0.3.0-beta.25 - 2026-09-11

🐛 Bug Fixes

• Load knowledge memories without enabling automation (#590)
• Allow resizing maximized internal windows (#589)
• Delegate bounded native tools to orchestrated workers (#591)
• Emit profile scope from memory extraction (#592)
• Recover layout settings saves and expose apply results (#596)
• Confirm terminal termination when closing windows (#597)
• Reduce excessive CPU in connected sessions (#599)
• Bound session summaries and preserve complete details (#600)
• Reconcile Goal context and session lifecycle (#601)
• Preserve terminal creation scope and accessible title actions
• Preserve exact window titles and wait for reasoning controls
• Deduplicate delivered skill context and gate input-only roles (#607)
• Verify private Tailscale endpoints through tsnet (#608)
• Report effective dream role in memory health (#609)
• Group reasoning and tools in session work segments (#610)
• Add durable notification acknowledgement (#611)
• Complete notification review and main integration repairs
• Keep unread title counts current in background tabs
• Resolve notification integration Go lint findings
• Preserve escalation acknowledgement across neutral events
• Restore finished notifications and timeline disclosure behavior
• Synchronize attention delivery and durable loop state

🧪 Testing

• Wait for connected idle Skills prompt readiness
• Supply valid origins in acknowledgement fixtures
• Label unscoped attention story notifications
• Retain explicit global scope in attention fixtures
• Create escalation fixtures through their lifecycle
• Project escalation events in acknowledgement fixtures
• Persist canonical escalation status in overview fixtures

0.3.0-beta.24 - 2026-09-10

🎉 Features

• Add herdr bridge to community catalog (#560)

🐛 Bug Fixes

• Honor profile in operator tool catalog (#551)
• Tolerate unmatched terms in memory recall (#569)
• Scope startup tool guidance to session roles (#572)
• Preserve migrated state during update recovery (#574)
• Unify spec-cycle task completion semantics (#575)
• Preserve provider command routing for spawned sessions (#576)
• Preserve prior session profiles and bound metadata warnings (#578)
• Preserve native model reasoning capabilities (#579)
• Make memory opt-in and preserve pressure compaction (#580)
• Resolve post-merge shutdown and verification failures
• Keep loop authoring editable during validation
• Preserve profile scope across loop run views (#583)
• Preserve profile ownership in loop and memory runtimes (#582)
• Reserve shutdown time for required cleanup (#581)
• Retain the Global desktop across workspace catalog changes
• Repair release integration contracts and lifecycle cleanup
• Stabilize release lifecycle races and integration fixtures
• Respect startup and shutdown lifecycle contexts
• Preserve interrupted session identity and bridge progress bursts
• Preserve cancellation delivery and pending activity deadlines

🧪 Testing

• Enable memory for the knowledge browser journey
• Keep noncooperative ACP prompts alive after cancellation
• Select the desktop workspace before awaiting its client

Release Notes

Fixes

Memory and dreaming require explicit opt-in

CompozyOS is a control plane, so it no longer starts persistent memory extraction or background
dreaming from omitted settings. memory.enabled and roles.dream.enabled now default to false.
To enable memory, set memory.enabled = true in config.toml and restart the daemon. Dreaming
requires the separate roles.dream.enabled = true opt-in; enabling memory alone leaves it off.

The enabled extractor now requests an explicit no-candidate result, accepts conventional empty
responses and JSONL fences, and preserves valid candidates from mixed output. Malformed lines
remain diagnosable failures instead of silently disappearing. Extraction failures and timeouts
appear in the configured DLQ and extractor failure listing. Child-stop details distinguish failed
or timed-out extraction from a parsed child response; successful inbox production owns the
memory.extractor.completed event.

Session pressure compaction remains independently controlled by session.compaction.enabled.
It reuses checkpoint coverage and may launch a summary child when an active session reaches the
pressure threshold, even with persistent memory disabled. Idle sessions and session-end memory
updates do not start that work. An explicit checkpoint-role opt-out or a failed summary leaves
uncovered events unarchived.

Migration notes

No configuration is rewritten and no stored memory is deleted. Existing explicit true or false
values retain their meaning; omitted values use the new disabled defaults. Profile and workspace
role overrides keep their precedence under the daemon memory master switch. Existing public keys,
tools, routes, and response shapes remain available. Raw extraction failures require a new
extraction; replay remains limited to normalized candidate inbox failures. (#561)

Previous-release sessions remain readable after upgrade

Sessions created by 0.3.0-beta.21 remain readable after upgrading. The persisted
creation-profile codec accepts versions 4 and 5, validates their fields, and keeps
historical profile references, policy digests, and creation digests unchanged.
New runtime profiles continue to use version 5.

Unreadable session metadata now produces a bounded scan summary with at most five
examples. An unchanged set repeats at most once every five minutes per scanner;
changed failures are reported immediately. compozy doctor --only runtime.session_metadata -o json reports live counts and a bounded sample,
including missing or invalid catalog creation witnesses.

Migration notes: the version 4 to 5 change added optional ACP selections. Version
4 profiles upgrade through the persistence codec with no selections, preserving
their original bytes and hashes instead of rewriting immutable witnesses. No SQL
migration, config change, session deletion, or manual reset is required. Unknown
versions and corrupted witnesses remain rejected and unchanged. This does not
change dreaming defaults or claim to reproduce the reported CPU/disk measurements.

0.3.0-beta.23 - 2026-09-07

⚡ Performance Improvements

• Reduce test and development feedback overhead (#556)
• Avoid rendering unchanged windows during layout updates

🎉 Features

• Integrated terminal — runtime-owned shells for people and agents (#490)
• Live steer and truthful stop for sessions (#555)
• Manageable session queue, truthful live view, and legible transcripts (#557)

🐛 Bug Fixes

• Restore beta 22 release notes and changelog
• Package site search catalogs
• Zoom windows without covering others and keep the layout stream alive (#525)
• Honor route skips within a planning pass (#529)
• Scope lifecycle loop actions (#531)
• Preserve profile scope in loop implementers (#527)
• Stabilize base CI integration (#536)
• Fence terminal generation outputs and stabilize e2e contracts (#547)
• Preserve ACP options in loop-managed session profiles (#542)
• Preserve unresolved review findings (#543)
• Mark skipped terminal loop nodes as not taken (#544)
• Sanitize runtime settings when changing providers (#546)
• Ship the AppImage with the static runtime (#548)
• Preserve provider failures before output validation (#545)
• Terminal operating system (#552)
• Stabilize loop recovery and simplify run inspection (#554)
• Keep pending activity visible and repair CI synchronization
• Prevent stale terminal catalog reads from replacing live state

🧪 Testing

• Stabilize Windows PTY read readiness
• Drain Windows PTY startup output

Release Notes

Features

Keep sessions alive while observable work is still running

Session supervision now considers agent progress, running tools, active children, Loop runs, task leases, and scheduled waits. A quiet transcript alone no longer means the session is idle. If a work-signal source cannot answer, supervision reports attention and suspends automatic stopping.

Observed silence warns after 30 minutes by default and enters the normal stop ladder after another 10 minutes; fresh work cancels the pending stop. Network Live participation has no aggregate wall-time limit by default, while explicitly configured and other budgets remain effective.

Capacity starvation now escalates visibly. Blocked automation fires defer durably and resume after restart, and scheduler counters distinguish skipped wakes from successful work.

PR: #557.

Manage follow-ups without losing them when a turn is interrupted

Queued follow-ups survive interruption of the active turn, including agent- and Goal-owned entries. Edit, remove, steer, or explicitly clear the queue from the session controls. Clearing writes durable actor-attributed records and is also available through compozy session input clear and the corresponding HTTP/UDS and native-tool surfaces.

Send identities make retries idempotent: retrying the same message returns its recorded outcome, while reusing the identity with different content is rejected. When an acknowledgment is lost, the client shows Not confirmed and retries the original identity. Daemon-generated follow-ups now use the same durable queue.

PR: #557.

Reconnect and read long sessions with a truthful live view

Session streams recover from their last delivered position, including an empty catch-up acknowledgment when already current. Brief interruptions stay quiet; repeated failures show Reconnecting, then Disconnected with Try again. Sending while disconnected keeps the draft. Compaction and retention recovery preserve a consistent active turn and replace expired history windows explicitly.

Completed tool work and settled turns fold into readable summaries, interrupted work stays open, and Thinking is explicit. Reading older history or expanding work no longer competes with live scrolling. Large payloads have Show all and Download controls; stop and steering provenance remain visible on the relevant messages.

Bounded agent event ingestion and durable-history recovery prevent a slow watcher from wedging the producer or silently losing accepted output. Streaming redaction was optimized while preserving its output.

PR: #557.

Search the full conversation and jump between your messages

Find matches in older, unloaded conversation history and jump directly to the containing message or tool result, opening the necessary folds. Search covers text, tool names, filenames, errors, inputs, and outputs. An operator-message outline and a compact message trail make long sessions easier to navigate without losing your place as output streams.

The same reads are available through compozy session search, compozy session outline, HTTP/UDS, and the corresponding native tools. Search results carry location hints so clients can open the exact matching work row.

PR: #557.

Steer a working session and see when Stop has actually finished

Follow-ups now default to steering. Runtimes that advertise live steering receive the guidance inside the active turn; other runtimes report an explicit interrupt-and-replace fallback. The composer shows what happened, restores refused drafts, and Settings lets you choose queueing instead. CLI and native-tool responses expose the send outcome and steering capability.

Stop uses cooperative cancellation, forced stop, and process-group termination with process identity checks. The UI stays at Stopping until the runtime can verify the outcome; an unverifiable stop remains visible with attention. Canceling a turn keeps the session promptable, including when escalation needs to replace its process. Restart reconciliation identifies crashed agents and stale decisions instead of leaving phantom activity.

PR: #555.

Terminals stay with the workspace and welcome people and agents

Open real terminals inside CompozyOS, watch an agent's deliberate command run live, and reconnect after closing a window or reloading the app while the daemon keeps the process running. Visible agent terminals appear without taking focus. The same terminals are available through the Web and Desktop apps, CLI, HTTP/UDS, and native tools.

Authorized people and agents in the same workspace and profile can type, resize, answer input, signal, and close concurrently. Each submitted write stays whole and actor-attributed; there is no control handoff. Explicit read-only attachments remain available. Agent execution uses the approval policy, and hidden input is redacted from retained terminal surfaces.

A command journal records who ran what, approval, outcome, and boundary-detection confidence. Recording is opt-in with retention limits. Local macOS, Linux, and Windows support interactive terminals; remote sandboxes support command execution and journaling without interactive attachment.

PRs: #490, #552.

Fixes

Carry the selected Profile through Loop compilation and worker sessions

Profile-scoped Agents, Skills, Loops, and Session references now resolve consistently through validation, persisted responses, and execution. Orchestrated implementers and nested daemon-issued Session commands retain the validated caller Profile while preserving workspace and identity checks.

Lifecycle extension tools are authorable only in the workspace and Profile where they are enabled. Compilation sees the same tool schema and placement as execution, with normal validation and permission policy still enforced.

Loop-managed sessions also inherit configured ACP options and speed, with explicit runtime options taking precedence. This prevents session creation-profile mismatches before the provider starts.

PRs: #527, #531, #542.

Keep skipped Loop branches and unresolved review findings honest

Exclusive routing no longer executes a dominated branch later in the same planning pass. Skipped downstream and fan-out steps settle as Not taken instead of appearing permanently pending after the run ends; work that ran in earlier rounds keeps its history.

Review-and-fix findings that are valid but blocked or unresolved remain pending and retain their status. Invalid findings remain invalid. Finalization no longer counts those findings as resolved simply because the review round finished.

PRs: #529, #543, #544.

Keep terminal output and session activity visible through lifecycle races

A short-lived terminal that exits while the browser is attaching now keeps its exited state when an older catalog response arrives late. The exit bar and retained output remain discoverable. Terminal selection controls no longer resize the process and clear the selection, hidden panes no longer publish invalid dimensions, and a completed CLI detach no longer causes an unintended reconnect.

Session stream closure drains the persisted stop marker. The pending-reply indicator also appears when a delayed React effect has already consumed its initial guard interval, instead of staying hidden indefinitely. Delayed Settings navigation and runtime-selector closing focus no longer override a newer operator action.

PRs: #547, #557. CI follow-ups: 862e138, 52d2c4a.

Recover Loop runs without losing results or reporting an old failure as current

Carried external results with identical des...

0.3.0-beta.22 - 2026-09-01

This beta makes Loop cancellation forceful and removes Kill, rebuilds runtime selection on live provider catalogs, and lets a parent Loop reconfigure one child run. It also restores prompting for managed sessions and closes regressions across extensions, worktrees, Profiles, fan-out rosters, and conversation clear.

🎉 Features

• Rebuild ACP runtime catalogs (#498)
• Support child Loop config overrides (#494)

🐛 Bug Fixes

• Allow extension loops to call owned tools (#503)
• Honor selected orchestrated implementer (#502)
• Externalize oversized loop action results (#510)
• Force loop cancellation (#509)
• Enable prompts for managed sessions (#517)
• Preserve sparse fan-out roster rows (#518)
• Scope Loop extension tools to worktrees (#519)
• Preserve profile-scoped extension Agent skills (#516)
• Prevent session cancel and clear races (#523)

Release Notes

Cancel is now the single way to stop a Loop run, and it stops the run's own sessions instead of asking politely. Runtime selection reads live provider catalogs, so the models you pick match what the provider offers. Managed sessions accept prompts again, and Loop work stays inside the extension, Profile, and worktree it was scoped to.

Breaking Changes

Cancel now stops a Loop run for real, and public Kill operations are gone

Loop cancellation commits the terminal state before cleanup and stops every session that run owns, so a canceled run leaves nothing alive. Because cancel is now forceful, the separate Kill operation is removed from every public surface. (#509)

• Removed CLI commands: compozy loop kill and compozy loop node kill.
• Removed HTTP and UDS routes: POST /workspaces/{workspace_id}/loop-runs/{run_id}/kill and POST /workspaces/{workspace_id}/loop-runs/{run_id}/nodes/{node_id}/kill.
• Removed native tools: compozy__loop_kill and compozy__loop_node_kill.
• Public run transition and event vocabulary now exposes only cancellation. Stored node_killed events are projected as canceled.
• Authored Loop DSL now accepts on_parent_close: terminate or abandon. Stored cancel values are normalized to terminate.
• compozy__loop_cancel and compozy__loop_node_cancel — and their CLI, HTTP, UDS, and Web equivalents — now terminalize immediately instead of requesting cooperative cancellation.
• Sessions the run only borrowed are left running, workspace isolation is preserved, and a cleanup that fails is retried durably.

Callers still using a Kill route, command, or tool must move to the matching cancel surface; there is no public alias.

Features

Runtime selection reads live model catalogs

Model discovery and runtime configuration are rebuilt around logical model identities and live provider catalogs, so what you pick in CompozyOS matches what the provider actually offers. (#498)

• Authored model IDs are separate from the transport aliases a provider expects, so a Loop or Agent keeps working when a provider renames its wire identifier.
• Catalogs are discovered and stored with a five-minute freshness window, refreshed on a timer and on read, and fall back to the last successful result when a provider is unreachable.
• Cursor launch aliases resolve before the process starts, including the Grok 4.5 and 4.6 Reasoning and Fast combinations. Opus 5 is visible offline while live discovery stays authoritative.
• Hermes is treated as a discoverable ACP agent with handshake readiness diagnostics. OpenClaw stays described as a provider-managed bridge instead of showing model, Reasoning, or Fast controls it does not have.
• Curated models can declare default_speed; live models outside the curated fallback are admitted, and selected model and Fast settings survive inheritance and restart projection.
• Speed and typed acp_options are available on Agent definitions, session and prompt overrides, roles, Loops, Tasks, the CLI, HTTP, UDS, native tools, extension contracts, OpenAPI, and the SDKs. The shared Runtime Selector is wired into Agent, session, role, Loop, Task, and onboarding surfaces.
• The New Session dialog no longer carries a first-message box. Create the session, then send the first prompt from the composer. This was a Web-only field; no API payload changed.

This ships database migrations 00093 through 00097 and regenerated contract output.

A parent Loop can reconfigure one child run

The reserved run-loop action accepts an optional params.config_overrides object, so a parent Loop can give one child run its own iteration limits, budgets, environment, reattempt behavior, and runtime selection without touching the child's stored configuration. (#494)

• Works with both await and detach.
• Exact node-output references stay typed, and unknown literal fields are rejected before the child starts.
• Override values can be filled from templates.
• The override set is closed and excludes operator-owned lifecycle and request-expiry policy.
• The Loop editor exposes the overrides as JSON, and malformed JSON, unknown settings, wrong types, or trailing data block the run instead of failing mid-flight.
• If Goal binding fails while a run is starting, the task run is terminalized instead of staying live.

Large Loop action results survive instead of breaking the run

A Loop action can now return a payload larger than the task-run envelope without losing coordinator restart safety. Results up to 16 KiB stay inline; anything larger is stored in the existing Loop blob store and read back byte for byte through a workspace-authorized paging resource. A result above the action budget fails with the typed action_result_too_large error before the task completes, so the lease is released instead of the run stalling. (#510)

• Adds compozy task run result, task-run result paging over HTTP and UDS, the Host API tasks/runs/result resource, and the compozy__task_run_result native tool.
• compozy__tool_list now returns deterministic pages so the global tool-result limit stays enforceable; compozy__tool_info still returns full descriptors.
• The Task UI shows and copies bounded results.
• Spec-cycle Task fan-out is a hard cut from embedded bodies to path plus body_ref.

No config.toml key was added or removed — the existing tool-result budget remains the source of truth.

Fixes

App status asks the app instead of guessing from the process

compozy app status and compozy app open decided whether the desktop app was running by matching a recorded process ID and its start timestamp. When that timestamp comparison did not line up, a perfectly healthy app was reported as not running, and app open refused to reuse it. Both commands now probe the app's own control socket and take its answer. (#494)

• A control channel that reports not running, or is unavailable, still resolves to "not running" instead of failing the command.
• Any other probe failure is surfaced as an error rather than silently read as a stopped app.

An extension Loop can call the tools its own extension ships

A code-backed extension can contribute both Loops and tools, but the external-source policy stopped a contributed Loop from resolving a tool owned by that same extension, so the action failed with unknown_action_kind. The manifest owner is now preserved through resource loading, compilation, executed snapshots, and hydration, and execution adds exactly that same-owner extension source to the normal allow set. (#503)

• Trusted-source status is never granted, and tools from other extensions stay denied.
• Loop schema compilation snapshots the operator registry once per compilation instead of reprojecting it repeatedly.
• Extension installation and enablement retry transient SQLITE_BUSY conflicts, and lifecycle tokens prevent stale cleanup from disabling a replacement installation.

Loop extension tools run in the worktree the Loop selected

Extension tools invoked from a Loop now resolve against the selected ready worktree instead of the workspace root, so work stays where the run was pointed. Direct and root-scoped calls are unchanged. (#519)

• Web Loop environment authoring is limited to inherit, workspace root, and a named worktree; directory and per-run values set through the API or CLI remain visible and read-only.
• A worktree is resolved by workspace ID and worktree ref and must be ready before it is used.
• Removing a worktree now takes an exclusive usage lease, so compozy worktree remove and the matching delete route report that an operation is in progress while a Loop action is holding that worktree, instead of pulling it out from under the run.

You can talk to managed sessions again

The Web composer now follows prompt authority instead of lifecycle ownership, so eligible user, system, coordinator, and spawned sessions can all be prompted while active or stopped. An eligible stopped session resumes under the same durable session ID and transcript. (#517)

• The composer's stop control now cancels the current turn instead of stopping the whole session, so you can interrupt one answer and keep going.
• Managed sessions still cannot be renamed, cleared, attached, archived, deleted, or stopped as a whole.
• Dream, maintenance, archived, transitional, and unrecoverable sessions stay read-only.
• Session lifecycle docs and the official CompozyOS skill describe the new prompt boundary.

Orchestrated task delivery uses the implementer you picked

implement-tasks running in mode=orchestrated replaced your selected implementer Agent with code_implementer. The typed Agent input now flows through the orchestrated objective, the conductor skill, and compozy spawn, so every worker runs as the Agent you chose and keeps its identity, Agent-local Skills, permissions, provider defaults, and category runtime overrides. (#502)

• code_implementer is still the default, so omitting the input behaves as before.
• A recovered session wh...

0.3.0-beta.21 - 2026-08-27

This beta introduces Profiles, agent-manageable Goals, conjunctive runtime routing, and ecosystem skill sources. It also consolidates task delivery into one Loop and hardens session, profile, and Loop recovery.

⚡ Performance Improvements

• Delegate full gates to pull request CI (#476)

🎉 Features

• Profiles — the who-is-working dimension (#457)
• Combine settings update actions (#461)
• Replace environment path with worktree icon (#463)
• Group session tool calls (#466)
• Restore agent-manageable Goal orchestration (#470)
• Support conjunctive runtime routing (#475)
• Expand profile identity customization (#484)
• Absorb ecosystem skill folders and expose skills back (#488)
• Merge spec-cycle task delivery loops (#491)

🐛 Bug Fixes

• Close profiles regressions after PR 457 (#459)
• Make sessions dock contextual (#468)
• Classify settled spawned TTL cleanup correctly (#469)
• Restore reliable session message copy (#460)
• Add runtime provider tooltips (#464)
• Close windows when sessions are deleted (#465)
• Route command palette entities directly (#467)
• Preserve worktree binding during reconciliation (#456)
• Harden profile-scoped runtime and web flows (#481)
• Keep inactive loop routes out of task projection (#483)
• Harden Loop recovery and expose execution truth (#492)
• Publish npm packages with trusted identity (#495)
• Accept setup-node OIDC placeholder
• Preserve web assets in release module
• Remove npm token from release recovery

🧪 Testing

• Fix failing tests

Release Notes

Profiles add an explicit owner to work, Goals become manageable by agents, and Loops gain more precise routing and recovery. This beta also adopts ecosystem skill sources and consolidates task delivery under implement-tasks.

Breaking Changes

Update requests now use an ordered targets list

The update mutation now accepts targets instead of the singular target, so one operation can apply the Runtime update, the App update, or both in that order. The contract is consistent across HTTP, UDS, generated clients, Settings, and the desktop update flow. (#461)

• Valid values are ["runtime"], ["app"], and ["runtime", "app"].
• Empty lists, duplicates, reversed ordering, and the removed target field are rejected.
• Callers using the old field must migrate to targets; there is no compatibility alias.

Ecosystem skill folders become managed sources

CompozyOS can discover skills from .agents/skills, optional .claude/skills, configured source roots, and installed extensions, then present them through one catalog with origin and exposure state. Skills can be exposed to other tools through managed links without copying their contents. (#488)

• skills.sources selects supported ecosystem roots and skills.custom_sources adds explicit roots.
• The built-in compozy source is always active; agents is enabled by default, claude is opt-in, and custom sources default to an empty list. Existing .agents/skills libraries are discovered after updating without a manual migration.
• compozy skill sources, expose, and unexpose manage discovery and exposure through the CLI, with matching API and native-tool reads.
• File watching refreshes discovered skills as source folders change.
• compozy skill inspect is removed; use compozy skill info. There is no compatibility alias.

One task-delivery Loop with two execution modes

implement-tasks now owns both task-delivery paths. Its default per-task mode keeps one isolated code_implementer session per Task; mode=orchestrated uses the bundled orchestrator agent to spawn, prompt, verify, and stop one bounded worker per Task. (#491)

• Four optional runtime inputs choose the conductor, backend workers, frontend workers, and every other worker. Task-frontmatter runtime fields still win over these run inputs.
• compozy spawn now accepts provider, model, reasoning-effort, and speed overrides, so orchestrated workers preserve the selected runtime choice.
• Goal output contracts now require the runtime's complete|blocked vocabulary, and Goal prompts receive the authored output schema.
• The bundled spec-cycle extension moves to 0.5.0 with the consolidated Loop inventory.
• The standalone orchestrate-tasks Loop and its docs/catalog entry are removed. Operator-side [loops.inputs.orchestrate-tasks] config blocks are now inert and should be deleted; move any desired values under [loops.inputs.implement-tasks] and set mode = "orchestrated".

Features

Profiles add a who-is-working dimension

Profiles introduce an ownership dimension across sessions, Tasks, Loops, worktrees, memory, credentials, resources, extensions, and client state. Switching profile changes the work you read without moving workspace files or restarting the daemon; All profiles provides an explicitly labeled aggregate view. Profiles separate work context and are not a security boundary. (#457, #459, #481)

• Create, rename, archive, unarchive, delete, select, list, update, and read the current profile through the CLI, HTTP, UDS, and Web.
• Agents can read the catalog and current selection through compozy__profile_list and compozy__profile_current.
• Credentials, resources, extension enablement, notification presets, and configuration overlays resolve with profile ownership.
• Session windows, deep links, live streams, reconnects, and workspace selection retain their profile and workspace identity.

Profile identity is visible and editable

Profiles can use catalog-backed Lucide icons, searchable emoji with skin tones, and custom colors. The switcher supports direct editing, and compact owner identity now appears across sessions, the command palette, workspaces, and desktop surfaces. Unknown Lucide slugs fail validation instead of silently rendering a fallback. (#484)

Agents can manage Goals through every public runtime surface

Goal operations are now structured and agent-manageable through compozy__goal_control, HTTP, UDS, compozy session goal, and Web. The shared contract supports set, replace, status, pause, resume, and clear while enforcing same-workspace lineage and cycle checks. Spawned Goal work preserves provider, model, reasoning-effort, and speed choices. (#470)

Runtime routing can match type and complexity together

Loop runtime rules can match both Task type and complexity. Specificity is deterministic—id wins over type + complexity, then type, then complexity—and matching runtime fields merge independently, with later equal-specificity rules winning per field. (#475)

Session navigation and transcript controls are more direct

• Message copy works for text already received while generation continues and reports success or failure; before the first copyable token it remains disabled, and packaged desktop clipboard writes use a trusted Electron boundary. (#460)
• The composer shows its environment or worktree as a compact control with the full value in a tooltip. (#463)
• Provider and model identities expose accessible tooltips, including sign-in requirements. (#464)
• Consecutive tool calls are grouped in the session transcript without hiding their individual state. (#466)
• Command-palette results open the selected entity directly in the correct workspace. (#467)
• The Sessions dock action opens a new session when needed or focuses the most recently used session. (#468)

Fixes

Session ownership and cleanup preserve durable state

• Boot reconciliation preserves the persisted worktree binding for existing sessions. (#456)
• Deleting a session removes its windows from all layouts and desktop states, including pinned, minimized, stacked, and tiled windows, without affecting unrelated workspaces. (#465)
• Spawned-session cleanup treats an already settled prompt as a clean completion; only an in-flight prompt is classified as a timeout. (#469)
• Profile-scoped navigation, session streams, reconnects, and restart recovery preserve profile and workspace ownership. (#459, #481)

Loop recovery reports the execution that actually happened

Inactive routes remain visible as route_not_taken but no longer create phantom Tasks or dependencies. Recovery validates persisted executed-definition bytes, isolates an invalid snapshot instead of blocking healthy coordinators, and makes Goal cleanup and binding allocation safe under replay. (#483, #492)

• reattempt_strategy = "halt" stops automatic succession after a failed generation while preserving explicit reruns.
• Terminal runs record completed_at, so their duration no longer grows after completion.
• Explicit reruns understand the selected node's dependency closure and no longer treat unrelated pending cells as part of that rerun.
• Inspect, dry-run, status, CLI, HTTP, UDS, native tools, and Web expose effective configuration together with the source of each field.

Compare v0.3.0-beta.20...v0.3.0-beta.21

0.3.0-beta.20 - 2026-08-24

🎉 Features

• Make loop runs legible and task lists calm (#452)
• Complete production demo seed (#453)

🐛 Bug Fixes

• Recover ACP sessions after provider disconnects (#454)

0.3.0-beta.19 - 2026-08-21

🎉 Features

• Add Batuta to marketplace (#432)
• Complete Loop graph engineering and typed inputs (#427)
• Simplify the interface for everyday users (#440)
• Deliver the command palette operating surface (#441)

🐛 Bug Fixes

• Website font style
• Harden Loop runtime and graph execution (#438)
• Use candidate version in release dry-run
• Coalesce redundant ACP tool updates (#442)
• Resolve agent runtime recovery regressions (#447)
• Preserve run-agent session lifecycle (#446)
• Use migration timeout for tail replay

🔧 Miscellaneous Tasks

• (mise) Pin Go 1.26.6 (#433)

Release Notes

Features

Agents operate commands without the UI

Everything the palette does is reachable from the CLI, HTTP, UDS, and native tools, with the same reasons and the same gates. An agent supervising CompozyOS discovers a command, checks its contract, targets a client, invokes it, and follows the approval — never depending on a browser. (#441)

• Native tools: compozy__cmd_palette_list reads the daemon-canonical catalog for the bound workspace, and compozy__cmd_palette_invoke runs one command with id, optional args, and optional client. Availability, targeting, single-flight, and approval rules all still apply.
• Every refusal is structured and carries the same text the UI row shows: command_not_found, invalid_arguments naming the fields, no_attached_shell, multiple_clients listing every attachment ID, and already_running.
• HTTP and UDS expose the catalog, clients, invocation, and stream under /api/cmd-palette/*, plus rank signals, usage, pins, and personalization. Approvals are read and canceled through /api/tools/approvals/{id}.
• Configuration parity is complete: bindings, aliases, pins, and personalization resets go through the same validated daemon paths Settings uses, and a change made by an agent reaches connected shells without a restart.
• compozy approvals show|cancel is a new top-level verb for the tool-approval lifecycle behind any invocation.

compozy cmd-palette invoke session.new --client <attachment-id> -o json
compozy cmd-palette invoke <destructive-id> -o json   # returns approval_pending + approval_id
compozy approvals show <approval-id> -o json          # pending → terminal
compozy approvals cancel <approval-id>

Ask the agent when nothing matches

A query with no strong result no longer dead-ends. The palette offers one visually distinct Ask agent: '<query>' row; pressing Enter creates a session with the workspace's default agent and uses the query as the opening prompt. (#441)

• Nothing is sent before Enter. Typing never carries the query to a provider, and a rapid double Enter still creates exactly one session.
• A weak-but-real match keeps both the results and the fallback row; only a query below the served threshold is fallback-only.
• With no workspace default agent, Enter opens the agent picker first. If the session fails to start, the failure names its reason and the palette reopens with your query intact.
• Turn it off in Settings → Palette, or set fallback_targets = []. Both report the same desired state, and the row disappears immediately.

[cmd_palette]
# The current runtime accepts "agent". Use [] to disable the fallback row.
fallback_targets = ["agent"]

Batuta in the Marketplace

Batuta v0.1.0-beta.3 ships as a curated community extension, so operators discover and install it from the Marketplace instead of going through the unverified GitHub-install consent flow. (#432)

• Its agent, skill, and Loop are resource-only and vendored for review, pinned to a deterministic archive digest.
• It installs from the community tier and still requires explicit enablement before it publishes its resources.

Correct one output, repair one lane

Operators can fix a settled node output without rewriting what actually happened, and can act on a single fan-out cell without disturbing its siblings. (#427)

• Amend output applies to a settled output while its run, node, or cell is parked, and appears only when the node declares an output shape to validate against. It shows the recorded original read-only beside the corrected value and takes a reason.
• Amendments are append-only: the recorded output is never rewritten, the corrected value becomes what resume and downstream reads see, and both stay visible in history and in a diff. Amending does not re-run consumers — pair it with Rerun from here.
• Run detail returns amendments[] with bounded, redacted values, or a byte-size and content-hash summary for large data. No API reads an amendment's private output reference directly.
• The control is available as compozy loop node amend, POST /loop-runs/:id/nodes/:node/amend, and compozy__loop_node_amend.
• --item (or item_index) pauses, resumes, cancels, or kills one fan-out cell without touching the rest of the window.

compozy loop node amend --run-id <run-id> --node build --item 3 \
  --payload '{"artifact":"dist/app-1.4.2.tgz"}' --reason "wrong tag captured"

Every domain opens inside the palette

The palette is not only a launcher — it browses. Sessions, Tasks, Loops, Jobs, Agents, Triggers, Marketplace, Bridges, Knowledge, Vault, Worktrees, Network channels, and Extensions each open as a view without leaving the overlay, and views stack so one selection can push the next. (#441)

• Four view kinds ship: list, detail, grid, and form. Lists carry domain chips with truthful counts and single-select semantics; a chip with zero matches names the filter and clears in one keystroke.
• State badges come from the shared status vocabulary and always pair a glyph with a label — never color alone.
• Selecting a row previews its metadata and sanitized text in a detail pane without stealing focus from the list, and the pane clears when the row disappears from another surface instead of showing stale content.
• Form views traverse typed fields in declared order, block an invalid submit on the first failing field, and discard values when you pop the view.
• Vault rows show names and metadata only. A secret value never enters a view, a preview, or a match highlight.
• A cold open shows a loading state, never a blank list dressed up as empty; an oversized list either scrolls virtually or states the exact showing N of M.
• Views stream patches, so a list already on screen updates in place as the runtime changes.

compozy cmd-palette list --source core -o json | grep palette.view.
# palette.view.sessions, .tasks, .loops, .jobs, .agents, .triggers,
# .marketplace, .bridges, .knowledge, .vault, .worktrees,
# .network-channels, .extensions

Extensions contribute commands and views

An extension can add its own commands and views to the palette from resources.cmd_palette, beside its tools. CompozyOS validates the contribution during extension build, extension validate, install, and development reload, and prefixes every local ID with the extension name — capture from the notes extension becomes ext.notes.capture. (#441)

• The action union is closed: tool calls a tool the same extension owns, view opens one of its views, navigate opens a CompozyOS app, and url opens an external link. Extensions cannot declare client operations.
• A declarative view names a read-only tool as its source and returns the shared v1 view payload, which the daemon validates before rendering. A mutating, destructive, interactive, or open-world tool is rejected at validation time, so opening a view never starts an approval flow.
• A programmable view sets program: true and is backed by the public view.provider surface, with patch streaming for live updates. Start from the template with compozy extension init notes --template view-provider-ts.
• A command can ship a default_shortcut. If that chord already belongs to something else, the default stays dormant and the conflict is visible in Settings instead of silently stealing the key.
• Destructive extension commands must declare themselves and supply confirmation copy; the same approval gates apply to them as to core commands.

resources: {
  cmd_palette: {
    commands: [{
      id: "capture",
      title: "Capture note",
      section: "Notes",
      icon: "pencil",
      action: { kind: "tool", tool: "capture_note" },
      default_shortcut: "alt+shift+KeyN",
    }],
    views: [{
      id: "recent",
      title: "Recent notes",
      kind: "list",
      source: { tool: "list_recent" },
    }],
  },
},

Fan-out settles with an honest count

A fan-out can declare how it settles, and a partial result stays partial everywhere it is read instead of being rounded up to success or down to failure. (#427)

• strategy accepts wait_all (the default), fail_fast, race, and best_effort. best_effort requires both a threshold — a percentage like 66% or a count like { count: 2 } — and an explicit missing: acceptable.
• A collect result is succeeded, partial, or failed, and its output carries total, succeeded, failed, canceled, coverage_rate, and partial.
• Live counts read through nodes.<fan-out-id>.progress.* — total, succeeded, failed, canceled, running, pending, settled, success_rate, failure_rate — with the short progress.* form inside the fan-out body. Rates are 0 for an empty collection.
• The run page separates lanes that succeeded, lanes that failed, lanes the strategy canceled, and lanes that never materialized because the window did not open them. Partiality is a run-level fact (completion_state), so it reads partial in the outcome card, the run lists, and a diff. A wide fan-out reports aggregate counts instead of one row per lane.
• The fan-out window has no daemon-wide ceiling; logical width stays bounded by each node's positive max_fan_out. Write-time validation rejects a negative `fan_out_width...

0.3.0-beta.18 - 2026-08-18

🐛 Bug Fixes

• Daemon path resolution

🧪 Testing

• Fix cases failing

0.3.0-beta.17 - 2026-08-18

♻️ Refactoring

• Unify PRD and TechSpec into a single spec pipeline (#397)

🎉 Features

• Add first-class worktree support (#388)
• Close the loops UI visual-contract parity gap (#406)
• Unify zero-inventory empty states for jobs, triggers, and tasks (#409)
• Redesign workspaces overview as command-tab switcher (#410)
• Redesign trigger detail into the When/If/Then rule page (#411)
• Session attachments — paste, drop, and picker to multimodal agents end to end (#412)
• Add Agent Plugins ingestion to extensions (#419)
• Add session attention and orchestration parity (#422)
• Replace Tauri with Electron and unify updates (#424)

🐛 Bug Fixes

• Guard autonomous memory extractor writes (#396)
• Write $ENV interpolation in pi runtime models.json apiKey (#404)
• Authorize daemon-owned loop effects (#407)
• Retain terminal loop effect results in web (#408)
• Bound desktop runtime health checks (#414)
• Preserve loop goal session lineage (#420)
• Support resource-only extension development (#423)

🧪 Testing

• Preserve loop claim tokens in daemon fixtures (#418)

Release Notes

Breaking Changes

The desktop app is now Electron

The Tauri/Rust desktop host is replaced by an Electron shell with a narrow preload boundary, and updating became one durable daemon-owned operation exposed identically through the CLI, HTTP, UDS, Settings, and the menubar. The app provisions the bundled daemon from an empty home, or attaches to a compatible daemon that is already running without taking ownership of it, keeping single-instance focus, deep links, safe navigation boundaries, page zoom, window geometry recovery, diagnostics, logs, and the owned-versus-attached quit contract. (#424)

• Runtime and App are separate update tracks with operation progress, holder-aware blocked state, staged-next-launch state, apply and cancel actions, and truthful absence when a track is unsupported.
• A keyboard-accessible menubar indicator appears only when an update is actionable and navigates to Settings. The renderer holds no desktop-only update authority, and the SPA behaves the same in a browser and in the app.
• Desktop artifacts are planned, inventoried, and channel-checked as one release authority, with notarization and signing input checks and packaged smokes provisioned from empty isolated homes. On macOS the ZIP and on Linux the AppImage are the updater artifacts; DMG and DEB are install artifacts only.

Migration notes: this is a hard cut with no compatibility bridge. The Tauri runtime, commands, permissions, capabilities, fixtures, generated bindings, Cargo dependencies, build configuration, scripts, config keys, docs, and tests are deleted rather than deprecated. Install the app from the artifacts published with this release. The installed-app update walk from one beta to the next was not verified for this build, so the App track must be proven by a release owner across a fresh beta pair before it is treated as delivered.

Features

Agent Plugins install as extensions

CompozyOS ingests Agent Plugins 1.0.0 packages as extensions with no Compozy-specific manifest. A portable plugin contributes skills plus local or remote MCP servers while keeping the existing extension lifecycle, trust, isolation, diagnostics, Marketplace, CLI, HTTP, UDS, native-tool, and Web management surfaces. (#419)

• Manifest discovery and validation are strict: fixed-location skills and MCP configuration, closed schemas, deterministic diagnostics, native-manifest precedence, and safe rejection of unsupported components.
• Portable skills and stdio or streamable-HTTP MCP servers are synthesized into the canonical extension model, with absolute PLUGIN_ROOT and PLUGIN_DATA expansion, single-token stdio commands, package-root working directories, remote-header bindings, URL policy, and secret redaction.

Migration notes: end-to-end delivery is claimed only for the provider paths proven end to end, Claude Code and Hermes. OpenClaw's current ACP bridge advertises session_mcp=false, so CompozyOS fails closed instead of pretending to deliver session MCP servers.

Attention: know which session needs you

CompozyOS has one daemon-owned attention model. Pending input, permission requests, finished-unseen sessions, operator presence, notification delivery, and cross-workspace session discovery are runtime state instead of per-surface guesses. Orchestrator agents get structured wait, spawn, stop, approve, clarify-answer, prompt-cancel, and notify controls across native tools, CLI, HTTP, and UDS, so an agent supervising other agents no longer polls a shell or depends on the web UI to act. (#422)

• The global catalog persists canonical attention revisions, pending interactions, seen and settled state, and cursor-stable attention ordering.
• Presence leases, attention summaries and events, sanitized interaction discovery, generalized waits, prompt cancellation, operator notifications, and session wake propagation are available on every transport, with deterministic CLI exit behavior.
• Desktop shortcuts moved to a daemon-owned, configurable keymap, and the command palette gained nested views including an attention-first Sessions view.

First-class Git worktrees

Git worktrees are runtime objects across the daemon, Web desktop, CLI, HTTP and UDS, native tools, extensions, configuration, generated contracts, and documentation: create, adopt, discover, inspect, reconcile, dismiss, and safely remove isolated checkouts. Sessions, Task runs, fan-out workers, and Loop environments bind to an exact worktree without losing the parent workspace's config, skills, agents, or memory. (#388, #410)

• The new worktree domain owns Git capability detection, canonical repository identity, naming and placement, per-repository mutation locking, and durable lifecycle state.
• Creation is a phased pending → ready operation with recorded ownership checkpoints, bootstrap copy and setup support, cancel-safe rollback, and boot recovery.
• Adoption verifies the linked checkout, the common Git directory, main-checkout exclusion, and repository identity before registering it. Discovery merges Git-known checkouts with durable records without turning a discovered row into an adopted worktree.
• Removal fences the record as removing, rechecks session activity and Git safety under the repository lock, preserves branches and history, and requires an explicit second step for dirty or unique-unpushed work.
• Finishing work runs through a truthful assisted-exit ladder for commit, push, pull request, merged evidence, and cleanup. Dismissed tombstones release their reserved name, exit actions resolve caller references to canonical record ids, and CLI mutation output keeps worktree identity.

Loops UI and empty catalogs match their design contract

Every Loops surface adopts the approved visual contract's locked review decisions, collapse and section grammar, icon budget, and truthfulness rules, rendering only daemon-backed data and adding no helper copy. Jobs, Triggers, and Tasks share one zero-inventory empty state with the same composition, density, and icon grammar. (#406, #409)

• Automation suggestions and task templates are empty-state affordances again: they render only in the unfiltered zero-inventory state instead of sitting above a populated Jobs catalog.
• The three catalogs compose the same components and differ only in icon, title, support line, action, and panel content.

Session attachments: paste, drop, or pick

The session composer accepts images (PNG, JPEG, WebP) and files (PDF, Markdown, plain text) by paste, drag-and-drop, or file picker. Attachments persist before the prompt is accepted, ride the prompt as provider-neutral references, and reach multimodal agents as protocol-conformant ACP content blocks gated by the capabilities that agent negotiated at initialization. Saving a screenshot to disk and describing its path is no longer the workaround. (#412)

• The daemon keeps the agent's prompt capabilities from the initialize handshake instead of discarding them, so unsupported content is refused in place rather than sent to an agent that never advertised it.
• Attachments render durably in the transcript across reload, live streaming, recap, and archive, and they are deleted with their session.
• The capability gate lives inside the composer's attachment strip. Steering a running prompt stays text-only.

The workspace switcher works like Command-Tab

The fullscreen workspaces overview is rebuilt as a Command-Tab style switcher over the live shell: a glass tile strip, a frosted focus plate, an identity caption, an always-visible vertical worktree menu, a full keyboard model, and a registered ⇧⌘W shortcut. It switches workspace identity only; window arrangements stay with the Desktops overview. (#410)

Migration notes: the previous 264 px dossier grid, with its member stacks, path footers, and "Enter →" row, is deleted rather than kept behind a flag.

Trigger detail is a rule page

A trigger now reads as the rule it is, not as a job inspector with the cron stripped out: a plain-language sentence of what the trigger does, a labeled Enable switch opposite it as the only accent on the page, one When / If / Then card, a single-open Recent-runs accordion, a four-card rail, and an Inspect sheet for runtime internals. (#411)

Migration notes: the shared automation detail panel is jobs-only again, and triggers render through their own component family.

Fixes

Autonomous extraction stays out of curated memory

The autonomous memory extractor could write operational chatter into curated memory, and a generated slug collision could overwrite an unrelated entry. The deterministic scanner now rejects Memory v2 operational identifiers — memory_propose, native compozy__memory_* tool names, controller event names, and scanner rule IDs — and extract...