deferred to 0.4.5 for iOS Safari verification.
• R4 — S18 symlink footgun — routed to the 0.4.5+ backlog.
• openrig-user stale plugin copy + whoami --all-hosts silent host filter — 0.4.5 candidates.
• Wider mission-template prose sweep — post-cut sequencing.
• Belt-and-suspenders real-host proofs (R13-1 / R1 / R3) — published-npm Linux install smoke, real registered-host two-host e2e for S13 + S18, and S15 real-host feed-subscription capture sequenced as post-publish lifecycle validation lanes. Shipped code already proven via VM/SSH stand-ins per PM rulings; real-host lanes are defense-in-depth belt-and-suspenders, not release gates.

---

[0.4.3] - 2026-07-03

Status: shipped; "rigs that survive" theme.

Summary For Installing Agents

• Package version: bumps from 0.4.2.
• Migrations: additive only. 045_resume_verification, 046_seat_identity_verdicts, 047_events_node_type_index. Existing v0.4.2 databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged.
• Backward compatibility: rig send default posture changes — unknown / stale / missing / busy activity signals now advise-and-send instead of default-blocking; only needs_input (a real interactive picker on the target pane) is a hard send-refuse. --dangerously-interact --reason "..." override still available for intentional prompted-seat driving.

Headline

Rigs actually survive. Crash-restore ledger (FR-3 → FR-7) survived a real hard power-off → reboot → rig start: both Claude and Codex seats restored to their original sessions with recalled pre-crash markers, zero fresh-prime. That's the load-bearing "rigs survive" claim, and it's proven at the operating-system level, not just in unit tests.

Survival Backbone

• Crash-restore resume-token ledger (FR-3 → FR-7 + FR-6.1) — capture-on-adoption / snapshot-refresh / restore-target-pin / freshness threshold (1h advisory, --fresh re-verify, FR-6.1 periodic re-stamp) / no-silent-fresh-prime guarantee on the restore path.
• Fixture-home isolation guard — a fresh-prime that would clobber a live rig's home dir is refused loudly.
• Liveness PID-verify — daemon distinguishes a live seat from a dead-PID ghost.
• Daemon event-loop health + terminal broker resilience — health signal exposed; TerminalSessionBroker recovers cleanly across daemon restarts.
• Startup-proof — challenge-verified orientation read; seat can't skip past its orientation material.

The Deny-by-Default rig send Reversal

The 0.4.1 3-layer guard was too strict at the fleet level — unknown / stale / missing / busy all default-blocked, requiring --dangerously-interact for routine coordination. Corrected:

• Only needs_input hard-refuses — that's the actual footgun-point.
• Unknown / stale / missing / busy advise-and-send — peer sends land; operator sees the advisory in output.
• --dangerously-interact --reason override — unchanged for intentional prompted-seat driving.

Also: Codex activity-signal hardening so idle Codex takes normal sends while the genuine prompt block holds; hook-trust autoclear fast-follow for fully-unattended Codex restore.

rig send Unified Targeting

Multi-recipient list + --pod + --rig — reuses broadcast fan-out + per-recipient guard. Backward-compatible.

Wave-2 UI + Theming

• Rig-status + launch-control UI — start / stop / recover a rig from the workspace surface; launch modal for mixed-plan rigs.
• Switch-client view-retarget — a switch-client action lands on the correct target view.
• Dashboard theming (Vellum Dark opt-in) — light = existing :root (byte-identical); dark = first shipped alternate; token-block + registry scales to N. Uses Tailwind darkMode: 'selector'.

Recovery + Seat Lifecycle

• Seat-handover full-cycle — outgoing seat delivers captured context to a fresh successor; resume marker carries via FR-3; loud-unwind on both lanes on failure.
• Seat-forking closeout — fork lifecycle terminates on the shared checkpoint; predecessor + successor named.
• Idle-gate watchdog — idle seat holding a claimable gate qitem is woken with bounded skip-recording.

Hardening + Bug Pile-ins

• Session-admin mutation auth-guard — admin mutation surface no longer reachable without the correct auth posture.
• Secret-boundary B1 hardening (rig auth) — fd-first: open the fd + operate on the fd, never re-resolve the path. Closes the check-then-use gap under interruption / concurrent-legitimate-rig-process scenarios (TOCTOU class closed as a consequence). Leak-hunt regression against the real credential file.
• rig queue show bounded body preview — long qitem bodies truncated in show view; full body inspectable via the queue-item drawer.
• Manual configurable compaction trigger + same-seat guard — Claude Code seats can be compacted from outside the seat; same-seat mutation refused.

Doctrine

• mission-slice-sop skill ships — per-file rules for PROGRESS.md / PROOF.md / MISSION_NOTES.md / MISSION_BRIEF.md / README.md, the SCAFFOLD/POPULATE/PROJECT/VERIFY lifecycle, hot-potato queue handoffs, rig scope audit backstop.

Known Follow-ons

• Slice-04 real-provider handover VM-marker — code proven at runtime; real-provider end-to-end VM-round-trip is a fast-follow proof capture (not a claim gap; the load-bearing survival proof is the crash-restore capstone).
• rig ps consolidated-default + progressive disclosure — captured for 0.4.4.
• Deploy-identity: git SHA via /healthz + rig --version (version-truth-vs-commit-truth observability gap) — captured for 0.4.4 Discovery.
• Managed-hooks-via-requirements.toml — later fast-follow.
• Skill-layer cut depth (slice-25) + dashboard glyph swap (slice-24) — deferred.

---

[0.4.2] - 2026-07-01

Status: shipped; targeted CLI hotfix.

Summary For Installing Agents

• Package version: bumps from 0.4.1.
• Migrations: none — no schema changes ship in 0.4.2.
• Node engines: unchanged.
• Backward compatibility: no CLI surface, daemon, or dependency changes. rig daemon status no longer false-negatives during the daemon's post-start listener-bind window; genuine-down reporting is unchanged.

Fixed

• rig daemon status false-negative after restart — the probe's single /healthz fetch lost to the post-restart HTTP-listener bind window (process up, not yet accepting), causing a false "Daemon not running" / "healthz failed" report even though /healthz was returning 200. Fixed by wrapping the three getDaemonStatus /healthz branches in a status-probe-local bounded settle (max 5 attempts, 200ms backoff, hard-bounded). Genuine-down still fails all attempts and is reported stopped / unhealthy after the budget — never masked, never an unbounded wait.

Scope

• packages/cli/src/daemon-lifecycle.ts — three probe branches now go through probeHealthzWithSettle.
• packages/cli/test/daemon-lifecycle.test.ts — focused probe-layer tests: transient-then-healthy settles to running / healthy; pid-alive-but-never-answers stays healthy: false; genuine-down still reported stopped after the hard-bounded budget.

No dependency, script, config, or behavioral package-field changes beyond the CLI hotfix and version bumps.

---

[0.4.1] - 2026-06-30

Status: shipped; observability + operator-UI overhaul.

Summary For Installing Agents

• Package version: bumps from 0.4.0.
• Migrations: additive only. Migration 044 adds a nullable queue_items.summary column; pre-0.4.1 items degrade cleanly to a body-fallback label. Existing v0.4.0 databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged.
• Backward compatibility: rig send defaults now refuse a send when the target pane is at an interactive prompt or permission block (3-layer guard: L0 default-blocked, L1 --raw still guarded, L2 --dangerously-interact --reason "..." audited override). rig queue create + rig queue handoff gain an optional --summary field with WARN-on-author (does not hard-break existing callers). Cosmetic Project tab renames: Topology → Workflow (test-id stable as project-tab-topology); Queue folds into Story.

Headline

OpenRig v0.4.1 is the workspace-as-mission-cockpit release: a coherent altitude projection (workspace → mission → slice), a Mission Steering landing tab (STEERING.md + MISSION_BRIEF.md), a Story queue-item DAG git-graph that reconstructs what actually happened on a mission, a Workflow spec visualizer, a Proof tab, a Workspace Portfolio panel, an Artifacts navigator, and a Progress heat-map — all derived through a new UI digital twin so visual intent can be approved before any UI slice is built.

New Top-Level CLI Verbs

• rig auth — product-native, CLI-local Codex auth-profile management with a hardened secret boundary (refuses symlinked active auth, hardlink + symlinked-parent escapes out of CODEX_HOME). List / show / switch / capture / forget profiles under ~/.openrig/codex-auth/.

rig send — Interactive-Prompt Guard

• L0 (default) — blocks rig send when the target pane is at an interactive prompt or permission block. Hook-primary (Codex PermissionRequest) with a hardened capture-pane fallback (12-line trailing-content scan + 15-second send-readiness freshness).
• L1 — --raw — exact keystrokes; the L0 guard still applies.
• L2 — --dangerously-interact --reason "..." — explicit override, implies --raw, requires --reason, writes an audit row.

Workspace Observability Surfaces

• Mission Steering tab — landing tab when you click into a mission. Panel 1 projects STEERING.md (what agents are currently being told to do); Panel 2 projects the new mission MISSION_BRIEF.md doctype (the locked 7-section template).
• Mission Brief doc-type + projection — rig scope init-workspace / rig scope mission create emit a root MISSION_BRIEF.md from the 7-section template (Brief / What & why / Building / Progress / Proven / Needs you / Pointers); the Steering tab renders it markdown → UI.
• Story tab — queue-item DAG git-graph — scrollable, upward-growing git-graph derived from chain_of_record + handoff lineage; single-parent edges only (no invented merge state); one-line rows over a curved gutter; Tier-3 drawer with the full agent-speak body + chain. Mission + slice altitudes; client-side from /api/queue (no new surface). Queue tab folds into Story.
• Workflow tab — spec visualizer — finishes the half-built Project Topology tab into a real read-only visualizer of the configured workflow spec (dotted-grid canvas, dark-header step cards, per-step state dot, dagre LR layout, amber reject → rework loop-back). Label rename Topology → Workflow (project-tab-topology id-stable). Mission + slice altitudes.
• Proof tab — per-slice proof galleries + empty-state for scaffolded-but-unpopulated slices; reads from each slice's proof/ directory and an optional PROOF.md summary.
• Progress heat-map — Project Progress tab consolidates to the heat-map (per-slice rollup cards retired).
• Artifacts navigator — slice-altitude ArtifactsNavigator replaces the prior SliceArtifactsTab card wall; resolves via the existing /api/files/* surface; Decisions surface routes through Story (decision-of-record items are Story nodes).
• Workspace portfolio — workspace parent-altitude cross-mission portfolio panel (mission list + steering glance on expand, lazy MISSION_BRIEF.md fetch); rollup metric counts proven (from hasProofPacket) rather than done.

UI Digital Twin + Visual-Intent Convention

• UI digital twin (harness) — a derive-from-source twin renders all six real Project UI surfaces 1:1 daemon-free from typed fixtures (cache-seed + a thin fetch override + a seeded SSE stream; not MSW). One self-contained intent.html per surface; tsc compile-time drift-guard; ~2-step per-slice authoring loop; production-isolated dev-only target. Per-surface build: TWIN_ROUTE=<route> npm run twin:build.
• rig scope intent-visual slot — rig scope slice create scaffolds an ## Intent visual slot in the slice README.md (with [change.diff] + the TWIN_ROUTE=<route> npm run twin:build rebuild command). Non-visual slices get an explicit N/A line.
• Visual intent → proof convention — adopted alongside the harness.

Topology + For-You

• Topology edge-flow animation — when a real queue handoff or rig send travels an edge, the edge animates in the handoff direction, brightens while live, then settles static after TTL. Animates only on a real queue/send signal (no workflow DAG, no ambient motion); reduced-motion omits the flow.
• For-You phone restyle + real-data fidelity — the Dashboard restyle reaches For-You as a phone-friendly cards layout with an altitude-dial level filter (All activity → Highlights → Needs you). The internal source.type wrapper string no longer renders, and the vestigial storytelling-preview band that ignored the level filters is removed.

Reliability + Correctness

• Fresh-install daemon-start fix — @hono/node-ws is now declared in @openrig/cli (the CLI vendors the built daemon and does not depend on @openrig/daemon, so its package.json must mirror the daemon runtime deps for a global install to resolve them). A packaging-completeness gate now fails the test suite if a daemon runtime dep is not mirrored in the CLI.
• Table / hybrid terminal-action reliability — terminal-action errors surface as a visible alert instead of silent failure on the topology Table view + the hybrid surface; the Table terminal now opens cleanly.
• Queue-item human-readable summary — additive nullable summary field on queue items (migration 044). The Story-row label prefers the authored summary and degrades to the body fallback for pre-0.4.1 items. The agent-speak body remains the source of truth and is inspectable in the queue-item drawer.
• Seat-scoped post-compaction restore — Claude Code seats get a scoped, idempotent restore packet derived from the JSONL transcript.
• Table-view crash fix — null-safe TanStack filter + an ErrorBoundary on all three topology Table mounts (host / rig / pod).
• Dashboard route refresh — cosmetic visual overhaul of the welcome / home launcher route (paper-draft launcher grid + six cards + Field Environment).

Conventions Adopted

• Visual intent → proof (the digital-twin convention) — derive-from-source twin (no MSW), one intent.html per surface, twin-data-freshness as the residual release-close check.
• Release-durability close AC-9 — skill-cascade integrity.
• Release-durability close AC-10 — twin-data-freshness.

Known Limitations + Follow-ons

• The skill-layer cut still awaits a decision on the load-bearing set; the cut does not execute in this release. The shipping cascade-drift checker (slice 04.3) is not in this cut.
• Convention drift control (slice 28) is partially delivered (convention ratified + folded into the release-close gate; product skill + audit-code in flight).
• Twin capture tooling (slice 11.2) is in flight; the twin harness ships.
• Workspace UX architecture (slice 15) design-discovery scope is approved; remaining mockups are in flight.
• For-You embedded terminal phone-UX is a non-gating polish check, not yet phone-verified.
• rig send hook-primary PermissionRequest path lands with this release; the fallback capture-pane guard is fully proven; the hook-primary path rides its full proof on the next iteration.
• rig auth deeper structured secret-boundary follow-on is tracked separately, not in this cut.
• Inherited cascade-metadata hygiene from v0.4.0 remains the documented residue; bulk fix is a separate work item.

Carry-Forward From v0.4.0

The v0.4.0 cascade-metadata hygiene findings (missing_provenance + missing_verified on the skill layer) remain the documented residue. Other v0.4.0 known issues (managed-seat Codex hook-trust ID-scrape, resume auto-capture-on-reconcile, post-host-adoption smoke for rig seat clear-attention + Codex resume posture) carry forward to subsequent releases.

---

[0.4.0] - 2026-06-20

Status: wrap-gate CLEAR; lifecycle push / npm publish / tag held for authorization from the project owner.

Summary For Installing Agents

• Package version: bumps from 0.3.4 at the lifecycle wrap step.
• Migrations: additive only; no schema-breaking migrations. Existing v0.3.4 databases upgrade by running rig daemon start.
• Node engines: unchanged.
• Backward compatibility: read-command DEFAULTS change (compact-by-default for rig ps, rig whoami, rig queue list, rig restore-check, rig context); --full returns the v0.3.4 default shapes. rig queue list adopts docker / kubectl-aligned grammar (-a / -A / --full / -o json|wide / --mine / --source / --destination); the prior unscoped firehose default is retired (opt-in via -A -a --full). Existing flag forms continue to work and compose with the new grammar.

Token-Efficient Defaults (headline)

Five read-commands flip from firehose-by-default to compact-by-default — closes a ~225,000-token aggregate context-window cost on aged hosts.

• rig ps — compact TL;DR per node (slice 25); --full for v0.3.4 shape; --rig <name> / --session <sess> filters. Slice 34 breadth default flipped to current-rig (derived from OPENRIG_SESSION_NAME's @<rig> suffix); -A/--all-rigs for fleet breadth; all-states default preserved (topology/readiness signal, unlike queue-list); --full JSON now emits resumeTokenPresent boolean instead of the resume-token value (security fix). Daemon-side payload source-dedup (slice 26): recoveryGuidance no longer duplicated per-node; contextUsage compact in list payload.
• rig whoami — compact identity-recovery essentials by default (~192 tokens vs ~909); --full (alias --verbose) returns v0.3.4 payload. Allowlist projection — future fields default to --full.
• rig queue list — docker / kubectl grammar (slices 28 + 32): -a for history, -A for cross-rig breadth, -o json|wide for encoding, --mine / --source / --destination for scope. Default is active + compact + current-rig.
• rig restore-check — summary counts + not-ready seats only by default (slice 29); --full for complete per-seat detail. Closes the largest measured bomb (~79,000 → low thousands).
• rig context — compact summary by default (slice 30); --full for complete payload.

New Top-Level CLI Verbs and Subcommands

• rig skill audit (slice 10) — read-only audit of the skill cascade. Detects missing / stale / self-referential / invalid-date / mirror-drift across canonical → product mirror → hub cwd → installed plugin. False-green prevention: emits unable-to-audit exit 2 rather than reporting clean when evidence unavailable.
• rig scope mission|slice progress (slice 33) — deterministic PROGRESS.md updates through the command surface rather than hand-edited markdown. rig scope mission|slice create now scaffold PROGRESS.md automatically.
• rig scope mission|slice stage / verified / reconcile (slice 35) — maturity vocabulary from conventions/scope-and-versioning §2 enforced through commands. stage <id> <new-stage> sets stage (wip / provisional / established / canonical / superseded / retired); superseded REQUIRES --successor; invalid stages rejected. verified <id> --against "<source>" stamps verified: <today> against <source>; --against MANDATORY (bare timestamps rejected — the anti-stale keystone). reconcile <id> is the idempotent repair verb (backfills PROGRESS.md + conforms id/stage/verified frontmatter + repairs id-registration ghosts). create now writes mandatory stage (default wip) + a verified placeholder. show derives read-time effective-reliability projection from (stage × verified) — stale-verified canonical reported as effectively provisional. Composes with slice 33 to make rig scope the deterministic convention-enforcer.
• rig seat clear-attention extended to derived projection staleness (slice 16) — reaches the second class of projection staleness (restoreOutcome=failed on a live ready session) that v0.3.4 couldn't.

UI + Topology + Identity

• Real (interactive) terminals (slice 01) — per-seat terminals are interactive; read-only 3-second snapshot view retired for local-host seats. Global LiveTerminalRegistry caps concurrently-live terminals (ui.terminal.max_live_terminals config); LiveTerminalProvider + ProgressiveTerminal interaction model — live where the user is looking, static smoked-glass thumbnails everywhere else; in-place multi-live in the topology grid; shared smoked-glass styling across focused / popover / grid / node-detail.
• Real-terminal session broker (slice 38) — release-critical reliability: a daemon-owned TerminalSessionBroker keyed by canonical sessionName (one tmux pipe-pane per session, N WebSocket subscribers, output fanout, session-level seed + shared scrollback ring, input-owner semantics, honest cleanup). Closes the "second view steals output from the first" failure mode (tmux's one-pipe-pane-per-pane constraint). terminal-ws is now a thin broker subscriber. Resize policy = canonical fixed geometry (120×40); subscribers fit/scroll their container, no per-subscriber tmux resize.
• Unified static/live terminal component (slice 39) — shared StaticTerminalPlate + opaque mirror + static line-return fix + 90×27 mirror geometry (fit-to-container projection of the broker's 120×40 live stream); fontSize-scaling for selection on scaled views (not CSS transform); geometry-comment sweep (behavior-neutral).
• Agent Images library polish (slice 07) — Fork-now + row metadata + nested-failure rendering.
• Attention / activity detection elite tier (slice 09) — richer agentActivity consumption.
• Topology graph-view ghost render fix (slice 21).
• Reliable active/idle node state (slice 18) — DOT→terminalActive fallback; dead pane_silence_flag retired.
• Multi-host dogfood hardening (slice 02).
• Native Codex session-identity capture (slice 11) — foundation for 0.4.1 identity refactor.
• Codex resume preserves approval posture (slice 17).
• Scope-backed progress rails (slice 15).

Bug-Fix Wrap

• Wrap convergence fixes (slice 24) — P1 For-You drill captured/live contract + P2 daemon test-harness WebSocket registration.

Known Limitations / Carry-Forward

• Plugin-lineage drift in openrig-core — the openrig-core plugin skill lineage is divergent/stale; full re-sync is OPR.0.4.1.4 (rides 0.4.1). Boot-path layers (canonical + hub cwd) verified current in wrap-gate AC-3 sweep. rig skill audit (slice 10) is the runtime mechanism for future drift detection.
• All earlier "PUSHED to 0.4.1" carry-forwards from the original wrap-gate were RESTORED to 0.4.0 during the wrap: slice 34 (rig ps current-rig default + -A/--all-rigs + resumeTokenPresent) landed — see Token-Efficient Defaults; slice 35 (rig scope stage/verified/reconcile) landed — see New Top-Level CLI Verbs. Real-terminal-related slices 38 + 39 also shipped via the project owner's live-dogfood forward-fix authorization on 2026-06-21. Nothing of substance carries forward to 0.4.1 from the original wrap-gate set.

What To STOP Using

• Stop using rig ps --nodes --json as the casual status check assuming v0.3.4 shape; compact default IS the casual check.
• Stop using bare rig queue list as the cross-rig firehose; default is now active + current-rig.
• Stop using rig whoami --json for the heavy payload on boot; default is compact.
• Stop using rig restore-check as a per-seat-detail fleet scan; default is summary + not-ready only.
• Stop hand-editing PROGRESS.md markdown; use rig scope ... progress.
• Stop applying the token-efficiency-boot-guardrail pack's CLI-command prohibitions on hosts running 0.4.0 (host-version workarounds; CLI-prohibitions half retires at host-upgrade). The pack's bounded-local-search + scope/over-flag discipline GRADUATE to a standing convention.

Verification

• Wrap worktree clean on 8d55ea60.
• CLI surfaces source-verified against the command modules at the release SHA.
• The historical CLI→skill cascade sweep reported the internal canonical skill source → product mirror at packages/daemon/specs/agents/shared/skills/core/openrig-user/SKILL.md → hub cwd .claude/skills/openrig-user/SKILL.md + .agents/skills/openrig-user/SKILL.md as byte-identical (reported md5 e2aa9176). This records the historical report, not a fresh mirror check.
• cli-reference.md updated for 6 changed commands + new rig skill section; last-verified-against-source bumped to 8d55ea60.
• Stale-pattern grep (dumps everything / --notify required / rig down 404) returned 0 hits across active SKILL.md locations.
• The historical AC-6 self-check evidence was internal and is not a public reproducible receipt.

---

[0.3.4] - 2026-06-15

Status: released. npm @openrig/[email protected] (latest); GitHub Release v0.3.4; git tag v0.3.4.

Summary For Installing Agents

• Package version: package metadata bumped at release-manager step; CLI reports the new version after npm publish.
• Migrations: no new schema-bumping migrations in 0.3.4. Existing databases upgrade by running rig daemon start on the new daemon.
• Node engines: unchanged from 0.3.3 (CLI accepts Node >=20).
• Backward compatibility: existing CLI argument shapes, daemon route paths, RigSpec/AgentSpec schemas, and persisted settings remain backward compatible. New routes are additive (POST /api/rigs/:id/up plan / apply path is the same path 0.3.3 shipped; POST /api/sessions/:session/reconcile is new; POST /api/sessions/:session/clear-attention is new; POST /api/rigs/:rigId/nodes/:nodeRef/launch and POST /api/rigs/:rigId/nodes/launch-subset are new). New CLI commands (rig start, rig reconcile-session, rig seat clear-attention) are additive. rig up flips from fresh-by-default to resume-original-by-default — callers that implicitly relied on fresh-prime as the default must now name --fresh <seats...> explicitly.

rig start — Recovery Entry Point (slice 01)

New top-level command. Sequences existing primitives: daemon-start -> kernel auto-boot wait -> candidate listing -> picker / flags -> per-rig restore (/api/rigs/:id/up) + reconcile:

rig start                            Interactive: daemon + kernel + pick-and-restore
rig start --last                     Headless: restore all rigs that were last running
rig start --all                      Headless: restore all rigs with restore-usable snapshots
rig start --rigs <name> [<name>...]  Headless: restore only the named rigs
rig start --json                     JSON output for agents

• Id-grounded end-to-end: candidate preview and apply both go through POST /api/rigs/:id/up. Same-name rigs surface as separate candidates; selection carries rigId so the name-based /api/up route is never consulted in the recovery path (no ambiguous_name 409).
• Re-codes nothing: same /api/rigs/:id/up that rig up <existing> uses; same five-term vocabulary on the seat-level outcome.

rig up — Resume Original By Default (slice 02)

rig up <existing-rig> resumes original sessions by default. --fresh <seats...> is now the explicit per-seat opt-in for operation B (deliberate fresh-prime):

• Default: seats resume; outcome reports resumed.
• --fresh <logicalId> [<logicalId>...]: deliberate fresh- prime for the named seats; outcome reports fresh-primed.
• awaiting-decision: when the daemon cannot resume and the operator has not opted into fresh. TTY callers get a per-seat [y/N] prompt; headless callers get the explicit hint rig up --existing <source> --fresh <logicalId>. ZERO session started for awaiting-decision seats.
• Backward-incompatible default flip: callers that implicitly depended on fresh-prime as the default must now name --fresh explicitly. The --existing flag (treat <source> as a rig name) is unchanged.

rig reconcile-session — Adopt a Hand-Resumed Session (slice 03)

New top-level command. Adopts a LIVE, hand-resumed canonical session back into its persisted node without launching:

rig reconcile-session <session>
rig reconcile-session <session> --rig <rigId> --node <logicalId>
rig reconcile-session <session> --no-launch
rig reconcile-session <session> --json

• NEVER launches / relaunches / kills / replays startup / presses resume menus / compacts / types into the pane. The only mode this command has; --no-launch is accepted for explicitness.
• Same node id, no re-key: the live process binds back to its OWN persisted node.
• Honest reporting: projection drift is a list of unproven metadata fields; conversation continuity is reported as a status string, never claimed as proven.
• Daemon route: POST /api/sessions/:session/reconcile.

rig up --plan — Read-Only Restore Preview (slice 04)

rig up <existing-rig> --plan [--json]

• No mutation: returns the restore plan only.
• Per-node intendedAction: resume / fresh-prime / awaiting-decision keyed to the five-term vocabulary.
• Snapshot the plan would consume: surfaced in the response so the operator can verify the floor before apply.
• Honest async timeout: when the preview cannot complete within bound, the response says so rather than claiming a clean plan.

Pod-Aware Claude Resume-Selection Menu (slice 05 rev1 BLOCKING)

ClaudeCodeAdapter.verifyResumeLaunch now treats a Claude resume-selection menu the same way it treats the Codex unresolved-gate case (the 0.3.3 slice 21 FR-2 pattern):

• Returns immediately with recovery: attention_required and last-12-line pane evidence on BOTH the inner poll loop and the final-probe exit path.
• ZERO numeric selection keystrokes are ever sent.
• Routes into the existing HarnessLaunchResult -> startup-orchestrator startupStatus: attention_required -> ps / status projection — same path the Codex case uses.

Five-Term Restore Status Vocabulary (slice 06)

The seat-level status on rig up, rig restore, and rig ps is now ONE of:

• resumed — original session continuity proven by the native-resume probe.
• fresh-primed — operator opted into deliberate fresh-prime (operation B); a brand new session started instead of resumed.
• awaiting-decision — daemon could not resume and operator has not opted into fresh. ZERO session started. The honest zero-session state.
• attention_required — seat is live or parked but needs operator action (auth gate, model-selection menu, trust prompt, stuck recovery). NEVER reported as failed.
• failed — the launch transport itself failed.

Replaces the prior 2-3 term collapsed model that hid edge cases. awaiting-decision is new and replaces the prior pattern where zero-session outcomes were either misreported as success or as failure.

Codex Profile-V2 Preflight (slice 07 rev1 BLOCKING)

Profile-load check on profile-bearing launch and restore surfaces, with narrowed legacy-profile detection:

• Legacy detection requires legacy-specific patterns only: contains legacy, [profiles.<name>], cannot be used while.* legacy, legacy profile selector. The prior generic match against failed to load configuration was also catching invalid-TOML stderr and giving the wrong migration hint.
• Invalid TOML surfaces the parse reason: up to 3 stderr lines (e.g. expected newline) with a generic TOML-validity hint instead of a wrong hint pointing at [profiles.<profile>].
• Stale comment in codex-runtime-adapter.ts corrected: absent .config.toml passes (Option B), not fails.

cmux Launch Readiness (slice 08)

Launch path no longer silently produces a partial cmux workspace:

• Honest partial-workspace state: when cmux comes up with a subset of expected windows / panes, the seat surfaces an honest partial state instead of being projected as launched-clean.
• One-click open-missing affordance: UI surfaces the one-click path to open the missing workspace pieces.

Periodic Snapshots (slice 09)

PeriodicSnapshotScheduler ships as the crash-insurance floor under event-driven and teardown snapshots:

• snapshots.periodic.enabled (default true): master switch.
• snapshots.periodic.interval_seconds (default 300): per-rig snapshot interval.
• snapshots.periodic.retention_keep (default 10): per-rig auto-periodic retention count.
• auto-periodic snapshot kind: captured per enabled rig on interval; pruned by retention_keep.
• Restore selector: treats auto-periodic and auto-pre-down symmetrically — the newer wins. A daemon crash between teardown snapshots no longer loses arbitrary lifecycle state.
• rig ps / status: surfaces last-snapshot / floor so the operator can see the crash-insurance floor at a glance.

rig seat clear-attention (slice 10)

New subcommand on rig seat. Evidence-gated, operator-attested, audited reconcile of a stuck attention_required seat back to ready:

rig seat clear-attention <session>
rig seat clear-attention <session> --reason "<operator attestation>"
rig seat clear-attention <session> --json

• Without --reason: clear requires daemon-side evidence the seat is back to a clean state.
• --reason <text>: operator-attestation override of the evidence gate; the attestation string lands in the audit row verbatim.
• Daemon route: POST /api/sessions/:session/clear-attention.
• Output: Cleared <session>: <from> -> ready (<clearedBy>).
• Replaces the hand-edit-SQLite / fake-clear pattern. Node id is unchanged.

Node-Granular Managed Partial Restore (slice 11)

rig launch relaunches a seat or subset by logical id through orchestration:

rig launch <rigId> <nodeRef>                  Single seat
rig launch <rigId> --seats <a,b,c>            Subset (comma-separated)
rig launch <rigId> --seats <a,b> --hold-reason "<text>"
rig launch <rigId> --seats <a,b> --json

• Single target: POST /api/rigs/:rigId/nodes/:nodeRef/launch.
• Subset: POST /api/rigs/:rigId/nodes/launch-subset.
• Partial outcomes never collapsed: launched, held (with reason), alreadyRunning, and failedTargets (liveness unknown) reported separately.
• Retires the v0.3.x-era pod_aware_launch_unsupported dead-end and the "use rig up instead" workaround that lost per-seat control.

Slow Codex Resume Classification (slice 13)

Internal classification tweak in verifyResumeLaunch for slow but genuinely-resuming Codex sessions:

• Previously the slow path mis-categorized through the unresolved-gate branch.
• Now correctly classifies through the five-term vocabulary and reaches resumed when the readiness probe confirms.

What to STOP Using

• rig up <existing-rig> is no longer fresh-by-default. Use --fresh <seats...> for deliberate fresh-prime.
• A live or parked seat is NEVER failed. Use attention_required. The honest zero-session state is awaiting-decision.
• pod_aware_launch_unsupported / "use rig up instead" for per-seat relaunch is RETIRED. Use rig launch <rigId> <nodeRef> or rig launch <rigId> --seats <a,b>.
• Hand-editing SQLite or fake-clearing a stuck attention_required seat is RETIRED. Use rig seat clear-attention <session> (evidence-gated) or rig seat clear-attention <session> --reason "<attestation>" (operator-attested, audited).
• Relying only on event-driven or teardown snapshots for crash safety is RETIRED. The periodic snapshot scheduler is the floor; tune snapshots.periodic.* to taste.
• Classifying invalid TOML as a legacy-profile problem is RETIRED. The Codex profile-v2 preflight surfaces the actual parse reason.
• Restoring a hand-resumed session by relaunching the whole rig is RETIRED. Use rig reconcile-session <session> --no-launch.

Known Limitations / 0.3.4 Carry-forwards

• rig view list/show --json flag inconsistency — wrapper-layer routing path remains; the daemon's view show <name> route returns JSON correctly when invoked directly. Workaround: human-readable output for now.
• docs/DESIGN.md docs-guard ledger — design-doc update ledger carries forward; no runtime impact.
• Slice-21 FR-1 (native Codex session-id hook): scope-tipped to 0.4.0 after build-time forensic. Carried forward from 0.3.3.
• Slice-13 component 3 (auto-rollout dispatcher): skill-layer landing remains; product-code dispatcher / invocation is intentionally out of the shipped runtime bundle. Carried forward from 0.3.3.
• Slice-05 sub-scopes carried forward: agent / port / managed-app collision detection (Item 4.3); broader install-into-existing-rig pathway acceptance (Item 4.4); --target-name CLI flag for install-time rig-name overrides.
• Slice-21 FR-4(d) accepted-queue-state schema: deferred from 0.3.2; carried forward.
• Onboarding journey + battle-hardening: slices 04 (new-user-journey), 08 (hooks-elite), 10 (rig-self), 11 (personal-rig) carried forward to a later release.
• Workspace symlink alignment: daemon-side workspace-resolver alignment with operator symlinked workspace roots remains a follow-up; non-blocking for 0.3.4.
• Slice-13 permission-block-routing-architecture remains held: big-green-light gated by operator review; rigx-experimental only; not split-deferred (stays held).
• 0.3.4 host-upgrade flow held: operators installing v0.3.4 fresh from npm have full access immediately; existing-host upgrade follows the standard daemon-restart flow. The named host-upgrade flow is held for separate sequencing.

Quick Verification Commands

# Confirm CLI version after the release-manager version bump
rig --version

# Confirm daemon starts cleanly (no new migrations to apply in 0.3.4)
rig daemon start

# Confirm rig start surface is wired
rig start --help

# Confirm rig up --plan + --fresh are wired
rig up --help | grep -E "(plan|fresh)"

# Confirm rig reconcile-session is wired
rig reconcile-session --help

# Confirm rig seat clear-attention is wired
rig seat clear-attention --help

# Confirm rig launch supports single-seat + subset relaunch
rig launch --help

# Confirm five-term vocabulary on rig ps
rig ps --help | grep -i attention

---

[0.3.3] - 2026-06-11

Status: released. npm @openrig/[email protected] (latest); GitHub Release v0.3.3; git tag v0.3.3.

Summary For Installing Agents

• Package version: package metadata bumped at release-manager step; CLI reports the new version after npm publish.
• Migrations: one new migration in 0.3.3 — 042_rig_archive (ALTER TABLE rigs ADD COLUMN archived_at TEXT + idx_rigs_archived; append-only, non-destructive, no rigs-row restructure). Existing databases upgrade by running rig daemon start.
• Node engines: unchanged from 0.3.2 (CLI accepts Node >=20).
• Backward compatibility: existing CLI argument shapes, daemon route paths, RigSpec/AgentSpec schemas, and persisted settings remain backward compatible. New routes are additive (/api/rigs/:id/archive, /api/rigs/:id/unarchive, /api/rigs/:rigId/pods/:podNamespace/members). New CLI commands (rig archive, rig unarchive, rig add / rig add-member) are additive. New rig ps, summary, and rig up flags (--include-archived, ?includeArchived=true, ?archived=only) are additive and default to existing exclude-archived behavior.

Large Startup-File Transport (slice 16)

TmuxAdapter.sendText no longer caps at the OS MAX_ARG_STRLEN limit:

• Payloads over 100KB are written to a unique temp file (Node fs, never shell-embedded), loaded into a unique tmux buffer, and pasted with paste-buffer -d -r. -r preserves raw LF so multi-line packs do not early-submit on every newline; -d drops the buffer on successful paste. The single trailing C-m stays the caller's separate sendKeys(["C-m"]).
• Payloads under 100KB keep the exact inline tmux send-keys -t <t> -l <text> command (behavior-preserving).
• Cleanup: temp file unlinked in finally; explicit delete-buffer on paste-error path; unique temp + buffer names per call so parallel rig up seats do not collide.
• Backward-compatible constructor: optional second arg supplies the file/buffer ops (default wires Node fs + os.tmpdir); new TmuxAdapter(exec) is unchanged.

send_text Inline Dash Sentinel (slice 17)

Inline tmux send-keys -t <t> -l <text> now carries a -- end-of-options sentinel:

• Any small send_text startup payload whose content begins with - (notably --- YAML frontmatter — the norm for per-seat packs) is no longer parsed by tmux as flags.
• Inert for non-dash content.
• The slice-16 large/buffer path is already immune (content travels via a file, never argv) and is untouched.

cmux 0.64.x Compatibility (slice 18)

surface.list normalizer resolves the surface handle across cmux 0.64.x AND 0.63.x:

• cmux 0.64.x renamed the surface identifier: list-panels --json rows carry ref with no id (0.63.x carried id). Result: surfaceId came back undefined and cmux-transport never mapped surface.sendText -> cmux send, throwing "Unknown cmux method: surface.sendText" (HTTP 500 build_workspace_failed).
• New normalizeSurfaceRow resolves the handle from ref ?? surface_ref ?? surface_id ?? id, normalizing every row regardless of array key (panels / pane_surfaces / surfaces).
• One resolution order serves both versions — no version-negotiation shim. Mirrors the existing normalizeWorkspaceRow and create/split handle patterns.

rig archive Affordance (slice 19)

New top-level commands and a non-destructive archive lifecycle:

rig archive <rigId> [--force] [--json]
rig unarchive <rigId> [--json]

• Non-destructive: rig row preserved; archived_at set; rig.archived event fires. unarchive clears archived_at and fires rig.unarchived.
• Default reads exclude archived: rig ps, /api/rigs/summary, /api/rigs, /api/ps. Opt-in via rig ps --include-archived / ?includeArchived=true / ?archived=only. rig ps marks archived rows with * and renders a legend; the flag propagates through cross-host argv.
• rig up archived-name refusal (AC-7): a name matching ONLY an archived rig is refused with a 3-part error pointing at rig unarchive; --json emits rig_archived. Never silently restores.
• --force on archive: required when a rig is running or degraded; surfaces a 3-part fact / consequence / action error without it (AC-6).
• UI: lazy collapsible "Archive" section under the localhost host node, fed by useArchivedRigs (separate query against /api/rigs/summary?archived=only), not by client-side filtering. rig.archived / rig.unarchived events drive global query invalidation (["rigs","summary"] + ["rigs","summary","archived"] + ["ps"] + ["nodes", rigId] when present) so a CLI archive reactively refreshes other mounted UIs.
• Migration 042_rig_archive: ALTER TABLE rigs ADD COLUMN archived_at TEXT + idx_rigs_archived. Append-only; mirrors the 023_stream_items precedent.

rig add / rig add-member (slice 24)

New top-level command for the add_member converge op:

rig add <rigId> <podNamespace> <member-fragment-path> \
    [--json] [--rig-root <root>]

• Member fragment: YAML or JSON; tolerates a bare member or a { member } wrapper; uses the spec snake_case field names (id, runtime, agent_ref, profile, cwd, ...).
• Daemon route: POST /api/rigs/:rigId/pods/:podNamespace/members. Outcome -> HTTP: rig_not_found / pod_not_found -> 404, member_conflict -> 409, validation_failed / preflight_failed -> 400, success -> 201. Per-node launch status (launched / failed / attention_required) rides in the 201 body.
• MCP tool: rig_add ships in lockstep.
• Honest edge validation: non-array edges is REJECTED (CLI prints error + exits 1; route returns 400 validation_failed; domain returns validation_failed as defense in depth). Edge kind is validated against the canonical VALID_EDGE_KINDS set exported from rigspec-schema.ts and reused (not duplicated). Edges still carry NO runtime behavior (the edge-runtime fence holds).
• Built on the topology-converge spine: Op union + differ + convergeOp scaffold (AC-6); rig add is imperative CLI sugar over the converge interface, not a bypass.

rig down Accepts Name-or-Id (slice 22)

rig down <name> now works:

• /api/rigs/summary?includeArchived=true is fetched; id-match across ALL rigs (archived ids still reach teardown); name-match ACTIVE rigs only.
• Same-name active+archived pair resolves the ACTIVE rig (not ambiguous).
• Archived-only name does not resolve by name (use the id, or rig unarchive first).
• The packaged openrig-user skill is corrected across specs source + assets/plugins copy + _canonical mirror; the down.ts resolver comment is corrected. The historical v0.3.1 and v0.3.2 CHANGELOG entries and release notes are left intact (the bug genuinely existed at those releases).

Honest Codex Restore Gate (slice 21 FR-2)

verifyResumeLaunch no longer returns ok:true unless the native-resume-probe proves the seat actually resumed:

• Unresolved operator-action gates (update that cannot auto-dismiss, trust, model-selection) and a bounded poll that never reaches resumed return ok:false with recovery: attention_required plus last-12-line pane evidence.
• Routes into existing projection: HarnessLaunchResult -> startup-orchestrator startupStatus: attention_required -> ps / status projection. Same path the Codex auth-refusal case already shipped; no new state machinery.
• Auto-dismiss preserved: a skippable update gate still auto-dismisses and continues to success; only UNRESOLVED gates fail loudly. The readiness loop (checkReady) stays the SECOND check that upgrades the seat to ready once it genuinely reaches the TUI.
• Carry-forward: FR-1 (native Codex session-id hook) scope- tipped to 0.4.0 after build-time forensic; FR-2 ships alone in 0.3.3.

rig send --verify Honest Delivery Outcomes (slice 99.0.6.3)

The three outcomes are now named in the response:

• delivered: ok:true + post-capture re-confirmed the snippet (the prior Verified: yes).
• rendered-unconfirmed: text + Enter both succeeded but the capture could not re-confirm (redraw race, or the capture threw). LANDED, NOT failure. Exit stays clean.
• failed: the transport itself failed (send_failed / submit_failed carry outcome: "failed"; HTTP mapping unchanged).

The legacy Verified: yes/no line is preserved verbatim (parsers); a new Delivery: line carries the named outcome plus, for rendered-unconfirmed, a rig capture <session> confirmation pointer. --json carries outcome through. Mid-work / wait-for-idle REFUSALS deliberately carry no outcome (nothing was sent).

rig whoami Peers Contract (slice 99.0.6.1)

peers[] is this rig's roster EXCLUDING self. It is NOT a directionally-edged subset, and it is NOT host inventory.

• WhoamiResult.peersNote (required string, additive) carries the contract in-band, naming the three pointers: peers[] (roster), edges{} (directional graph), rig ps --nodes (inventory including self + live state).
• CLI Peers header: keeps the literal Peers: prefix verbatim (shipped parsers grep on it), then adds the in-band clarifier.
• No new field: peers[] name and shape are unchanged; no roster / podRoster field is added (peers[] already IS the roster).

Workflow Instantiate By Name (slice 04.1)

rig workflow instantiate <built-in-name> (e.g. conveyor, basic-loop) now resolves end-to-end:

• WorkflowRuntime.instantiate resolves the identifier against the seeded spec cache BY NAME first via the new WorkflowSpecCache.resolveSourcePathByName, falling back to literal-sourcePath only when no named spec matches.
• The cache returns the STORED path verbatim — no source-tree re-derivation — so the dist/builtins production layout stays safe.
• Diagnostic rows are excluded via version != '' (valid specs always carry a version) so resolution needs no dependency on the slice-11 status column / migration.

Guided Golden Path State Clarity (slice 04.2)

The new-operator golden path now points at the correct discovery verb:

• rig workflow specs lists built-in / seeded workflow specs ((built-in) tagged). USE THIS to discover names before rig workflow instantiate <name>.
• rig workflow list lists workflow INSTANCES; empty for a fresh operator.

Corrected in docs/reference/getting-started.md and in the CLI's setup golden-path text (goldenPathNextSteps() step 4).

For-You Manage-By-Exception (slice 20)

Feed-interaction UX on existing signals only (the 0.4.0 attention-detection layer is untouched):

• Drill-to-terminal: new FeedCardTerminalDrill in the card footer opens the resolved source/author session's terminal PREVIEW via GET /api/sessions/:sessionName/preview, reusing TerminalPreviewPopover over the same externally-owned-trigger event contract TopologyTerminalView uses. Session-NAME keyed ONLY. Honest framing — "terminal preview" / "captured snapshot, not live"; disabled with an honest title when no session resolves.
• Decision-band sort: feed-classifier exports sortFeedByDecisionBand — a stable two-band partition (action-required + approval above progress / observation / shipped) using the existing newest-first comparator within each band. Applied at the single Feed.tsx merge-consumption seam. Not a ranking engine.
• One-click approve (approve-only): VerbActions gains an additive oneClickVerbs prop. APPROVE submits directly on click; deny/route stay select+confirm. Defense in depth: prop type narrowed to Array<Extract<MissionControlVerb, "approve">> so misuse is a compile error, and a runtime ONE_CLICK_SAFE_VERBS = {"approve"} allowlist rejects cast-forced "deny" / "route". Reuses the same performSubmit path (identical optimistic receipt and held-error behavior).

CLI Release-Surface Parser (slice 13.1)

Deterministic TypeScript Compiler API extractor that walks Commander registrations in packages/cli/src/commands/*.ts at two git refs and emits a structured release-surface-diff:

• Resolves both Commander idioms (chained inline subcommands and factory indirection through addCommand(buildChildCommand())).
• Emits the REGISTRATION name (rig-policy.ts surfaces as policy); option name-tokens taken from .option() arg[0] only so template-literal descriptions never drop an option.
• Reads batched via one git cat-file --batch per ref (fast, offline, deterministic).
• 3-part honest failure shape; never a silent empty diff.
• NOT registered as a rig verb at 0.3.3 — the module is product code with hermetic test fixtures (including a v0.3.1..v0.3.2 worked example checked in at src/release-surface/release-surface-diff.v0.3.1-v0.3.2.yaml).

Skill <-> CLI-Surface Binding Index (slice 13.2)

Deterministic offline lookup that joins a release surface-diff to "which skills are affected by this release":

• Composes with the slice 13.1 parser; invocation-agnostic.
• Implements the ratified join grammar: component-wise prefix match in either direction (so up does not match update); conservative over-include bias for the no-false-negative floor.
• Drops --version from the binding index (the canonical grammar is command paths only, not global flags); the skill body still documents rig --version as prose.
• Ships with the v0.3.2-affected-skills regression fixture derived from the corpus.

Known Limitations / 0.3.4+ Deferrals

• Slice-21 FR-1 (native Codex session-id hook): scope-tipped to 0.4.0 after build-time forensic.
• Slice-13 component 3 (auto-rollout dispatcher): skill-layer landing for this release; product-code dispatcher / invocation is intentionally out of the shipped runtime bundle. 13.1 parser + 13.2 binding index ARE shipped product code.
• Slice-05 sub-scopes carried forward: agent / port / managed-app collision detection (Item 4.3); broader install- into-existing-rig pathway acceptance (Item 4.4); --target-name CLI flag for install-time rig-name overrides.
• Slice-21 FR-4(d) accepted-queue-state schema: deferred from 0.3.2; carried forward.
• Onboarding journey + battle-hardening: slices 04 (new-user-journey), 08 (hooks-elite), 10 (rig-self), 11 (personal-rig) carried forward to a later release.
• Workspace symlink alignment: daemon-side workspace-resolver alignment with operator symlinked workspace roots remains a follow-up; non-blocking for 0.3.3.
• Slice-13 permission-block-routing-architecture remains held: big-green-light gated by operator review; rigx-experimental only; not split-deferred (stays held).
• rig view list/show --json flag inconsistency — wrapper- layer routing path remains; the daemon's view show <name> route returns JSON correctly when invoked directly. Workaround: human-readable output for now.

Quick Verification Commands

# Confirm CLI version after the release-manager version bump
rig --version

# Confirm daemon starts and migration 042 applies
rig daemon start

# Confirm rig archive surface is wired
rig archive --help
rig unarchive --help

# Confirm rig add surface is wired
rig add --help

# Confirm rig down accepts name-or-id
rig down --help

# Confirm rig workflow specs lists built-ins
rig workflow specs

# Confirm rig send --verify carries the delivery outcome
rig send --help | grep -i verify

# Confirm rig whoami peers contract is stated in-band
rig whoami --json | jq '.peersNote'

---

[0.3.2] - 2026-06-02

Status: released. npm @openrig/[email protected] (latest); GitHub Release v0.3.2; git tag v0.3.2.

Summary For Installing Agents

• Package version: package metadata bumped at release-manager step; CLI reports the new version after npm publish.
• Migrations: one new migration in 0.3.2 — 041_rig_policy (CREATE TABLE for the operator-context-mode bindings store; no impact on existing data; binding rows are operator-authored at runtime). Existing databases upgrade by running rig daemon start.
• Node engines: unchanged from 0.3.1 (CLI accepts Node >=20).
• Backward compatibility: existing CLI argument shapes, daemon route paths, RigSpec/AgentSpec schemas, and persisted settings remain backward compatible. New routes are additive. New CLI commands (rig policy, rig scope, rig workspace doctor) are additive. New rig queue create flags (--body-file, --mission, --slice) are additive.

Rigbundles First-Class

rig bundle ships cross-primitive bundling end-to-end:

• Five content kinds routed: skills + plugins (hybrid) + workflow_specs + context_packs + agent_images. Each kind lands in its canonical library under $OPENRIG_HOME; consumer-scan visibility preserved.
• bundle.yaml author manifests auto-detected when present. Vendoring uses both-sides path containment + symlink-escape protection + integrity hashing in the manifest.
• rig bundle create new flags: --notes <text>, --min-daemon-version <ver>, --min-cli-version <ver> — operator notes captured in bundle provenance metadata; min-version gates power the install-time compatibility check.
• rig bundle install new flags: --skip-version-check (operator- explicit override of the install-time compatibility check), --force (operator-explicit override of the install-time conflict check). NOT recommended for routine use; provided for known-good operator scenarios.
• rig bundle history — new subcommand reading ~/.openrig/bundle-audit.jsonl with optional --rig / --since filters.
• Install timeout bumped — the prior 5-second cap was too short for tmux-session-bootstrapping installs.

Workspace + Workflow GA

Operator-facing surface hardened:

• rig workspace validate --max-files — strict-int regex enforced; out-of-range values produce a 3-part error before client.post.
• rig workflow project --exit — enum guard against handoff | waiting | done | failed.
• 14 new discriminator tests on validator paths.

rig up <starter> Paper-Cut Fix-Round

Four bounded fixes unblocking the homepage quick-start on fresh 0.3.1→0.3.2 installs:

• HTTP 4xx surface for pre-launch failures: cycle_error, preflight_failed, validation_failed, service_boot_failed — replaces bare 500.
• No orphan rig record on pre-launch failure: instantiator re-ordered + rollback path + compose teardown order tightened.
• Path-form rig up <install-internal-spec> defaults cwd: closes the divergence between path-form and bare-form invocation; library specs now match path-form behavior.
• walkYamlFiles skip standard noise dirs: .worktrees, node_modules, .git, dist, .turbo, .next. Plus stale workflow_specs rows prune at startup with an install-root preservation guard (shipped built-in specs survive the prune).

Coordination + First-User Setup Fix-Round (slice 21)

Five bounded follow-rounds:

• FR-1 — Coordination-model boot instinct: rig send vs rig queue vs rig queue handoff + §1b doctrine surfaced in core/openrig-user/SKILL.md.
• FR-2 — First-user workspace + workflow setup teaching: skill
  • docs content for the path from fresh install to first workflow_spec authoring.
• FR-3 — MISSION_NOTES durable-pattern hardening: convention codemap + auto-scaffold via rig scope mission create (uses conventions/mission-notes/TEMPLATE.md); --no-mission-notes opts out.
• FR-4 — Queue ergonomics:
  • rig queue create --body-file <path> (use - for stdin) kills the backtick-shell-corruption class for multiline bodies. Mutually exclusive with --body.
  • First-class --mission <id> / --slice <id> flags translate to mission:<id> / slice:<id> tags (compose with --tags).
  • lastNudgeResult wording fix; closure-vs-acceptance docs.
• FR-5 — rig workspace doctor: 7-check workspace-readiness diagnostic (workspace root, missions folder, file allowlist, daemon alignment, daemon reload, optional slice docs, MISSION_NOTES presence). Default exit-code: non-zero only on fail; --strict makes warn-or-fail non-zero. CLI overlays OPENRIG_FILES_ALLOWLIST from operator's shell env.

Daemon Test Substrate-Path Scrub (slice 14)

Internal-team substrate path shape scrubbed from 4 daemon source sites + 10 test files. Hook-constants de-duplicated. Privacy class closed for tracked source + test surface.

ConceptCard Data Source (slice 17)

ConceptCard wired to shaped backlog candidates; storytelling-adapter completion deferred from 0.3.1 is now complete.

For-You Priority Windowing (slice 20)

Server-side attention query (Option 3): SQL predicate pushdown + exact-match attention regex + dismissal as string-keyed for queue-derived cards.

Operator Context-Mode Bindings (slice 09)

New rig policy command surface paired with daemon-side typed-primitive store (migration 041_rig_policy):

• Six modes: sleep | desk | mobile | away | focus | debug.
• Four scopes: global_host | rig | workstream | qitem.
• Restate-and-confirm posture (HG-4): set is restate-only until --confirm is passed; scripts cannot silently apply a binding.
• --qualifier strict reject for global_host (HG-7 guard finding): operators who type --scope global_host --qualifier <id> get an error and the daemon is never contacted.
• Operator-edit verbs require bearer token: set --confirm and unset require --bearer <token> (or OPENRIG_AUTH_BEARER_TOKEN env).
• 6 subcommands: set, show, effective, cite, unset, defaults.

Scope Tree Primitive (slice 12)

New rig scope command for operating the substrate scope tree (missions, slices, sub-slices) per conventions/scope-and-versioning:

• Mission tier: ls, show, create (auto-mints stable dot-IDs into mission frontmatter; auto-scaffolds MISSION_NOTES by default; --template auto-selects release when name matches release-X.Y.Z).
• Slice tier: ls, show, create, ship, close, move.
• Templates ship under dist/lib/scope-templates/: release- feature, placeholder, mission-notes, bug-fix, research, backlog-deprecation, backlog-tech-debt, mission-placeholder, mission-release.
• Top-level option --workspace <path> overrides workspace root (otherwise inferred from cwd or $OPENRIG_WORK_ROOT).

Known Limitations / 0.3.3 Deferrals

• Slice-05 Item-3 sub-scopes deferred to 0.3.3: agent/port/managed-app collision detection (Item 4.3); broader install-into-existing-rig pathway acceptance (Item 4.4); the --target-name CLI flag. Design-contingent on the CLI surface decision.
• Slice-21 FR-4(d) accepted-queue-state schema deferred to 0.3.3: the new accepted queue state is a schema model change; carried forward per the release-triage philosophy.
• Onboarding journey + battle-hardening deferred to 0.3.3: slices 04 (new-user-journey), 08 (hooks-elite), 10 (rig-self), 11 (personal-rig) physically moved to the release-0.3.3 mission tree.
• Workspace symlink alignment: daemon-side workspace-resolver alignment with operator symlinked workspace roots is a follow-up from slice-21 FR-5 QA; non-blocking for 0.3.2.
• Slice-13 permission-block-routing-architecture remains held: big-green-light gated by operator review; rigx-experimental only; not split-deferred to 0.3.3 (stays held).
• rig down <name> still returns HTTP 404 at v0.3.2; use rig down <rigId> --delete instead.
• rig view list/show --json flag inconsistency — wrapper-layer routing path remains; daemon's view show <name> route returns JSON correctly when invoked directly. Workaround: human-readable output for now.

---

[0.3.1] - 2026-05-15

Status: released. npm @openrig/[email protected] (latest); GitHub Release v0.3.1; git tag v0.3.1.

Summary For Installing Agents

• Package version: package metadata bumped at release-manager step; CLI reports the new version after npm publish.
• Migrations: no schema-breaking migrations in 0.3.1. Existing databases upgrade by running rig daemon start.
• Node engines: unchanged from 0.3.0 (CLI accepts Node >=20).
• Backward compatibility: existing CLI argument shapes, daemon route paths, RigSpec/AgentSpec schemas, and persisted settings remain backward compatible. New routes are additive. New ConfigStore keys are opt-in default-off.

Claude Auto-Compaction Policy

The headline 0.3.1 feature: operator-configurable Claude session auto-compaction with safe defaults.

• Opt-in default-off: with no policy configured, no behavior change. The daemon never sends an auto-/compact until the operator explicitly enables the policy.
• 7 new ConfigStore keys in the policies.claude_compaction.* namespace (lockstep across CLI VALID_KEYS + daemon SETTINGS_VALID_KEYS): enabled, threshold_percent (strict integer 1-100), compact_instruction (default empty; appended to /compact slash-command args when set), message_inline, message_file_path, pre_compact_instruction, post_restore_audit_instruction. Strict validation across all source layers (set/POST/env/file) — invalid env values fall back to defaults with a warning to stderr rather than silently coercing.
• 5 operator-editable prompt surfaces rendered in the Settings → Policies UI form: pre-compaction prep, compact instruction, post-compaction restore (inline), restore file path, post-restore audit. Daemon-owned wrappers (usage/threshold framing, trust-channel preservation, marker paths, read-depth enforcement, turn-boundary handshake, dedup + cooldown) are non-editable.
• 6-stage daemon-to-LLM lifecycle:
  1. Pre-compact prep prompt — full-context Claude writes a mental-model restore map (annotated ASCII file/folder tree) before compaction ("save game before quit").
  2. /compact with operator instructions + trust-channel preservation embedded in args.
  3. Post-compact turn-boundary handshake — non-restorative acknowledgment creates an assistant-turn boundary so the subsequent restore prompt lands in the correct trust context.
  4. Restore prompt — explicit user-request shape; defense-in-depth fallback chain (marker → JSONL transcript path → session-id → generic).
  5. Compliance prompt — forces FULL/PARTIAL/NOT_READ read-depth audit table; counters Claude's deferred-execution + token-conservation instincts.
  6. Cooldown (10-minute default) — prevents re-fire while restore work is still consuming context.
• PreCompact hook + SessionStart/UserPromptSubmit bridge: the openrig-core plugin ships a marker-bridge that picks up pending-restore markers post-compaction and injects restore directives once. Templates live in the claude-compaction-restore skill and ship with the plugin.
• Safety hardening: SessionTransport classifies typed prompt drafts as attention state — auto-/compact retries later instead of overwriting human input. Send-failure does not advance dedup state (transient retry). Re-arm requires threshold-crossing (session must drop below threshold before next auto-compact).

Library Explorer Finishing

The Library destination (skills + plugins + specs) became a fully operator-facing surface:

• No duplicate top-level entries: > SKILLS and > PLUGINS rows removed from the top of SpecsTreeView. Bottom-row clicks now do dual-action (navigate to the matching index page + expand the tree).
• Reorder: Plugins above Skills.
• OpenRig-managed skills discovery: 32 shared skills now visible in the tree + on /specs/skills index. Previously the workspace-relative path lookup returned empty in production VM environments.
• Daemon-owned library discovery API (new):
  • GET /api/skills/library → consolidated LibrarySkillPublic[] (workspace + openrig-managed sources; absolute paths not leaked).
  • GET /api/skills/:id/files/list?path=<rel> + /api/skills/:id/files/read?path=<rel> — skill folder browse + content read.
  • GET /api/plugins/:id/files/list?path=<rel> + /api/plugins/:id/files/read?path=<rel> — plugin folder browse + content read.
  • PluginEntry.skillCount field added to plugin discovery serialization.
• Real file-browser docs-browser on plugin and skill detail pages: detail pages mount a DirectoryTree + FileContentPanel against the real plugin/skill folder. Markdown auto-renders; non-markdown files (e.g. .ts, .json) render as text. Folder navigation works (entering subfolders + listing files).
• Rolled-up index pages: /specs/skills lists all skills as flat rows with source label + file count + entry link. /specs/plugins lists all plugins as rows with version + runtimes + skill-count + entry link.

Plugin Primitive v0

• Plugin discovery: vendored plugins under $OPENRIG_HOME/plugins/ (default ~/.openrig/plugins/) are discovered, validated, and surfaced through rig plugin list + /api/plugins.
• Plugin install (v0): explicit operator copy or symlink to $OPENRIG_HOME/plugins/<plugin-id>/. A rig plugin install <substrate-path> verb is deferred to 0.3.2; see OPENRIG-INSTALL.md inside each plugin's source for the documented copy/symlink workflow.
• CLI: rig plugin list / show / used-by / validate subcommands available. No install subcommand at v0.
• Plugins shipped as substrate references (for plugin authors to copy-install): gstack (45 skills), obra-superpowers (14 skills). openrig-core ships bundled with the daemon (11 skills).

Settings Destination Explorer

Settings became a 4-item Explorer destination matching Topology / Project / Library / For-You pattern:

• /settings (general config keys form), /settings/policies, /settings/log, /settings/status.
• Old top-row tab nav removed.
• Shared SettingsPageShell chrome across all 4 sub-routes.
• Policies page is the home for the Claude auto-compaction policy form (see above).

CMUX Launcher

• Launch in CMUX button on the rig-scope topology tab-bar trailing slot. Opens a cmux workspace for the rig with appropriate title + cwd parameters. Powered by new daemon route + cmux adapter extensions.

Node-Page Overview + Details

• Seat overview table consolidated as 7-column horizontal layout with vertical grid lines (Claude/Codex agent + status + context + tokens + uptime + cwd + current-work).
• Tab consolidation + activity alignment on the node-detail surface.
• Alert-only notification banner (renders only on real-alert states: failed, attention_required, or latestError !== null); generic recoveryGuidance no longer triggers a banner on every seat.
• cwd / current-work separation: factored into a SeatOverviewSecondary primitive below the column table.

Mobile Drawer Behavior

The Explorer drawer at 375px viewports now layers above the mobile rail tray for Settings / Project / Library / For-You destinations (previously hidden behind rail-tray; visible click path didn't register on Explorer items). Topology mobile drawer is intentionally hidden in 0.3.1 (clicking the hamburger triggered a pre-existing TopologyTableView renderer cascade); the topology mobile drawer is scheduled for full restoration in 0.3.2 via a dedicated TopologyTableView render-path slice.

Dashboard And For You Visual Refresh

The Dashboard (/) and For You (/for-you) destinations got a coordinated visual refresh to a "vellum" surface language — translucent stone-tinted cards over a paper-grid background, ambient multi-stop shadow, mono+dot kind indicators, and L-shaped corner-bracket registration marks. The chrome vocabulary is consistent across destination cards (Dashboard) and both feed-card systems (For You).

• Dashboard — full rewrite of / into a thin composition over new dashboard/vellum/ primitives (BackVellumSheet, MidLayerContent, TopLayerContent, DestinationsLayer, VellumDestinationCard, CornerBracket, graphics.tsx, marks.tsx). Hero typography ("WELCOME BACK") at display-lg + headline-bold; tactical instrument-panel stats line with tabular numerals and a success-token active count. Six destination cards (Topology / Project / For You / Library / Search / Settings) share the same numeral-layout treatment. Real-data hooks thread through (useRigSummary, usePsEntries, useSpecLibrary, window.location.hostname).
• For You — both card systems unified to the same vellum recipe:
  • Storytelling band: CardShell rewritten to bg-stone-100/45 + backdrop-blur-[10px] + ambient shadow + corner brackets; design-token leading dots replace prior bg-emerald-50 / bg-amber-50 / etc. off-brand utilities. Title at 16px headline-bold; body at 12px.
  • Queue-item FeedCard.tsx: same outer chrome; KIND_DOT + TONE_DOT design-token maps; vellum bordered-no-fill action buttons (Approve/Deny/Route/Hold/Drop/Annotate/Handoff) with hover-invert and 44px touch targets; TONE_RECEIPT strip is a subtle bg-stone-50/40 with a leading colored dot.
• Single source of truth — /dashboard and /lab/vellum-lab both import from packages/ui/src/components/dashboard/vellum/index.js. Future visual changes hit one location.
• Lab routes — /lab/card-previews, /lab/vellum-lab, /lab/vellum-bg/{a-large,b-small,c-allover} are checked-in experiment surfaces for designer iteration. Reachable in production by direct URL; not linked from main nav. Useful when iterating on the visual system.

For You Storytelling Adapter

The storytelling band (top of /for-you) now wires four card kinds to real data:

• Progress — from useMissionDiscovery (first 2 active missions)
• Shipped — from useSlices (status = shipped/complete/done; capped at 3)
• Incident — from useSlices (status = blocked/failed/danger or fallback "info"; capped at 3)
• Approval — from useActivityFeed + classifyFeed (kind === "approval"; capped at 2; qitemId extracted from event payload with snake_case alt and FeedCard.id fallback). Surfaces real queue items waiting on approval in a high-visibility band.

ConceptCard component is preserved in source but not emitted by the production adapter — a deliberate data-source decision is scheduled for 0.3.2.

Action Outcome And Inline Error Surface

Queue-item action buttons (VerbActions — Approve/Deny/Route/Hold/Drop/ Annotate/Handoff) now render outcomes immediately and surface failures without silently reverting:

• Optimistic outcome — on mutation success, the ActionOutcomePanel ("Approved by X" / "Routed by X to Y") renders immediately. Audit-log roundtrip reconciles in background. Operator no longer waits for a query refetch to see what happened.
• Inline error surface — on mutation error, a tertiary-bordered error block renders below the verb buttons with the daemon's error message; verb-selection state is preserved so the operator can correct and retry. Replaces the prior silent-revert UX where errors were never displayed.
• React-query callback discipline — submit() split into separate onSuccess (optimistic outcome + reset selection) and onError (set error message; do NOT reset). Regression test guards the silent-revert class explicitly.

Vendored Skill Provenance

Vendored skills shipped in packages/daemon/specs/agents/shared/skills/ now declare their upstream lineage via metadata.openrig frontmatter and (when modifications exist) a companion OPENRIG.md sidecar:

• vendoring_pattern: vendored-as-is | modify-the-file | add-supplementary-files
• vendored_from: upstream source identifier
• last_upstream_check: most recent diff date
• divergence_notes: human-readable summary of OpenRig-specific changes

Applied to all 10 process-skill surfaces (agent-browser, executing-plans, brainstorming, systematic-debugging, test-driven-development, using-superpowers, verification-before-completion, writing-plans, frontend-design, dogfood). OPENRIG.md sidecars added where the file has been modified or supplemented (agent-browser + executing-plans + brainstorming + using-superpowers + writing-plans). Convention is documented in the writing-skills-for-openrig skill.

Plugins And Skills On The VM (Operator Note)

Operators dogfood-testing 0.3.1 should expect:

• Stock VM install: only openrig-core plugin is bundled. The /specs/plugins UI list will show one plugin until the operator installs additional plugins per the v0 copy workflow.
• Skills: 32 OpenRig-managed shared skills ship under packages/daemon/specs/agents/shared/skills/ (discovered via the daemon skill-library API; no operator action required).
• User-installed skills: skills the operator installs under ~/.openrig/skills/ or the workspace .openrig/skills/ directory surface in the same list.

Config + Settings

Continues from 0.3.0 with the slice 08 validation pass:

• rig config get/set/reset/list remains the canonical CLI surface.
• Lockstep CLI VALID_KEYS + daemon SETTINGS_VALID_KEYS byte-identical sets (verified in slice 08).
• Help-drift CI gate from slice 08 honored across all new keys added in 0.3.1.

SC-29 Exceptions

The SC-29 exception process tracks explicit scope expansions to release contracts. Exceptions declared in 0.3.1:

• #10 (slice 24): cmux launcher — POST /api/rigs/:rigId/cmux/launch
  • CmuxLayoutService + 4 CmuxAdapter RPC methods.
• #10 (slice 27, numbering collision): Claude auto-compaction policy — 7 policies.claude_compaction.* ConfigStore keys. (Numbering collision with #10 above is a process-only inconsistency; both code scopes are correctly merged. Canonical SC29-LEDGER.md and ledger hygiene scheduled for 0.3.2.)
• #11 (slice 28): Library Explorer daemon API — 5 new daemon GET endpoints (/api/skills/library, /api/skills/:id/files/list, /api/skills/:id/files/read, /api/plugins/:id/files/list, /api/plugins/:id/files/read) + 2 response shape additions (PluginEntry.skillCount, LibrarySkillPublic).

Known Carry-Forwards (0.3.2 Candidates)

• rig plugin install <substrate-path> verb: explicitly deferred. Documented copy/symlink workflow is the v0 install path.
• Topology mobile drawer: hidden in 0.3.1 to avoid a pre-existing TopologyTableView renderer cascade at 375px viewports. Full restoration scheduled for 0.3.2 via dedicated render-path slice.
• Plugin source-label taxonomy: copy-installed plugins currently land in the vendored source kind; UI label says "No user-installed plugins" while listing them. Taxonomy refinement scheduled for 0.3.2.
• SC29-LEDGER.md: canonical SC-29 numbering ledger document. Authors currently self-assign exception numbers; documented ledger prevents collisions like the slice 24/27 #10.
• VM PreCompact hook installer: the documented install path for the claude-compaction-restore skill is operator-manual at v0; an automated installer is a 0.3.2 candidate.
• docs/DESIGN.md docs-guard violation: pre-existing npm run test:repo failure; tracked doc outside allowed paths; cleanup scheduled for 0.3.2 documentation hygiene pass.
• Environment-dependent tests: a small number of vitest suites fail on developer hosts due to port-conflicts (preflight) or live host Claude hook state (restore-check); focused-test gates pass these suites; cumulative-workspace runs surface the gaps. Isolation cleanup scheduled for 0.3.2.
• Cross-daemon route awareness: the VerbActions destination dropdown on /for-you currently lists session names without checking whether the local daemon can reach them. Routing to a non-local destination surfaces as an inline error (per the new error surface above) but the dropdown should ideally filter to local-daemon seats. 0.3.2 candidate.
• ConceptCard data source: ConceptCard component is preserved in source but not wired in the production adapter. A 0.3.2 slice will pick a deliberate data source (likely shaped backlog candidates or early-stage discovery items).
• Warm error messages on demo surfaces: daemon error strings (e.g., "queue item not found") surface verbatim through the inline error surface. Demo-grade polish to humanize these on user-facing surfaces is scheduled for 0.3.2.

Banked Discipline Patterns

0.3.1 surfaced a number of canonical agent-software-design patterns during the Claude compaction iteration cycle and Library Explorer finishing work. These are banked in operator-skill documentation for agent-prompt design + daemon-to-LLM trust establishment:

• Channel model: normal user message is the only authorized action surface; hook stdout is informational-only; /compact args carry trust contracts that the post-compact prompt invokes.
• Turn-boundary handshake: when a daemon-driven action request would land too adjacent to local-command output, insert a non-committing acknowledgment message first to create an assistant-turn boundary.
• Save-game-before-quit pattern: full-context agent writes restoration breadcrumb before forced context loss; context-loss agent reads it on restore.
• Structured-output forces completeness: ask LLMs for explicit FULL/PARTIAL/NOT_READ accounting when thoroughness matters; counters token-conservation instincts.
• Daemon-owned shared-resource discovery: skill/plugin discovery belongs at the daemon layer with HTTP endpoint surfaces; UI consumes via typed API. Avoids workspace-cwd-relative path-resolution brittleness.

Quick Verification Commands

# Confirm CLI version after the release-manager version bump
rig --version

# Confirm daemon starts cleanly
rig daemon start

# Confirm new Claude compaction policy keys are visible
rig config list | grep policies.claude_compaction

# Confirm plugins discoverable
rig plugin list

# Confirm skills discoverable
curl -s http://localhost:7433/api/skills/library | jq 'length'

---

[0.3.0] - 2026-05-10

Status: release candidate for public publish. This entry documents the changes since 0.2.0.

Summary For Installing Agents

• Package version: package metadata is still 0.2.0 until the release manager performs the final version bump. The release contents documented here are the intended 0.3.0 payload.
• Migrations: fresh databases apply migrations through 039_queue_target_repo. Existing databases migrate by running rig daemon start.
• Node engines: the published CLI accepts Node >=20. The root package and private daemon package remain constrained to active even-numbered Node lines.
• Specs and primitives: workflow specs, context packs, agent images, workspace scaffolds, file browsing, queue observability, context usage, and runtime skill discovery are all first-class product surfaces.
• UI shell: the operator UI has been rebuilt around the V1 shell: destination rail, explorer, center workspace, detail drawer, vellum surfaces, topology graph/table/terminal modes, and focused project observability.
• Starter content: 0.3.0 ships generic starter workflows and starter rigs. Project-specific automation recipes are intentionally not shipped in product source.
• No schema-breaking release change: existing CLI argument shapes, daemon route paths, RigSpec/AgentSpec schemas, and persisted settings remain backward compatible unless noted below.

Quick Verification Commands

# Confirm CLI version after the release-manager version bump
rig --version

# Confirm daemon starts and migrations apply
OPENRIG_DB=/tmp/openrig-030-verify.sqlite rig daemon start

# Confirm settings are readable
rig config list --with-source

# Confirm starter specs are visible
rig specs ls --json

# Confirm runtime identity and loaded context
rig whoami --json

If any verification fails, see "Failure Modes And Remediation" below.

---

V1 Shell And Operator UI

The 0.3.0 UI moves from prototype surfaces to a coherent operator shell:

• Two desktop chrome regions: destination rail and explorer.
• Center workspace for full pages.
• Default-closed detail drawer for previews and referenced content.
• Topology graph/table/terminal modes at a single topology URL.
• Settings rendered as a center workspace page, not as a sidebar panel.
• Vellum surface primitives, 1px region borders, and black-glass terminal preview styling.
• Shared runtime graphics marks for agent/runtime/tool identity.
• Retired legacy surfaces: old sidebar shell, legacy dashboard page, and rig-detail drawer patterns.

Starter Rigs And Workflows

OpenRig now ships starter content designed to be useful on a fresh install without exposing project-specific automation recipes.

• product-team is the primary human-directed starter rig.
• conveyor is the primary workflow-oriented starter rig.
• conveyor includes two generic workflow specs:
  • Conveyor: each stage can process queued work independently, so multiple packets can be in flight at once and natural queue backpressure handles slow stages.
  • Basic loop: one packet advances hop-by-hop around a small loop, useful when the operator wants a slower, easier-to-watch workflow.
• Generic starter workflows use the workflow runtime and queue primitives. They are examples and building blocks, not a hidden project workflow.
• Project-specific workflow specs can still be installed from a user workspace or private spec directory; they do not need to be committed to product source.

Mission-Shaped Workspace Defaults

Fresh installs now have a coherent default workspace path and scaffold:

• rig config init-workspace creates the default workspace structure.
• Workspace defaults include missions, slices, specs, proof/evidence locations, steering files, and user-editable docs.
• Existing installs are rebased at read time so newer defaults become available without destructive rewrites.
• Read-only mission/slice indexing supports nested mission-shaped workspaces while preserving compatibility with earlier flat-root layouts.

Project Observability

Project and queue work is now easier to inspect from the UI:

• For You cards classify queue lifecycle events, shipped work, progress, observations, and approvals.
• Queue cards hydrate qitem bodies and proof previews.
• Story tabs emphasize qitem body content and paginate long activity streams.
• Queue rows preview bodies and open the detail drawer with full source, destination, state, tags, and created-time metadata.
• Tests tabs show diagnostics and proof assets when no proof is available.
• Workspace and mission rollup pages include scoped Progress, Artifacts, Queue, and Topology tabs.
• Current/archive grouping separates active project work from old seed or completed work.

Mission Control And Queue Actions

Mission Control remains the operator surface for queue observability and qitem actions:

• Views include personal queue, human gate, fleet, active work, recent ships, recent activity, and recent observations.
• Actions include approve, deny, route, annotate, hold, drop, and handoff.
• Mission Control audit outcomes are reflected back into For You cards so terminal or already-actioned items show evidence instead of stale controls.
• Audit browsing and action history are read-only inspection surfaces.
• Existing daemon endpoints are reused; no extra workflow-specific endpoint is required for the public starter content.

Files, Markdown, Progress, And Proofs

The file and proof surfaces were expanded:

• File browser supports allowlisted roots, safe reads, asset reads, and conflict-checked writes.
• Markdown rendering supports frontmatter, code blocks, tables, images, and raw/rendered toggles.
• Progress views render status pills, hierarchy, and next-work markers.
• Proof screenshots open in an in-page viewer.
• File drawer headers, proof rows, queue related refs, and story rows use shared graphics marks for faster scanning.

Workflow Runtime And Spec Library

Workflow primitives are available as general infrastructure:

• Workflow specs are cached from markdown/YAML sources.
• Workflow instances and step trails are persisted.
• Specs library includes workflow entries and graph preview.
• Slice and project story surfaces can render spec-aware topology when a slice is bound to a workflow instance.
• Cycle-aware traversal prevents graph rendering from hanging on looping specs.

Context Packs And Agent Images

OpenRig now has additional reusable primitives for context and session state:

• context_packs package related context files into a coherent sendable bundle.
• agent_images capture reusable starter state from productive sessions.
• Library review surfaces can inspect these primitives and show safe summaries.
• AgentSpec startup can reference context packs and agent images.
• Resume-token data is redacted at route boundaries.

Topology, Activity, And Context Usage

Topology is now a working operational surface rather than a static diagram:

• Graph/table/terminal views are available at the topology route.
• Host graphs can show multiple rigs on one canvas.
• Rig groups can expand/collapse, persist that state, and auto-expand for current rig/pod/seat URLs.
• Agent activity, queue handoffs, token telemetry, and context usage are visible in topology views.
• Codex context telemetry is read from local session state and reflected in topology table and terminal views when available.
• Detached Codex sessions can still expose the last readable context sample; Claude context remains running-session based.

Terminal Preview

Terminal preview matured across several passes:

• Preview panes use existing session capture primitives.
• Compact terminal popovers are portal-mounted, clamp to viewport edges, and resize/reposition on scroll or viewport changes.
• The compact view strips unnecessary chrome and uses a black-glass visual language.
• The proof viewer and terminal preview share consistent drawer/popover behavior.

Runtime Skill Discovery

Runtime skill discovery is now part of profile resolution:

• Rig-local skill references still win first.
• Skills can be discovered from runtime-specific and shared user skill roots.
• Structurally invalid SKILL.md files are rejected with precise reasons.
• Profile resolution surfaces rejected-skill reasons instead of treating every broken skill as merely missing.
• The behavior is intentionally strict: a skill must have frontmatter, non-empty name, non-empty description, and non-empty body content.

CLI And Daemon Release Hardening

Several release-blocking polish items landed in the CLI/daemon:

• Transcript capture now uses bounded tmux capture-pane polling instead of an unbounded pipe file.
• rig send wraps delivered messages with sender/recipient context and a reply hint.
• Generated setup markers use OpenRig naming.
• Original runtime environment aliases keep deprecated RIGGED_* fallbacks for compatibility; newer typed settings use OPENRIG_* only.
• ConfigStore and SettingsStore remain lockstep for typed settings.
• No new plugin loader ships in 0.3.0; plugin support is planned for a later release.

Removed Or Not Included

• Project-specific workflow recipes are not included in product source.
• The old demo rig is no longer the recommended starter; public docs point to product-team and conveyor.
• The legacy mental-model-ha skill is removed from starter guidance.
• Root runtime projections such as CLAUDE.md are intentionally not tracked.
• Package-local pnpm-lock.yaml files are intentionally not restored; this repo uses npm workspaces and the root package-lock.json for release installs.
• Internal release artifacts and local dogfood packets are not part of the public release notes.

---

Failure Modes And Remediation

rig daemon start fails with an ABI mismatch

• Cause: native dependencies were compiled against a different Node version.
• Remediation: use an active even-numbered Node release, or rebuild native dependencies from the installed package directory.

Files browser or Progress view appears empty on a fresh install

• Cause: workspace scaffold has not been initialized or the configured root is not where the operator expects.
• Remediation: run rig config init-workspace, then inspect rig config list --with-source.

Mission Control views are empty

• Expected on a rig with no queue items.
• Remediation: create or hand off a queue item, then refresh. If still empty, confirm daemon status and DB path with rig daemon status and rig config get db.path.

A skill reference resolves as rejected

• Cause: the target SKILL.md exists but failed structural validation.
• Remediation: fix the skill frontmatter and body. It must include delimited YAML frontmatter with non-empty name and description, followed by non-empty markdown body content.

A public starter workflow is too simple for a specialized loop

• Expected. 0.3.0 ships reusable primitives and generic starter workflows. Specialized workflow specs should live in user workspace or private rig packages.

---

[0.2.0] - 2026-04-22

Baseline for this changelog. Key shipped capabilities at 0.2.0:

• Pod-aware multi-agent runtime with RigSpec, AgentSpec, pods, and seats.
• Rig-scoped environment management.
• Filesystem-backed spec library for built-in and user roots.
• Daemon-backed stream, queue, project, view, watchdog, and workflow primitives.
• Cross-runtime restore packets for Claude Code and Codex sessions.
• Communication primitives: rig send, rig capture, rig broadcast, durable rig chat, and transcript inspection.
• Identity and lifecycle commands: rig whoami, adoption/bind/materialize flows, snapshot/restore, and post-command handoff.
• Operator surfaces: rig ps, rig ps --nodes, queue inspection, and daemon status.
• 32 SQLite migrations.

---

This changelog is written for agents and humans. It should describe public release behavior without depending on local workspace paths or private project packets.