Release v2026.5.25-beta.13

308 PRs from 7 contributors since v2026.5.17-beta.12.

Breaking Changes

• Migrate ntfy from in-process adapter to sidecar (P7) (feat(channels)!: migrate ntfy from in-process adapter to sidecar (P7) #5224) (@houko)
• Remove in-process telegram adapter (now sidecar-only) (feat(channels)!: remove in-process telegram adapter (now sidecar-only) #5241) (@houko)
• Migrate gotify from in-process adapter to sidecar (feat(channels)!: migrate gotify from in-process adapter to sidecar #5263) (@houko)
• Migrate mastodon from in-process adapter to sidecar (feat(channels)!: migrate mastodon from in-process adapter to sidecar #5264) (@houko)
• Remove 6 low-value channel adapters (chore(channels)!: remove 6 low-value channel adapters #5265) (@houko)
• Drop 12 unmaintained adapters (chore(channels)!: drop 12 unmaintained adapters #5267) (@houko)
• Migrate bluesky from in-process adapter to sidecar (feat(channels)!: migrate bluesky from in-process adapter to sidecar #5277) (@houko)
• Migrate reddit from in-process adapter to sidecar (feat(channels)!: migrate reddit from in-process adapter to sidecar #5281) (@houko)
• Migrate twitch from in-process adapter to sidecar (feat(channels)!: migrate twitch from in-process adapter to sidecar #5297) (@houko)
• Migrate rocketchat from in-process adapter to sidecar (feat(channels)!: migrate rocketchat from in-process adapter to sidecar #5298) (@houko)
• Migrate discord from in-process adapter to sidecar (feat(channels)!: migrate discord from in-process adapter to sidecar #5299) (@houko)
• Migrate nextcloud from in-process adapter to sidecar (feat(channels)!: migrate nextcloud from in-process adapter to sidecar #5301) (@houko)
• Migrate slack from in-process adapter to sidecar (feat(channels)!: migrate slack from in-process adapter to sidecar #5302) (@houko)
• Migrate webex from in-process adapter to sidecar (feat(channels)!: migrate webex from in-process adapter to sidecar #5309) (@houko)
• Migrate zulip from in-process adapter to sidecar (feat(channels)!: migrate zulip from in-process adapter to sidecar #5310) (@houko)
• Migrate line from in-process adapter to sidecar (feat(channels)!: migrate line from in-process adapter to sidecar #5312) (@houko)
• Migrate mattermost from in-process adapter to sidecar (feat(channels)!: migrate mattermost from in-process adapter to sidecar #5315) (@houko)
• Migrate signal from in-process adapter to sidecar (feat(channels)!: migrate signal from in-process adapter to sidecar #5317) (@houko)
• Migrate qq from in-process adapter to sidecar (feat(channels)!: migrate qq from in-process adapter to sidecar #5325) (@houko)
• Migrate matrix from in-process adapter to sidecar (feat(channels)!: migrate matrix from in-process adapter to sidecar #5368) (@houko)
• Migrate feishu from in-process adapter to sidecar (feat(channels)!: migrate feishu from in-process adapter to sidecar #5380) (@houko)
• Migrate wecom from in-process adapter to sidecar (WebSocket-only) (feat(channels)!: migrate wecom from in-process adapter to sidecar (WebSocket-only) #5392) (@houko)
• Migrate email from in-process adapter to sidecar (feat(channels)!: migrate email from in-process adapter to sidecar #5408) (@houko)
• Migrate dingtalk from in-process adapter to sidecar (Stream mode only) (feat(channels)!: migrate dingtalk from in-process adapter to sidecar (Stream mode only) #5417) (@houko)
• Migrate wechat from in-process adapter to sidecar (feat(channels)!: migrate wechat from in-process adapter to sidecar #5421) (@houko)
• Migrate teams from in-process adapter to sidecar (feat(channels)!: migrate teams from in-process adapter to sidecar #5433) (@houko)
• Migrate whatsapp from in-process adapter to sidecar (dual-mode) (feat(channels)!: migrate whatsapp from in-process adapter to sidecar (dual-mode) #5445) (@houko)
• Migrate webhook from in-process adapter to sidecar (feat(channels)!: migrate webhook from in-process adapter to sidecar #5455) (@houko)
• Migrate google_chat from in-process adapter to sidecar (feat(channels)!: migrate google_chat from in-process adapter to sidecar #5459) (@houko)
• Delete dead per-channel REST endpoints + their helpers (chore(channels)!: delete dead per-channel REST endpoints + their helpers #5463) (@houko)

Highlights

• Channel adapter sidecar migration — all 27 messaging integrations (Slack, Discord, Telegram, WhatsApp, Signal, Teams, and more) are now isolated sidecar processes instead of in-process adapters; 18 unmaintained adapters were removed. Sidecar adapters can be configured directly from the dashboard.
• Human-in-the-loop (HITL) approval step — agents can now pause and request operator approval mid-run; approvals route back to the originating chat with inline keyboard buttons on supported adapters, and the same tool only prompts once per session.
• Credential pools — configure multiple API keys per LLM provider for automatic round-robin rotation and instant failover on rate limits.
• Schedule tab & budget visibility — the dashboard now has an editable Schedule tab for managing triggers, cron jobs, and continuous mode; a new per-provider budget caps surface shows spend and limits per provider.
• Security hardening — session tokens are now hashed at rest, SSRF validation added to URL inputs, path-traversal guards tightened across asset and file routes, SQL bindings replace string concatenation in session cleanup, and request bodies are size-capped against pre-allocation DoS.

Added

• Credential pools — multi-key rotation per provider with… (feat(kernel): credential pools — multi-key rotation per provider with… #5063) (@Chukwuebuka-2003)
• Add per-agent memory isolation via agent_id parameter (feat(memory): add per-agent memory isolation via agent_id parameter #5071) (@leszek3737)
• Propagate W3C traceparent to outbound LLM HTTP requests (feat: propagate W3C traceparent to outbound LLM HTTP requests #5190) (@neo-wanderer)
• Implement HITL operator-step — notify dispatch, timeout watchdog, HTTP actions→resume (wire the operator HTTP #5133, spawn a timeout watchdog #5134, dispatch channel #5135) (feat(workflow): implement HITL operator-step — notify dispatch, timeout watchdog, HTTP actions→resume (#5133, #5134, #5135) #5191) (@houko)
• Caller-controlled conversation_key for agent_send (feat(runtime,kernel): caller-controlled conversation_key for agent_send #5212) (@houko)
• Forced /compact with async spawn, ack+event, summary banner (feat(kernel,api,channels,dashboard): forced /compact with async spawn, ack+event, summary banner #5213) (@houko)
• Sidecar channel parity — protocol, supervision, config (P0–P3) (feat(channels): sidecar channel parity — protocol, supervision, config (P0–P3) #5219) (@houko)
• Python sidecar channel adapter framework (P4) (feat(sdk): Python sidecar channel adapter framework (P4) #5220) (@houko)
• Hard-block new in-process channel adapters (P5) (feat(channels,ci): hard-block new in-process channel adapters (P5) #5221) (@houko)
• Migrate ntfy from in-process adapter to sidecar (P7) (feat(channels)!: migrate ntfy from in-process adapter to sidecar (P7) #5224) (@houko)
• Compute wasMentioned from group_trigger_patterns when mentionedJids is empty (feat(wa-gateway): compute wasMentioned from group_trigger_patterns when mentionedJids is empty #5230) (@f-liva)
• Telegram full sidecar parity (formatter + full inbound/outbound), stdlib-only (feat(sidecar,sdk): telegram full sidecar parity (formatter + full inbound/outbound), stdlib-only #5232) (@houko)
• Remove in-process telegram adapter (now sidecar-only) (feat(channels)!: remove in-process telegram adapter (now sidecar-only) #5241) (@houko)
• Configure sidecar adapters (telegram/ntfy) from dashboard (feat(channels): configure sidecar adapters (telegram/ntfy) from dashboard #5252) (@houko)
• Editable Schedule tab — triggers, cron, continuous mode (feat(dashboard): editable Schedule tab — manage triggers, cron, and continuous mode #4924) (feat(dashboard): editable Schedule tab — triggers, cron, continuous mode (#4924) #5256) (@houko)
• HITL operator-step dashboard surfaces (feat(workflows): human-in-the-loop steps — operator interaction via channels for approvals, review, and dynamic input #4977) (feat(workflows): HITL operator-step dashboard surfaces (#4977) #5257) (@houko)
• Credential pools for multi-key per-provider rotation (feat(kernel): credential pools — multi-key rotation per provider with configurable strategy #4965) (feat(kernel): credential pools for multi-key per-provider rotation (#4965) #5260) (@houko)
• Migrate gotify from in-process adapter to sidecar (feat(channels)!: migrate gotify from in-process adapter to sidecar #5263) (@houko)
• Migrate mastodon from in-process adapter to sidecar (feat(channels)!: migrate mastodon from in-process adapter to sidecar #5264) (@houko)
• Migrate bluesky from in-process adapter to sidecar (feat(channels)!: migrate bluesky from in-process adapter to sidecar #5277) (@houko)
• Migrate reddit from in-process adapter to sidecar (feat(channels)!: migrate reddit from in-process adapter to sidecar #5281) (@houko)
• Migrate twitch from in-process adapter to sidecar (feat(channels)!: migrate twitch from in-process adapter to sidecar #5297) (@houko)
• Migrate rocketchat from in-process adapter to sidecar (feat(channels)!: migrate rocketchat from in-process adapter to sidecar #5298) (@houko)
• Migrate discord from in-process adapter to sidecar (feat(channels)!: migrate discord from in-process adapter to sidecar #5299) (@houko)
• Migrate nextcloud from in-process adapter to sidecar (feat(channels)!: migrate nextcloud from in-process adapter to sidecar #5301) (@houko)
• Migrate slack from in-process adapter to sidecar (feat(channels)!: migrate slack from in-process adapter to sidecar #5302) (@houko)
• Migrate webex from in-process adapter to sidecar (feat(channels)!: migrate webex from in-process adapter to sidecar #5309) (@houko)
• Migrate zulip from in-process adapter to sidecar (feat(channels)!: migrate zulip from in-process adapter to sidecar #5310) (@houko)
• Migrate line from in-process adapter to sidecar (feat(channels)!: migrate line from in-process adapter to sidecar #5312) (@houko)
• Migrate mattermost from in-process adapter to sidecar (feat(channels)!: migrate mattermost from in-process adapter to sidecar #5315) (@houko)
• Migrate signal from in-process adapter to sidecar (feat(channels)!: migrate signal from in-process adapter to sidecar #5317) (@houko)
• Migrate qq from in-process adapter to sidecar (feat(channels)!: migrate qq from in-process adapter to sidecar #5325) (@houko)
• Migrate matrix from in-process adapter to sidecar (feat(channels)!: migrate matrix from in-process adapter to sidecar #5368) (@houko)
• Migrate feishu from in-process adapter to sidecar (feat(channels)!: migrate feishu from in-process adapter to sidecar #5380) (@houko)
• Migrate wecom from in-process adapter to sidecar (WebSocket-only) (feat(channels)!: migrate wecom from in-process adapter to sidecar (WebSocket-only) #5392) (@houko)
• Migrate email from in-process adapter to sidecar (feat(channels)!: migrate email from in-process adapter to sidecar #5408) (@houko)
• Migrate dingtalk from in-process adapter to sidecar (Stream mode only) (feat(channels)!: migrate dingtalk from in-process adapter to sidecar (Stream mode only) #5417) (@houko)
• Migrate wechat from in-process adapter to sidecar (feat(channels)!: migrate wechat from in-process adapter to sidecar #5421) (@houko)
• Migrate teams from in-process adapter to sidecar (feat(channels)!: migrate teams from in-process adapter to sidecar #5433) (@houko)
• Migrate whatsapp from in-process adapter to sidecar (dual-mode) (feat(channels)!: migrate whatsapp from in-process adapter to sidecar (dual-mode) #5445) (@houko)
• Migrate webhook from in-process adapter to sidecar (feat(channels)!: migrate webhook from in-process adapter to sidecar #5455) (@houko)
• Migrate google_chat from in-process adapter to sidecar (feat(channels)!: migrate google_chat from in-process adapter to sidecar #5459) (@houko)
• Restore ChannelsPage as a sidecar-only page (feat(dashboard): restore ChannelsPage as a sidecar-only page #5470) (@houko)
• Embed librefang-sdk + reconnect WeChat QR flow (feat(channels/sidecar+dashboard): embed librefang-sdk + reconnect WeChat QR flow #5472) (@houko)
• Approval notifications use inline keyboard on interactive-capable adapters (feat(channels/bridge): approval notifications use inline keyboard on interactive-capable adapters #5483) (@houko)
• Route approval popup to originating chat (follow-up to feat(channels/bridge): approval notifications use inline keyboard on interactive-capable adapters #5483) (feat(channels/bridge): route approval popup to originating chat (follow-up to #5483) #5484) (@houko)
• Thread chat_id through approval flow for group-chat support (feat(approval): thread chat_id through approval flow for group-chat support #5489) (@houko)
• Cache per-session approvals so the same tool only prompts once (feat(approval): cache per-session approvals so the same tool only prompts once #5663) (@houko)
• Per-agent [proactive_memory] extraction_model override (feat(memory): ProactiveMemoryOverrides missing extraction_model field — multi-provider deployments cannot per-agent override extractor #5475) (feat(memory): per-agent [proactive_memory] extraction_model override (#5475) #5690) (@houko)
• Bootstrap ESLint with jsx-no-target-blank guard (fixes Bootstrap ESLint for dashboard — needed for jsx-no-target-blank + no-danger-with-children guards #5561) (feat(dashboard/lint): bootstrap ESLint with jsx-no-target-blank guard (fixes #5561) #5701) (@houko)
• Propagate kernel-attested caller context to MCP servers (fixes feat(runtime-mcp): propagate sender peer/session context to MCP servers so they can authorize per-caller — currently call_tool is context-blind #5699) (feat(runtime-mcp): propagate kernel-attested caller context to MCP servers (fixes #5699) #5704) (@houko)
• Expose per-provider budget caps surface (feat(api,dashboard/budget): expose per-provider budget caps surface #5705) (@houko)

Fixed

• Force HOME so spawned CLI can find its credentials (fix(claude-code): force HOME so spawned CLI can find its credentials #4997) (@f-liva)
• Distinguish JoinError cancellation from panic in streaming bridge (bug: JoinError::is_cancelled() misclassified as panicked in streaming kernel task handler — ERROR noise on every journal-recovery restart #5058) (fix(api): distinguish JoinError cancellation from panic in streaming bridge (#5058) #5064) (@leszek3737)
• Spill oversized MCP/tool results to artifact store before truncation (fix(runtime): spill oversized MCP/tool results to artifact store before truncation #5149) (@neo-wanderer)
• Deny unknown fields in request DTOs to catch body typos (api: request DTOs accept unknown fields, body typos silently succeed #5131) (fix(api): deny unknown fields in request DTOs to catch body typos (#5131) #5151) (@houko)
• Validate expression at insert and auto-disable on repeated fallback (fix(cron): validate expression at insert and auto-disable on repeated fallback #5160) (@houko)
• Unwedge cooldown on wall-clock backstep (fix(triggers): unwedge cooldown on wall-clock backstep #5162) (@houko)
• Respect per-agent fallback_models override — None inherits global, Some([]) opts out (fix(kernel): respect per-agent fallback_models override — None inherits global, Some([]) opts out #5167) (@DaBlitzStein)
• Serde/config polish ([audit] Misc low-priority polish (serde / config) #5145) (fix(config): serde/config polish (#5145) #5172) (@houko)
• AuxClient inherits agent fallback chain when [llm.auxiliary] unset (bug(runtime): AuxClient ignores agent fallback chain — uses bare default_model without fallback #5169) (fix(runtime): AuxClient inherits agent fallback chain when [llm.auxiliary] unset (#5169) #5173) (@houko)
• Cap rate-limited autonomous loop re-fires (bug(runtime): rate-limited agent_send hands enter infinite retry loop with no max attempts #5168) (fix(runtime): cap rate-limited autonomous loop re-fires (#5168) #5174) (@houko)
• Time/clock/scheduling robustness ([audit] Time / clock / scheduling robustness (P1/P2 follow-ups to #5113-5115) #5136) (fix(kernel): time/clock/scheduling robustness (#5136) #5175) (@houko)
• Surface swallowed errors on persistence/IO paths ([audit] Silent error swallowing across persistence and I/O paths #5137) (fix(kernel,api,runtime): surface swallowed errors on persistence/IO paths (#5137) #5176) (@houko)
• Enforce prompt-cache key determinism ([audit] Prompt-cache determinism follow-ups (#3298 area) #5143) (fix(llm-drivers,runtime,skills): enforce prompt-cache key determinism (#5143) #5177) (@houko)
• Security defense-in-depth — symlink/archive/header/IP edge cases ([audit] Security defense-in-depth gaps (follow-ups to #5124) #5141) (fix(runtime): security defense-in-depth — symlink/archive/header/IP edge cases (#5141) #5178) (@houko)
• Enforce per-user memory/wiki ACL at tool dispatch ([audit] Auth / ACL hardening gaps #5139) (fix(kernel,api): enforce per-user memory/wiki ACL at tool dispatch (#5139) #5179) (@houko)
• Concurrency hazard follow-ups — kill_agent run/abort lifecycle ([audit] Concurrency hazards (follow-ups to #5125-5126) #5142) (fix(kernel,api,channels): concurrency hazard follow-ups — kill_agent run/abort lifecycle (#5142) #5180) (@houko)
• Memory substrate data integrity ([audit] Memory substrate data integrity (follow-ups to #5119-5121) #5138) (fix(memory,kernel,api,types): memory substrate data integrity (#5138) #5181) (@houko)
• Data-layer invalidation + a11y + dead code ([audit] Dashboard data layer + a11y + dead code (follow-ups to #5122-5123) #5140) (fix(dashboard): data-layer invalidation + a11y + dead code (#5140) #5182) (@houko)
• Task lifecycle / resource-leak follow-ups ([audit] Resource leaks / task lifecycle (follow-ups to #5127) #5144) (fix(api,kernel,runtime,acp): task lifecycle / resource-leak follow-ups (#5144) #5184) (@houko)
• Reject same-task re-entrant agent_msg_lock acquisition (agent_send: transitive A→B→A cycle deadlocks per-agent message lock #5125, channel_send: owner-caller mirror path deadlocks per-agent message lock #5126) (fix(kernel,runtime): reject same-task re-entrant agent_msg_lock acquisition (#5125, #5126) #5187) (@houko)
• Show full agent name on hover in chat sidebar (fix(dashboard/chat): show full agent name on hover in chat sidebar #5188) (@neo-wanderer)
• Regenerate OpenAPI/SDK/schema baselines for fix(api): deny unknown fields in request DTOs to catch body typos (#5131) #5151 DTO changes ([main red] CI failure on PR #5151 #5165) (fix(api): regenerate OpenAPI/SDK/schema baselines for #5151 DTO changes (#5165) #5189) (@houko)
• Prevent history_fold mid-string truncation on verbose-JSON models (fix(runtime): prevent history_fold mid-string truncation on verbose-JSON models #5206) (@houko)
• Re-enable send button on typing:stop (fix(dashboard): re-enable send button on typing:stop #5207) (@houko)
• /context reports real model context window (fix(kernel,runtime): /context reports real model context window #5208) (@houko)
• Surface config deserialize errors and fail closed on hard parse failure (fix(kernel): surface config deserialize errors and fail closed on hard parse failure #5209) (@houko)
• Honor token-trigger in inner compaction gate (fix(kernel): honor token-trigger in inner compaction gate #5210) (@houko)
• Canonical session pointer recovery on restart (Dashboard ?agentId=-only chats silently bind to a different session after a daemon restart (canonical pointer not preserved) #5198, Dashboard chat: unpinned ?agentId= sessions are never URL-pinned after creation, and the session dropdown shows a misleading active highlight #5199) (fix(kernel,api,dashboard): canonical session pointer recovery on restart (#5198, #5199) #5211) (@houko)
• Cover ChainExhausted in PooledDriver match (unblock main) (fix(kernel): cover ChainExhausted in PooledDriver match (unblock main) #5215) (@houko)
• Restore rustfmt-clean main after fix(kernel): surface config deserialize errors and fail closed on hard parse failure #5209 ([main red] CI failure on PR #5179 #5214) (fix(kernel,api): restore rustfmt-clean main after #5209 (#5214) #5216) (@houko)
• Expose background section + drop stale /api/cron/list allowlist row (fix(api,dashboard): expose background section + drop stale /api/cron/list allowlist row #5217) (@houko)
• Sidecar protocol/SDK follow-ups from feat(channels): sidecar channel parity — protocol, supervision, config (P0–P3) #5219/feat(sdk): Python sidecar channel adapter framework (P4) #5220 review (fix(channels,sdk): sidecar protocol/SDK follow-ups from #5219/#5220 review #5223) (@houko)
• Move first-party channel adapters out of examples into librefang-sdk (fix(sidecar,sdk): move first-party channel adapters out of examples into librefang-sdk #5228) (@houko)
• Unwrap ephemeral/viewOnce/edited wrappers before reading contextInfo (closes #48) (fix(wa-gateway): unwrap ephemeral/viewOnce/edited wrappers before reading contextInfo (closes #48) #5229) (@f-liva)
• Surface producer crash via ProducerCrashed, not SystemExit (fix(sdk/python): surface producer crash via ProducerCrashed, not SystemExit #5231) (@houko)
• Handle inbound poll_answer in telegram adapter (sidecar parity) (fix(sidecar): handle inbound poll_answer in telegram adapter (sidecar parity) #5242) (@houko)
• Close kill_agent/dispatch race + break HITL self-cycle (fix(kernel): close kill_agent/dispatch race + break HITL self-cycle (#5244 follow-ups) #5244 follow-ups) (fix(kernel): close kill_agent/dispatch race + break HITL self-cycle (#5244 follow-ups) #5244) (@houko)
• Unblock main — pass force=false in compact gate test (fix(kernel): honor token-trigger in inner compaction gate #5210/feat(kernel,api,channels,dashboard): forced /compact with async spawn, ack+event, summary banner #5213 collision) (fix(kernel): unblock main — pass force=false in compact gate test (#5210/#5213 collision) #5245) (@houko)
• Sidecar channels visible AND read-only on the dashboard (no 404 actions) (fix(channels): sidecar channels visible AND read-only on the dashboard (no 404 actions) #5249) (@houko)
• Surface telegram/ntfy discovery rows on the channels page (fix(channels): surface telegram/ntfy discovery rows on the channels page #5250) (@houko)
• Auto-pin agentId-only sessions + bind dropdown active to live connection (Dashboard chat: unpinned ?agentId= sessions are never URL-pinned after creation, and the session dropdown shows a misleading active highlight #5199) (fix(dashboard): auto-pin agentId-only sessions + bind dropdown active to live connection (#5199) #5253) (@houko)
• Cron picker click no longer closes schedule form (Can't create Schedules the form closing once trying to click to pick Cron Expression #5247) (fix(dashboard): cron picker click no longer closes schedule form (#5247) #5254) (@houko)
• Agent wizard tools/skills selectable + MCP servers dropdown (Tools, Skills and MCP selection per agent creation not working #5246) (fix(dashboard): agent wizard tools/skills selectable + MCP servers dropdown (#5246) #5255) (@houko)
• Follow-ups from third sidecar-configure review (fix(channels): follow-ups from third sidecar-configure review #5261) (@houko)
• Block cross-chat memory bleed via chat-scoped recall (Cross-chat context bleed: group msg mentioning agent contaminates DM session reply #5227) (fix(memory): block cross-chat memory bleed via chat-scoped recall (#5227) #5262) (@houko)
• Patch Baileys executeInitQueries to non-blocking allSettled (fix(wa-gateway): patch Baileys executeInitQueries to non-blocking allSettled #5268) (@f-liva)
• Align opentelemetry stack on 0.32 to fix main build break (fix(deps): align opentelemetry stack on 0.32 to fix main build break #5279) (@houko)
• Include kernel Bearer token on all REST forwards (fix(wa-gateway): include kernel Bearer token on all REST forwards #5285) (@f-liva)
• Thread sender context through streaming message handler (fix(api): thread sender context through streaming message handler #5288) (@f-liva)
• Skip file-upload OCR for image/* mime types (closes bug(llm-drivers/moonshot): preprocess_moonshot_files sends image/* MIME to file-OCR endpoint, fails with "text extract error" 400 #5290) (fix(llm-drivers/moonshot): skip file-upload OCR for image/* mime types (closes #5290) #5291) (@DaBlitzStein)
• Add default_agent to SidecarChannelConfig — restore inbound routing pin (closes bug(channels): inbound routing falls to non-deterministic "first available" agent when SidecarChannelConfig has no default + empty channels allowlist accepts all (related #4926) #5294) (fix(channels): add default_agent to SidecarChannelConfig — restore inbound routing pin (closes #5294) #5295) (@DaBlitzStein)
• Restore main — fmt drift, MCP caller_agent_id semantics, openapi baseline (fix(ci): restore main — fmt drift, MCP caller_agent_id semantics, openapi baseline #5300) (@houko)
• Honour Retry-After across sidecar polling adapters (fix(channels): honour Retry-After across sidecar polling adapters #5303) (@houko)
• Emit poll bursts in chronological order across sidecar adapters (fix(channels): emit poll bursts in chronological order across sidecar adapters #5305) (@houko)
• Restore main — fmt drift + stale config schema baseline (fix(ci): restore main — fmt drift + stale config schema baseline #5307) (@houko)
• Detect chat-template [User] line-leader as cascade leak (fix(runtime): detect chat-template [User] line-leader as cascade leak #5308) (@f-liva)
• Update openclaw test fixtures after mattermost sidecar (closes [main red] CI cancelled on PR #5312 #5316) (fix(migrate): update openclaw test fixtures after mattermost sidecar (closes #5316) #5318) (@houko)
• Wrap config sub-tabs + hide number-input spinner buttons (closes some configuration sub tabs not responsive and disappeared in configuration page #5293) (fix(dashboard): wrap config sub-tabs + hide number-input spinner buttons (closes #5293) #5319) (@houko)
• Pin response_format = Json on history_fold + web_augment aux calls (closes history_fold: pass ResponseFormat::Json to aux-LLM (DeepSeek and other strict-output providers fall back to bulk_summary) #5287) (fix(runtime): pin response_format = Json on history_fold + web_augment aux calls (closes #5287) #5320) (@houko)
• Observability + regression coverage on sidecar reconnect loop (closes bug(channels/telegram): bridge does not reconnect after transient network failure #5111) (fix(channels/telegram): observability + regression coverage on sidecar reconnect loop (closes #5111) #5321) (@houko)
• Define api-error-generic across all 6 locales (audit: api-error-generic-missing-fluent-key) (fix(i18n): define api-error-generic across all 6 locales (audit: api-error-generic-missing-fluent-key) #5322) (@houko)
• Use canonical getStoredApiKey for export download (audit: audit-export-401) (fix(dashboard/audit): use canonical getStoredApiKey for export download (audit: audit-export-401) #5324) (@houko)
• Purge pending_approvals on agent cascade-delete + schema-walking guard (audit: agent-cascade-delete-missing-tables) (fix(memory): purge pending_approvals on agent cascade-delete + schema-walking guard (audit: agent-cascade-delete-missing-tables) #5328) (@houko)
• Refuse to boot without LIBREFANG_STATE_SECRET when external_auth.enabled (closes security(auth): LIBREFANG_STATE_SECRET defaults to per-process random key — breaks OIDC across restart + multi-replica #5336) (fix(kernel/boot): refuse to boot without LIBREFANG_STATE_SECRET when external_auth.enabled (closes #5336) #5337) (@houko)
• Validate skill name + hand against path traversal (closes security(api/skills): Path traversal in POST /api/skills/install via name / hand #5338) (fix(api/skills): validate skill name + hand against path traversal (closes #5338) #5339) (@houko)
• Wrap upload_routes in route-local RequestBodyLimitLayer (closes security(api/upload): Upload route bypasses global body-limit + buffers full body to RAM #5342) (fix(api/upload): wrap upload_routes in route-local RequestBodyLimitLayer (closes #5342) #5343) (@houko)
• Cap triggers per agent at MAX_TRIGGERS_PER_AGENT = 50 (closes dos(kernel/triggers): TriggerEngine::register has no per-agent cap #5345) (fix(kernel/triggers): cap triggers per agent at MAX_TRIGGERS_PER_AGENT = 50 (closes #5345) #5346) (@houko)
• Verify caller owns from_agent_id before comms_send (closes security(api/comms): /api/comms/send does not verify caller owns from_agent_id (impersonation) #5349) (fix(api/comms): verify caller owns from_agent_id before comms_send (closes #5349) #5350) (@houko)
• SSRF-validate URLs at create + update (closes security(api/webhooks): create/update webhook lacks SSRF blocklist (persisted hostile URLs) #5352) (fix(api/webhooks): SSRF-validate URLs at create + update (closes #5352) #5353) (@houko)
• Gate require_auth_for_reads=false bypass behind external_auth_proxy (closes security(api): require_auth_for_reads=Some(false) honored without external proxy → reads leak on non-loopback bind #5356) (fix(api): gate require_auth_for_reads=false bypass behind external_auth_proxy (closes #5356) #5357) (@houko)
• Add /api/auth/callback to rate-limit allowlist (closes security(api/auth): /api/auth/callback not in rate-limit allowlist — captured state can DoS login #5358) (fix(api/auth): add /api/auth/callback to rate-limit allowlist (closes #5358) #5359) (@houko)
• Expect() on serde_json::to_writer in stream_json (closes fix(api/audit): audit_export streaming swallows serde_json error → malformed JSON possible #5360) (fix(api/audit): expect() on serde_json::to_writer in stream_json (closes #5360) #5361) (@houko)
• Write Argon2id upgrade-hint to 0600 file instead of log (closes security(api/dashboard): legacy-plaintext upgrade logs Argon2id PHC at INFO (verifier in logs) #5364) (fix(api/dashboard): write Argon2id upgrade-hint to 0600 file instead of log (closes #5364) #5365) (@houko)
• Kernel_err_to_status helper for 404/409 mapping (closes fix(api/agents): session/model/clone handlers map AgentNotFound → 500 (should be 404), AgentAlreadyExists → 500 (should be 409) #5366) (fix(api/agents): kernel_err_to_status helper for 404/409 mapping (closes #5366) #5367) (@houko)
• Require auth on GitHub Copilot OAuth endpoints (closes security(api/providers): GitHub Copilot OAuth endpoints unauthenticated → hostile page can hijack GITHUB_TOKEN #5369) (fix(api/providers): require auth on GitHub Copilot OAuth endpoints (closes #5369) #5370) (@houko)
• Atomic-rename write for secrets.env eliminates 0644 TOCTOU (closes security(api/skills): write_secret_env TOCTOU — secrets.env readable at 0644 before chmod 0600 #5371) (fix(api/skills): atomic-rename write for secrets.env eliminates 0644 TOCTOU (closes #5371) #5372) (@houko)
• Scrub raw rusqlite errors before responding (fix(api): scrub raw rusqlite errors before responding #5378) (@houko)
• Split /api/auth/login allowlist into exact + slash-prefix (fix(api/auth): split /api/auth/login allowlist into exact + slash-prefix #5382) (@houko)
• Always emit Secure on logout cookie clear (fix(api/auth): always emit Secure on logout cookie clear #5384) (@houko)
• Anchor [SILENT] cron marker to message prefix (fix(kernel): anchor [SILENT] cron marker to message prefix #5386) (@houko)
• Clamp listing endpoints — no more limit=None → full collection (fix(api): clamp listing endpoints — no more limit=None → full collection #5388) (@houko)
• Rel=noopener noreferrer + safeUrl on MCP catalog get_url (fix(dashboard): rel=noopener noreferrer + safeUrl on MCP catalog get_url #5390) (@houko)
• Hand-write Debug to redact OAuthTokens secrets (fix(types/oauth): hand-write Debug to redact OAuthTokens secrets #5395) (@houko)
• Warn on serde(other) Unknown variants with raw tag (fix(wire): warn on serde(other) Unknown variants with raw tag #5397) (@houko)
• Bind cleanup_orphan_sessions IN-clause instead of string-concat (fix(memory): bind cleanup_orphan_sessions IN-clause instead of string-concat #5401) (@houko)
• Hotfix dangling refs from feat(channels)!: migrate matrix from in-process adapter to sidecar #5368 + feat(channels)!: migrate feishu from in-process adapter to sidecar #5380 sidecar migrations (FeishuConfig + pulldown-cmark) (fix: hotfix dangling refs from #5368 + #5380 sidecar migrations (FeishuConfig + pulldown-cmark) #5402) (@houko)
• Drop dangling channels.feishu access in openclaw roundtrip test (fix(migrate): drop dangling channels.feishu access in openclaw roundtrip test #5404) (@houko)
• Bound regex cache at 4096 entries with FIFO eviction (fix(kernel-router): bound regex cache at 4096 entries with FIFO eviction #5406) (@houko)
• Per-process random anonymous fingerprint (fix(api/mcp-auth): per-process random anonymous fingerprint #5410) (@houko)
• Wire check_json_depth into global request middleware (fix(api): wire check_json_depth into global request middleware #5412) (@houko)
• Use SHA-256 (128-bit truncated) for DriverCache::cache_key (fix(llm-drivers): use SHA-256 (128-bit truncated) for DriverCache::cache_key #5414) (@houko)
• Persist trimmed active_sessions after periodic GC (fix(api/server): persist trimmed active_sessions after periodic GC #5419) (@houko)
• Tighten SQLite database files to 0o600 + data dir to 0o700 (fix(memory): tighten SQLite database files to 0o600 + data dir to 0o700 #5422) (@houko)
• Recover sessionWebhook via ChannelUser.librefang_user (fix(channels/dingtalk-sidecar): recover sessionWebhook via ChannelUser.librefang_user #5423) (@houko)
• Sanitize Custom channel names that collide with kernel-internal cron/autonomous/webui (fix(channels): sanitize Custom channel names that collide with kernel-internal cron/autonomous/webui #5425) (@houko)
• Byte + char dual cap on chat-message size (fix(api/validation): byte + char dual cap on chat-message size #5427) (@houko)
• Saturating_add inner cache-token sum (fix(kernel-metering): saturating_add inner cache-token sum #5430) (@houko)
• Recover passive-reply msg_id via ChannelUser.librefang_user (fix(channels/qq-sidecar): recover passive-reply msg_id via ChannelUser.librefang_user #5431) (@houko)
• Apply foreign_keys=ON + full PRAGMA set to PromptStore second pool (fix(memory/prompt): apply foreign_keys=ON + full PRAGMA set to PromptStore second pool #5434) (@houko)
• Scan raw string for command substitution — close double-quote bypass (fix(runtime/sandbox): scan raw string for command substitution — close double-quote bypass #5436) (@houko)
• Recover per-message reply correlation via ChannelUser.librefang_user across 6 sidecars (fix(channels/sidecars): recover per-message reply correlation via ChannelUser.librefang_user across 6 sidecars #5439) (@houko)
• Size-bounded PII regex compilation (fix(runtime/pii_filter): size-bounded PII regex compilation #5444) (@houko)
• Repair persisted session after trim+pinned-rescue (fix(runtime/agent_loop): repair persisted session after trim+pinned-rescue #5447) (@houko)
• Recover context_token via librefang_user across sidecar restart (fix(channels/wechat-sidecar): recover context_token via librefang_user across sidecar restart #5448) (@houko)
• Recover req_id via librefang_user across sidecar restart (fix(channels/wecom-sidecar): recover req_id via librefang_user across sidecar restart #5449) (@houko)
• Include traceback + cmd_type when on_command bare-except logs (fix(sdk): include traceback + cmd_type when on_command bare-except logs #5450) (@houko)
• WARN on env-vs-keyring master-key divergence (fix(extensions/vault): WARN on env-vs-keyring master-key divergence #5453) (@houko)
• Recover main build from sidecar fallout (missing default + orphans + test drift) (fix: recover main build from sidecar fallout (missing default + orphans + test drift) #5456) (@houko)
• Repair test build after feat(channels)!: migrate webhook from in-process adapter to sidecar #5455 (write_service_account_env removed) (fix(api/skills): repair test build after #5455 (write_service_account_env removed) #5460) (@houko)
• Cross-audit follow-ups (Retry-After x4, dedupe x2, LINE reply API) (fix(channels/sidecars): cross-audit follow-ups (Retry-After x4, dedupe x2, LINE reply API) #5462) (@houko)
• Rewrite ModuleNotFoundError into actionable install hint (fix(channels/sidecars): rewrite ModuleNotFoundError into actionable install hint #5465) (@houko)
• Preserve specific cause in last_error after circuit-breaker trip (fix(channels/sidecar): preserve specific cause in last_error after circuit-breaker trip #5468) (@houko)
• Redact WhatsApp JIDs atomically (no partial-redact via phone regex) (fix(runtime/pii_filter): redact WhatsApp JIDs atomically (no partial-redact via phone regex) #5469) (@f-liva)
• Recover reply context via XRPC on cache miss (closes channels/bluesky-sidecar: _thread_cache lost on sidecar restart — replies degrade to top-level skeets #5452) (fix(channels/bluesky-sidecar): recover reply context via XRPC on cache miss (closes #5452) #5471) (@houko)
• Demote /api/metrics 401 from WARN to DEBUG (fix(api/middleware): demote /api/metrics 401 from WARN to DEBUG #5482) (@houko)
• Repair 3 pre-existing main CI breakers inherited by all open PRs (fix(ci): repair 3 pre-existing main CI breakers inherited by all open PRs #5486) (@houko)
• Ack duplicate /approve <id> instead of error-shaped not-found (fix(api/channel_bridge): ack duplicate /approve <id> instead of error-shaped not-found #5487) (@houko)
• Wake idle agent after approval resolve so the chat gets the result (fix(kernel/approval): wake idle agent after approval resolve so the chat gets the result #5488) (@houko)
• Suppress redundant /approve|/reject ack on inline-keyboard tap (fix(channels/bridge): suppress redundant /approve|/reject ack on inline-keyboard tap #5490) (@houko)
• Route agent reply through channel after wake — fixes "tap Approve → silence" (fix(kernel/approval): route agent reply through channel after wake — fixes "tap Approve → silence" #5491) (@houko)
• Cargo fmt + regenerate sdk/ to repair main CI (Quality, OpenAPI Drift) (fix(ci): cargo fmt + regenerate sdk/ to repair main CI (Quality, OpenAPI Drift) #5494) (@houko)
• Log only email domain at INFO in OIDC auth_callback (fix(oauth): log only email domain at INFO in OIDC auth_callback #5504) (@houko)
• Sanitize reserved channel names at every SenderContext ingress (fix(kernel/channels): sanitize reserved channel names at every SenderContext ingress #5506) (@houko)
• Return path relative to home_dir, not absolute (fix(api/registry): return path relative to home_dir, not absolute #5509) (@houko)
• Keyboard nav for NotificationCenter (WAI-ARIA Menu Button) (fix(dashboard/a11y): keyboard nav for NotificationCenter (WAI-ARIA Menu Button) #5510) (@houko)
• Record comms_send in hash-chained audit log (fix(api/network): record comms_send in hash-chained audit log #5512) (@houko)
• Reject empty code in OAuth callback before token exchange (fix(api/mcp_auth): reject empty code in OAuth callback before token exchange #5515) (@houko)
• SSRF-validate attachment URLs + DNS-rebind pin (fix(api/agents): SSRF-validate attachment URLs + DNS-rebind pin #5517) (@houko)
• Cap bulk-handler Vec::with_capacity to prevent DoS pre-allocation (fix(api/routes): cap bulk-handler Vec::with_capacity to prevent DoS pre-allocation #5520) (@houko)
• Bound buckets map with hard cap + periodic sweep (fix(channels/rate-limiter): bound buckets map with hard cap + periodic sweep #5522) (@houko)
• Never log raw IdP token-endpoint response bodies (fix(security/oauth): never log raw IdP token-endpoint response bodies #5526) (@houko)
• Detect partial-upgrade drift between migrations table and user_version pragma (fix(memory/migration): detect partial-upgrade drift between migrations table and user_version pragma #5528) (@houko)
• Never silently default or fabricate from corrupt JSON-in-TEXT columns (fix(memory): never silently default or fabricate from corrupt JSON-in-TEXT columns #5532) (@houko)
• Reclaim per-session bucket on session delete (fix(runtime/file_read_tracker): reclaim per-session bucket on session delete #5534) (@houko)
• Bound RoundRobin cursor with cycle-aware iteration (fix(llm-drivers/credential-pool): bound RoundRobin cursor with cycle-aware iteration #5536) (@houko)
• Restore main — rustfmt drift + 2 PR-only test failures (fix(ci): restore main — rustfmt drift + 2 PR-only test failures #5538) (@houko)
• Release prune lock across try_summarize_trim().await; CAS on messages_generation (fix(kernel/cron): release prune lock across try_summarize_trim().await; CAS on messages_generation #5541) (@houko)
• Validate provider name shape before deriving env var (fix(api/providers): validate provider name shape before deriving env var #5542) (@houko)
• Bijective SHA-256 agent_id suffix to stop container-name collisions (fix(runtime/sandbox-docker): bijective SHA-256 agent_id suffix to stop container-name collisions #5545) (@houko)
• Hold ledger mutex across check + add (fix(kernel-metering): hold ledger mutex across check + add #5548) (@houko)
• Validate tool args at boundary before forwarding to MCP server (fix(runtime-mcp): validate tool args at boundary before forwarding to MCP server #5550) (@houko)
• Acquire per-agent semaphore in workflow send_message closure (fix(kernel/workflow): acquire per-agent semaphore in workflow send_message closure #5554) (@houko)
• Cap system_prompt size and lock down create-handler invariants (fix(api/prompts): cap system_prompt size and lock down create-handler invariants #5558) (@houko)
• Allow zero spaces in attribution regex (fix(hooks/commit-msg): allow zero spaces in attribution regex #5560) (@houko)
• Swap RefCell for parking_lot::Mutex to remove async borrow-panic footgun (fix(runtime/held_agent_locks): swap RefCell for parking_lot::Mutex to remove async borrow-panic footgun #5563) (@houko)
• Reject .. per-segment in react_asset, not by substring (fix(api/webchat): reject .. per-segment in react_asset, not by substring #5565) (@houko)
• Switch useSessionStream to authenticated WebSocket (fix(dashboard/queries): switch useSessionStream to authenticated WebSocket #5567) (@houko)
• Make agent_concurrency_for entry construction atomic (fix(kernel): make agent_concurrency_for entry construction atomic #5569) (@houko)
• Hash session tokens at rest in sessions.json — backup-snapshot replay resistance (fix(api/auth): hash session tokens at rest in sessions.json — backup-snapshot replay resistance #5571) (@houko)
• #[serde(skip_serializing)] api_key + proxy_url (fix(llm-driver/DriverConfig): #[serde(skip_serializing)] api_key + proxy_url #5573) (@houko)
• Escape translator HTML, route via (fix(dashboard/i18n): escape translator HTML, route via <Trans> #5576) (@houko)
• Canonicalize + containment-check source/target_dir (fix(api/migrate): canonicalize + containment-check source/target_dir #5577) (@houko)
• Warn at boot when declared provider API-key env vars are unset or empty (fix(kernel/boot): warn at boot when declared provider API-key env vars are unset or empty #5579) (@houko)
• Gate X-Forwarded-Proto on trusted_proxies for session cookie Secure flag (fix(api/auth): gate X-Forwarded-Proto on trusted_proxies for session cookie Secure flag #5581) (@houko)
• Allowlist --network and --cap-add to prevent sandbox collapse (fix(sandbox/docker): allowlist --network and --cap-add to prevent sandbox collapse #5583) (@houko)
• Install-deps program allowlist + flag denylist + Owner-only role (fix(api/skills): install-deps program allowlist + flag denylist + Owner-only role #5588) (@houko)
• Warn on manifest swap when session_mode or max_concurrent_invocations changes (fix(kernel/registry): warn on manifest swap when session_mode or max_concurrent_invocations changes #5590) (@houko)
• Remove partial identity files on write failure (fix(kernel/workspace): remove partial identity files on write failure #5592) (@houko)
• Evict JWKS + discovery caches on external_auth hot-reload (fix(api/oauth): evict JWKS + discovery caches on external_auth hot-reload #5594) (@houko)
• Fail-closed when guard-bash-safety lib is missing (fix(hooks): fail-closed when guard-bash-safety lib is missing #5596) (@houko)
• Rephrase strip_images placeholder so LLM does not deny image reception (fix(types/message): rephrase strip_images placeholder so LLM does not deny image reception #5597) (@DaBlitzStein)
• Wrap connect_mcp_servers spawns in spawn_supervised (fix(api/mcp): wrap connect_mcp_servers spawns in spawn_supervised #5599) (@houko)
• Hold Lane::Trigger permit across run_workflow spawn (fix(kernel/workflow): hold Lane::Trigger permit across run_workflow spawn #5602) (@houko)
• Derive deterministic SessionId for New-mode fires (fix(kernel/triggers): derive deterministic SessionId for New-mode fires #5604) (@houko)
• Align missed-fire log with single-catchup behaviour (fix(kernel/cron): align missed-fire log with single-catchup behaviour #5606) (@houko)
• Classify refresh failures, single-flight refresh, drop unwrap (fix(kernel/oauth): classify refresh failures, single-flight refresh, drop unwrap #5609) (@houko)
• Allow known framework source dirs, not just the librefang home (fix(api/migrate): allow known framework source dirs, not just the librefang home #5614) (@houko)
• Backfill missing #[utoipa::path] handlers + regenerate openapi.json (fix(api/openapi): backfill missing #[utoipa::path] handlers + regenerate openapi.json #5620) (@houko)
• API-surface hygiene — SPA route allowlist, registry id validation, auth/providers gating (fix(api): API-surface hygiene — SPA route allowlist, registry id validation, auth/providers gating #5638) (@houko)
• Non-IdP external_auth edits are a no-op, not a restart (fix(kernel/config): non-IdP external_auth edits are a no-op, not a restart #5646) (@houko)
• Propagate sender peer_id through remember_interaction_b… (fix(runtime): propagate sender peer_id through remember_interaction_b… #5647) (@Chukwuebuka-2003)
• Persist /sync since_token across restarts (fix(channels/matrix-sidecar): persist /sync since_token across restarts #5651) (@neo-wanderer)
• External_auth IdP change is hot-reload, not restart (restore main) (fix(kernel/config): external_auth IdP change is hot-reload, not restart (restore main) #5652) (@houko)
• Clear clippy Quality lane (needless borrow, doc indentation, manual char comparison, await-holding-lock) (fix(api): clear clippy Quality lane (needless borrow, doc indentation, manual char comparison, await-holding-lock) #5654) (@houko)
• Downgrade boot integrity-check failure to WARN (fix(audit): downgrade boot integrity-check failure to WARN #5659) (@houko)
• Migrate legacy shared-namespace row on fallback hit (fix(runtime/host_kv_get): migrate legacy shared-namespace row on fallback hit #5660) (@houko)
• Bound graceful shutdown so daemon.lock release isn't blocked by a hung phase (fix(daemon): bound graceful shutdown so daemon.lock release isn't blocked by a hung phase #5662) (@houko)
• Plug data leaks, restore lost state, harden parsing (fix(agent_loop): plug data leaks, restore lost state, harden parsing #5674) (@leszek3737)
• Harden pre-commit + add detect-secrets CI workflow (fix(ci/hooks): harden pre-commit + add detect-secrets CI workflow #5681) (@houko)
• CommsKeys hierarchy + TerminalTabs storage helper + Modal autoFocus (fix(dashboard): commsKeys hierarchy + TerminalTabs storage helper + Modal autoFocus #5682) (@houko)
• Soft-cap in-memory entries between trims at 1.5x max_in_memory_entries (fix(runtime-audit): soft-cap in-memory entries between trims at 1.5x max_in_memory_entries #5683) (@houko)
• Harden build.rs git/date invocation; document pnpm audit ignores (fix(build): harden build.rs git/date invocation; document pnpm audit ignores #5684) (@houko)
• WARN when [agents..proactive_memory] appears in config.toml (real path is agent.toml) (fix(kernel/config): WARN when [agents.<name>.proactive_memory] appears in config.toml (real path is agent.toml) #5687) (@houko)
• Filter /commands dispatch by account_id (multi-bot isolation) (fix(channels): filter /commands dispatch by account_id (multi-bot isolation) #5688) (@houko)
• Widen exclusions, regenerate baseline, ignore generated_at drift (fix(ci/secret-scan): widen exclusions, regenerate baseline, ignore generated_at drift #5691) (@houko)
• Update audit_retention_test for fix(runtime-audit): soft-cap in-memory entries between trims at 1.5x max_in_memory_entries #5683 soft-cap drain (fix(runtime-audit): update audit_retention_test for #5683 soft-cap drain #5693) (@houko)
• Strip line_number drift from detect-secrets baseline diff (fix(ci/secret-scan): strip line_number drift from detect-secrets baseline diff #5695) (@houko)
• Log bot_token fingerprint instead of full token (fixes Python wechat sidecar logs full bot_token at DEBUG (regression vs old Rust path) #5543) (fix(sidecar/wechat): log bot_token fingerprint instead of full token (fixes #5543) #5700) (@houko)
• Replace removed all-channels feature with telemetry (fix(docker): replace removed all-channels feature with telemetry #5702) (@houko)
• Add provider_budget_routes_test to detect-secrets baseline (fix(secrets): add provider_budget_routes_test to detect-secrets baseline #5707) (@houko)
• Regenerate SDKs for /api/budget/providers to repair main CI drift (fix(sdk): regenerate SDKs for /api/budget/providers to repair main CI drift #5709) (@houko)
• Include sdk/python/librefang in flake source filter (fix(nix): include sdk/python/librefang in flake source filter #5714) (@houko)

Changed

• Unify error contracts — RFC + ToolError + first migration (arch: inconsistent error contracts — String / anyhow / LibreFangError / LlmError mixed #3576) (refactor: unify error contracts — RFC + ToolError + first migration (#3576) #5258) (@houko)
• Extract shared helpers + WS client + test fakes (refactor(sidecar): extract shared helpers + WS client + test fakes #5335) (@houko)
• Return librefang-types IntegrationError from install_integration (stop leaking ExtensionResult) (refactor(kernel): return librefang-types IntegrationError from install_integration (stop leaking ExtensionResult) #5622) (@houko)
• Return types-owned outcome from install_integration (stop leaking InstallResult) (refactor(kernel): return types-owned outcome from install_integration (stop leaking InstallResult) #5644) (@houko)
• Widen ApiErrorResponse::internal_scrub sweep across routes (refactor(api): widen ApiErrorResponse::internal_scrub sweep across routes #5661) (@houko)

Performance

• Use count_sessions() on status + snapshot (audit: list-sessions-decode-on-poll) (perf(api/config): use count_sessions() on status + snapshot (audit: list-sessions-decode-on-poll) #5326) (@houko)
• Use list_arcs() in agent_budget_ranking (closes perf(api/budget): agent_budget_ranking deep-clones every AgentEntry #5347) (perf(api/budget): use list_arcs() in agent_budget_ranking (closes #5347) #5348) (@houko)
• Evict stale tool-call timestamps on push (closes perf(kernel/scheduler): tool_call_timestamps deque grows unbounded when limit=0 (default) #5362) (perf(kernel/scheduler): evict stale tool-call timestamps on push (closes #5362) #5363) (@houko)
• Rotate to next key on first RateLimit (closes perf(kernel/pool): PooledDriver hammers rate-limited key up to 6 times before rotating #5373) (perf(kernel/pool): rotate to next key on first RateLimit (closes #5373) #5374) (@houko)
• Tx-wrap recall access bump + batched IN hydrate (closes perf(memory): recall N+1 — per-row UPDATE without tx + per-id vector hydrate #5375) (perf(memory): tx-wrap recall access bump + batched IN hydrate (closes #5375) #5376) (@houko)
• Composite sessions(agent_id, updated_at) + audit_entries(agent_id, timestamp) indexes (perf(memory/migration): composite sessions(agent_id, updated_at) + audit_entries(agent_id, timestamp) indexes #5399) (@houko)
• Stream extract_text_content into a single String to avoid per-save Vec allocation (perf(memory): stream extract_text_content into a single String to avoid per-save Vec<String> allocation #5501) (@houko)
• Offload SQLite insert+prune via spawn_blocking, counter-gate prune (perf(runtime/trace_store): offload SQLite insert+prune via spawn_blocking, counter-gate prune #5524) (@houko)
• Block_in_place for ImageFile reads (4 sites) (perf(llm-drivers): block_in_place for ImageFile reads (4 sites) #5530) (@houko)
• Memoize dashboard_snapshot_inner with 900ms TTL cache (perf(api/config): memoize dashboard_snapshot_inner with 900ms TTL cache #5552) (@houko)
• Unblock axum executor on create_backup + persist_budget (spawn_blocking) (perf(api): unblock axum executor on create_backup + persist_budget (spawn_blocking) #5556) (@houko)

Full diff: v2026.5.17-beta.12...v2026.5.25-beta.13