release: prepare v0.4.2 — version bump, changelog, and release notes

Author: ChesterRa

CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project are documented in this file.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/), and versions follow SemVer/PEP 440.
 
+## [0.4.2] — 2026-02-22
+
+### Added
+- **IM key-based chat authorization**: dynamic bind-key authentication for IM bridges, replacing static trust with per-chat cryptographic binding. Includes `/bind` command, auto-subscribe on successful bind, pending approval management, and revoke semantics.
+- **`cccc_im_bind` MCP tool**: programmatic chat authorization via the MCP surface.
+- **Authorized chats Web UI**: view/manage bound IM chats and pending bind approvals from Settings → IM Bridge tab.
+- **Bind key UI**: generate and display bind keys for chat authorization directly from Web settings.
+- **Actor profiles system**: profile linking across daemon, Web, and MCP — including profile runtime, persistent store, and a dedicated Actor Profiles settings tab.
+- **Remote access control plane**: remote daemon access with hardened IM revoke semantics for secure multi-node operation.
+- **Telegram typing indicators**: typing action support with configurable throttling for more natural conversational UX.
+- **IM authentication IPC documentation**: new standards doc covering IM auth IPC methods.
+
+### Changed
+- **IM display names**: prefer actor titles over raw actor IDs in IM-rendered messages for better readability.
+- **Modal UX refinements**: extracted modal close handlers and adjusted inbox modal height for cleaner interaction.
+
+### Fixed
+- Fixed MCP message send incorrectly collapsing `None` recipients to empty list, breaking broadcast semantics.
+- Fixed `authorized_at` timestamp handling in IM Web UI.
+- Fixed IM KeyManager state not reloading from disk on each inbound poll, causing stale authorization data.
+- Fixed docs incorrectly requiring post-bind `/subscribe` step (now handled automatically).
+
 ## [0.4.1] — 2026-02-20
 
 ### Added

docs/release/index.md

@@ -2,6 +2,7 @@
 
 Current stable line:
 
+- [v0.4.2 Release Notes](./v0.4.2_release_notes)
 - [v0.4.1 Release Notes](./v0.4.1_release_notes)
 - [v0.4.0 Release Notes](./v0.4.0_release_notes)
 

docs/release/v0.4.2_release_notes.md

@@ -0,0 +1,66 @@
+# CCCC v0.4.2 Release Notes
+
+`v0.4.2` advances the IM integration and operator-facing control surfaces.
+It ships key-based IM chat authorization, a reusable actor profiles system, and a remote access control plane — all with matching Web/MCP/CLI coverage.
+
+## Highlights
+
+## 1) Key-based IM chat authorization
+
+IM bridges now authenticate chats through a **cryptographic bind-key flow** instead of static trust.
+Operators generate a one-time bind key in the Web UI, share it with the target IM chat, and the bridge verifies identity before granting access.
+
+Key capabilities:
+
+- `/bind <key>` command in supported IM platforms (Telegram first)
+- automatic subscription on successful bind (no separate `/subscribe` step)
+- **pending approval management**: operators can review and approve/deny bind requests from the Web Settings → IM Bridge tab
+- **revoke semantics**: authorized chats can be revoked at any time, with immediate effect on message routing
+- `cccc_im_bind` MCP tool for programmatic binding from automation workflows
+
+## 2) Actor profiles
+
+A new **actor profile** abstraction lets operators attach reusable identity metadata (display name, avatar, prompt preamble, model preferences) to actors.
+
+Profiles are linked at actor creation or update and propagate across:
+
+- daemon runtime (used for display in IM bridges and Web)
+- Web UI (dedicated **Actor Profiles** settings tab for CRUD operations)
+- MCP surface (profile query and assignment tools)
+
+## 3) Remote access control plane
+
+A new **remote access** layer allows authorized clients to interact with a CCCC daemon across network boundaries.
+Combined with hardened IM revoke semantics, this enables secure multi-node orchestration without exposing the daemon socket directly.
+
+## 4) Telegram UX improvements
+
+- **Typing indicators**: the bridge now sends typing actions with configurable throttling, giving collaborators visual feedback during agent processing.
+- **Actor titles over IDs**: IM-rendered messages now prefer human-readable actor titles instead of raw actor identifiers.
+
+## 5) MCP and operational fixes
+
+- **Recipient semantics fix**: `None` (broadcast) vs `[]` (no recipients) distinction is now correctly preserved in MCP message send, preventing unintended broadcast or silent drops.
+- **IM KeyManager reload**: authorization state is reloaded from disk on each inbound poll, eliminating stale-cache authorization failures after daemon restarts.
+- **Timestamp handling**: `authorized_at` timestamps in the IM Web UI are now correctly parsed and displayed.
+
+## Validation Summary
+
+Release preparation checks:
+
+- `pytest -q` -> all tests passed (including new test suites for actor profiles, IM auth, remote access, and chat ops)
+- `npm --prefix web run typecheck` -> pass
+- `npm --prefix web run build` -> pass
+- `npm --prefix docs run build` -> pass
+
+## Upgrade Notes
+
+From `v0.4.1`, this is a drop-in minor upgrade.
+No migration procedure is required — profile and IM auth state stores are created on first use.
+
+Recommended post-upgrade checks:
+
+1. restart daemon/web once to ensure clean runtime state
+2. verify IM bridge authorization by generating a bind key and testing the `/bind` flow in a test chat
+3. confirm actor profiles appear correctly in Web Settings → Actor Profiles tab
+4. if using remote access, verify connectivity and revoke semantics from the Remote Access settings tab

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cccc-pair"
-version = "0.4.1"
+version = "0.4.2"
 description = "Global multi-agent delivery kernel with working groups, scopes, and an append-only collaboration ledger"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.9"