v0.13.0

What's Changed

• Clarify the Tasks view and make live-log and inline edits safer by @danieljhkim in #1043
• Add routine and sweep-clock operations to the dashboard by @danieljhkim in #1045
• Keep dashboard workspace, window, and actor scope consistent across diagnostics views by @danieljhkim in #1046
• Diagnose the doc-duties EROFS blocker and make sandbox write denials attributable in the task record by @danieljhkim in #1047
• Make dashboard failure metrics incident-aware instead of counting repeated events as independent failures by @danieljhkim in #1048
• Add auto-task inspection, toggle, and manual mint controls to the dashboard by @danieljhkim in #1049
• Add delivery highlights and honest, accessible semantics to the Scoreboard by @danieljhkim in #1050
• Replace hardcoded family-specific crews in shipped jobs and auto-tasks with per-machine resolution by @danieljhkim in #1044
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #1051
• Reconcile MCP tool advertisement with capability enforcement for operator-only tools by @danieljhkim in #1052
• Extract orbit-types as a pure leaf and reorganize orbit-common by @danieljhkim in #1053
• Extract orbit-config from orbit-core by @danieljhkim in #1054
• Make orbit-core directional across application, runtime, and adapters by @danieljhkim in #1055
• Make orbit-store directional across contracts, drivers, repositories, and workflows by @danieljhkim in #1056
• Add task complexity as a dashboard dimension: completion by complexity, and duration faceted by it by @danieljhkim in #1057
• Canonicalize audit actor identity: split role into actor_kind + normalized actor by @danieljhkim in #1058
• Require task complexity at creation across all entry points by @danieljhkim in #1059
• Fix role-split aggregate: count and surface columns use different denominators by @danieljhkim in #1060
• orbit-web auto-task authorization tests race on ORBIT_OPERATOR in managed runs by @danieljhkim in #1061
• Record self-reported actor identity for unauthenticated MCP calls by @danieljhkim in #1062
• completion-by-complexity unset bucket is unreachable after complexity became required at create by @danieljhkim in #1063
• [auto-task] Remediate current GitHub Actions failures by @danieljhkim in #1064
• Spawned CLI-runner agents don't get ORBIT_ROOT injected, and their PATH never backfills ~/.cargo/bin by @danieljhkim in #1065
• probe_bwrap-gated Linux sandbox tests report PASS instead of SKIP when bwrap is unavailable by @danieljhkim in #1066
• system_crew:true marker never reaches the dispatched activity input by @danieljhkim in #1067
• Document root cause of 10-21x token-total disagreement between worker run store and orbit invocations by @danieljhkim in #1068
• Document the /tmp scratch-root pattern for orbit init/workspace init in the executor sandbox by @danieljhkim in #1070
• No attributable diagnostic when the executor sandbox's read-only Orbit-state mount causes an EROFS write failure by @danieljhkim in #1071
• check-error-translation.sh has no rg-availability guard, unlike its sibling guardrail scripts by @danieljhkim in #1069
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #1072
• Redact command arguments before persisting coordination audit records by @danieljhkim in #1073
• ORB-10908 EROFS diagnostic misses the task-lock-file open, the actual first write on a read-only task dir by @danieljhkim in #1074
• Enforce operator authorization for governed MCP tools by @danieljhkim in #1075
• Honor the execution environment allowlist for agent subprocesses by @danieljhkim in #1076
• Correct Linux sandbox security posture documentation by @danieljhkim in #1077
• task_pr_pipeline ignores task.crew and inherits workflow.default_crew by @danieljhkim in #1078
• Stop doctor from recommending orbit init --refresh-defaults by @danieljhkim in #1079
• Ask for system crew, not QA, during interactive orbit init by @danieljhkim in #1080
• Global skills catalog is deleted on every runtime open when the global root doubles as the workspace root by @danieljhkim in #1081
• orbit workspace list unconditionally rewrites the global registry and ignores ORBIT_ROOT, failing with an unattributable EROFS by @danieljhkim in #1082
• ORB-10916 makes every governed tool permanently unreachable over MCP: no session is ever granted the operator capability by @danieljhkim in #1083
• Allow Claude Code Keychain OAuth under macOS sandbox-exec by @danieljhkim in #1084
• Preserve explicit denyRead over Claude Keychain credential reallow by @danieljhkim in #1086

Full Changelog: v0.12.1...v0.13.0

v0.12.1

What's Changed

• chore: prepare v0.12.0 release [ORB-10870] by @danieljhkim in #1041

Full Changelog: v0.12.0...v0.12.1

v0.12.0

What's Changed

• fix: plugin-install smoke needs host identity flags [ORB-10849] by @danieljhkim in #1027
• release: v0.11.0 by @danieljhkim in #1026
• docs: refresh README for the 0.11.0 knowledge-surface removals [ORB-10851] [ORB-10852] by @danieljhkim in #1028
• docs: record v0.11.0 release smoke learnings [ORB-10854] by @danieljhkim in #1029
• docs: retire stale ADR and learning language from POSITIONING and seeded skills [ORB-10853] by @danieljhkim in #1030
• Drop dead .orbit/frictions/ path from friction tool descriptions by @danieljhkim in #1031
• Stop advertising ADRs on the orbit.search tool surface by @danieljhkim in #1032
• refactor: collapse the Orbit skill tree into one router skill [ORB-10… by @danieljhkim in https://github.com//pull/1033
• Correct friction-curation.yaml search and store-path claims by @danieljhkim in #1034
• Decouple the skill_list output golden from bundled skill content hashes by @danieljhkim in #1035
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #1036
• CI: checkout pins a deletable branch name, and the failure hook crashes instead of filing a task by @danieljhkim in #1037
• orbit doctor: report orphaned skill directories left behind by a retired skill by @danieljhkim in #1038
• Env-value redaction silently corrupts artifact prose when a sensitive-named variable holds a short common word by @danieljhkim in #1039
• orbit workspace init leaves dangling ~/.claude/skills and ~/.agents/skills symlinks for skills retired by ORB-10860 by @danieljhkim in #1040

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• chore(release): v0.10.0 by @danieljhkim in #814
• chore(release): promote v0.10.1 to main by @danieljhkim in #816
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #817
• Harden friction-curation dispositions and make Luna the dedicated crew by @danieljhkim in #818
• Block worktree removal when learning or ADR bodies exist only in that worktree by @danieljhkim in #820
• Expose a guarded ADR restore path for an existing unreadable allocation by @danieljhkim in #819
• Expose the workflow execution surface as operator-only MCP tools by @danieljhkim in #821
• Make the Codex plugin validator compatible with Python 3.9 by @danieljhkim in #822
• Expose federated and unavailable ADRs consistently through the CLI by @danieljhkim in #823
• Restore the 18 design-doc ADRs whose allocation survived but whose body was lost by @danieljhkim in #824
• [BLOCKED] Validate the workflow-tool self-dispatch guard and ship path on-box by @danieljhkim in #825
• Make superseded ADR bodies durable and unblock guarded worktree GC by @danieljhkim in #828
• Per-key layering for config.toml so a workspace override doesn't require duplicating the whole file by @danieljhkim in #830
• Enforce ship duplicate-dispatch guard in the shared submission path by @danieljhkim in #829
• Require --force before workspace init rewrites an existing registration by @danieljhkim in #827
• Run embedded-asset portability checks in make ci-fast by @danieljhkim in #826
• Require --force before workspace init rewrites an existing registration by @danieljhkim in #831
• Ship friction curation as a disabled default auto-task by @danieljhkim in #832
• Add QA sweep to disabled defaults and standardize friction tool calls by @danieljhkim in #833
• docs: propose Linux Bubblewrap sandbox by @danieljhkim in #834
• Triage: reconcile externally-completed tasks to done and suppress repeat diagnosis by @danieljhkim in #835
• Add fail-closed Linux Bubblewrap sandbox for CLI agents by @danieljhkim in #836
• orbit doctor reports the layout-upgrade lock as a dead-holder stale lock after every normal workspace init by @danieljhkim in #837
• fix: preserve managed runs across private PID namespaces [ORB-10557] by @danieljhkim in #838
• Document Ubuntu AppArmor prerequisite for Linux Bubblewrap sandbox by @danieljhkim in #839
• Diagnose and safely repair stale task reservations with orbit doctor by @danieljhkim in #840
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #841
• Allow task-scoped versioned .orbit configuration under the default sandbox policy by @danieljhkim in #842
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #843
• Collapse the duplicated CLI color vocabulary into one semantic role mapping by @danieljhkim in #844
• Prepare missing scoped .orbit config targets before sandbox launch by @danieljhkim in #847
• [BLOCKED] Introduce the output sink and a global --format, resolved once per invocation by @danieljhkim in #845
• [BLOCKED] Terminal tables are borderless with a one-line row invariant by @danieljhkim in #846
• Gate color and width at the sink and retire the hand-padded output paths by @danieljhkim in #849
• [BLOCKED] Build the first output regression fixtures for the CLI by @danieljhkim in #848
• Correct GPT-5.6 prices and cached-input accounting by @danieljhkim in #850
• Add explicit orchestration ownership to tasks by @danieljhkim in #851
• File the ADR for the process-global output sink by @danieljhkim in #852
• Add a weekly official model-price audit auto-task by @danieljhkim in #853
• fix: Complete orchestrator attribution contract after adversarial rev… by @danieljhkim in #855
• Aggregate managed invocation cost by task orchestrator by @danieljhkim in #856
• Surface orchestration cost metrics in the dashboard by @danieljhkim in #857
• Gate Linux Bubblewrap integration tests to Linux hosts by @danieljhkim in #858
• workspace init --force does not cover a pre-seeded checkout identity by @danieljhkim in #859
• Restore workspace clippy: orbit-exec integration test trips expect_used/unwrap_used by @danieljhkim in #860
• Redaction on knowledge-record writes has undefined coverage: host and key identifiers pasted from terminal output pass through unredacted by @danieljhkim in #861
• Add visual styling to the managed execution cost panel by @danieljhkim in #862
• Commands return payloads; the renderer owns stdout (ADR-0306 step 3) by @danieljhkim in #863
• Liveness sweep marks succeeding runs interrupted; false state cascades through pipeline_success_guard by @danieljhkim in #864
• Make task-pilot read-only sandboxing work on Linux by @danieljhkim in #865
• Unsatisfiable task dependencies must fail dispatch immediately, naming the blocker by @danieljhkim in #866
• Surface pipeline reliability on the orbit dashboard: job-run failure rate and recovery invocation rate by @danieljhkim in #867
• A run that completes after a false interrupt loses its outcome, and its overlap slot is released early by @danieljhkim in #868
• Friction records have no author-settable title; derivation from the first body line yields unusable titles and hides duplicates by @danieljhkim in #869
• Executors cannot write ADRs from the sandbox; decisions round-trip through a human transcription by @danieljhkim in #870
• fix: bump fast-uri by @danieljhkim in #871
• Scope global skill symlink creation to the global orbit root during init by @danieljhkim in #872
• Give delivery a deterministic execution summary instead of depending on the agent to write one by @danieljhkim in #873
• Make executor sandbox write grants derive from policy and survive context expansion by @danieljhkim in #874
• Stop local-mode pipelines from leaving the local base branch ahead of its remote by @danieljhkim in #875
• Close sandbox write-grant containment and diagnostic gaps left by PR #874 by @danieljhkim in #876
• Independent review cannot start against a candidate worktree, and the parent cannot tell that from a failed review by @danieljhkim in #877
• [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #878
• Fix orbit-core sandbox regression test missing orbit-exec dev-dependency by @danieljhkim in #879
• Add normalized token-usage efficiency trends to the managed execution dashboard by @danieljhkim in #880
• Trim the Orbit executor instruction stack without weakening safety or lifecycle contracts by @danieljhkim in #882
• Reject legacy crew role sub-tables at config load by @danieljhkim in #883
• Run step-failure recovery on the provider lane's middleweight crew by @danieljhkim in #881
• [BLOCKED] [auto-task] Doc duties — validate the least-recently-validated docs by @danieljhkim in #884
• [BLOCKED] Remove the planning duel subsystem by @danieljhkim in #885
• Restore orbit-task-pilot contract marker required by plugin validation by @danieljhkim in #886
• Fix task-pilot Linux read-only sandbox regression by @danieljhkim in #887
• [auto-task] Remediat...

v0.10.1

What's Changed

• Fix v0.10.1 release recovery blockers by @danieljhkim in #815

Full Changelog: v0.10.0...v0.10.1

v0.9.2

Full Changelog: v0.9.1...v0.9.2

v0.9.1

What's Changed

• Graph sync: prune build/ignored dirs in .orbitignore discovery walk (no-op sync ~10s → sub-second) by @danieljhkim in #502
• Graph reads: decouple query latency from full-worktree rescan (window vs. watcher/background sync) + ADR by @danieljhkim in #503
• Graph scan: prune build/ignored dirs in orbit-knowledge .orbitignore discovery walk by @danieljhkim in #504
• Graph reads: make show/refs/callers index-backed instead of hydrating the full graph per call (+ ADR) by @danieljhkim in #505
• Graph show returns a raw byte array instead of UTF-8 text at the LLM boundary by @danieljhkim in #506
• Graph trace resolves a handler for only ~34% of commands; command: selector silently returns empty by @danieljhkim in #507
• Graph impact should hint at fuzzy fallback when the precise floor is empty (parity with refs) by @danieljhkim in #508

Full Changelog: v0.9.0...v0.9.1

v0.9.0

What's Changed

• release: v0.8.2 by @danieljhkim in #480
• Companion glibc 2.38+ floor: fix smoke env + document Linux/Intel-mac limits by @danieljhkim in #481
• Split orbit-core command/search.rs (2,963 lines) into a search/ module by @danieljhkim in #482
• denyRead/denyModify *.env glob fails to match dotenv-variant secret files (.env.local, .env.production), allowing in-workspace secret exfiltration/modification by @danieljhkim in #485
• Malicious workspace .orbit/resources/{jobs,activities}/ override trusted global named workflows and run unsandboxed commands by @danieljhkim in #487
• Stored XSS: untrusted task/learning/ADR/friction content rendered via marked.parse() into innerHTML with no sanitizer and no CSP by @danieljhkim in #488
• macOS sandbox profile grants unrestricted file-read* plus network*, allowing a sandboxed agent to read and exfiltrate any on-disk secret by @danieljhkim in #489
• Audit blob and JSONL log files written world-readable (default umask), no permission hardening by @danieljhkim in #491
• Gemini HTTP transport places API key in URL query string, leaking it via reqwest error Display and to on-path proxies by @danieljhkim in #490
• Error and bytes fields recorded via tracing bypass redaction (record_error/record_bytes) by @danieljhkim in #492
• Policy glob matching is case-sensitive while target filesystems are case-insensitive, allowing SBPL deny bypass via case-variant paths by @danieljhkim in #494
• Pattern redactor misses major provider/SCM/cloud key formats (Google/Gemini, GitLab, fine-grained GitHub, AWS, npm, connection-string passwords) by @danieljhkim in #493
• fix: SBPL regex (?i) inline flag breaks sandbox-exec for all macOS CLI runs [ORB-00372] by @danieljhkim in #495
• ci: drop Graph Bench check, add macOS sandbox test leg [ORB-00372 follow-up] by @danieljhkim in #496
• fix: learning list/show prefer canonical self.root over stale worktree body_path [ORB-00373] by @danieljhkim in #497
• Non-UTF-8 audit blobs bypass all mandatory secret redaction by @danieljhkim in #498
• Unbounded child stdout/stderr capture enables memory-exhaustion DoS of the orchestrator by @danieljhkim in #500
• run_command automation action shell-interpolates rendered template output (command injection) by @danieljhkim in #499
• refactor: remove the Shell activity variant and run_shell dispatch [ORB-00374] by @danieljhkim in #501

Full Changelog: v0.8.2...v0.9.0

v0.8.2

Full Changelog: v0.8.1...v0.8.2

v0.7.1

What's Changed

• release: v0.7.0 by @danieljhkim in #430

Full Changelog: v0.7.0...v0.7.1