CHANGELOG.md
Rama main · réplica de lectura del repositorio original.
# Changelog
All notable changes to the `nimbus` core (headless Gateway + CLI binary + first-party MCP connectors) are documented in this file. release-please appends new entries between this header and the most recent version below when a release PR merges.
## [10.48.0](https://github.com/nimbus-agent/Nimbus/compare/v10.47.0...v10.48.0) (2026-11-11)
### Features
* **gateway:** scheduled workflows run unattended, and a write without a standing rule waits for you (Phase 10 SA4) ([#1964](https://github.com/nimbus-agent/Nimbus/issues/1964)) ([c9b2cbb](https://github.com/nimbus-agent/Nimbus/commit/c9b2cbb8527e31879f845cd3c2ed7c0f02476e0b))
## [10.47.0](https://github.com/nimbus-agent/Nimbus/compare/v10.46.0...v10.47.0) (2026-11-11)
### Features
* **gateway:** approve a recurring workflow write once, with a standing rule bound to the exact workflow (Phase 10 SA3, I55) ([#1962](https://github.com/nimbus-agent/Nimbus/issues/1962)) ([e55bbb7](https://github.com/nimbus-agent/Nimbus/commit/e55bbb7e60b3266aca81b4bdbd793da1bd22f958))
## [10.46.0](https://github.com/nimbus-agent/Nimbus/compare/v10.45.0...v10.46.0) (2026-11-11)
### Features
* **gateway:** a workflow can archive Gmail threads from a declared query, every write asked (Phase 10 SA2) ([#1960](https://github.com/nimbus-agent/Nimbus/issues/1960)) ([6ada37d](https://github.com/nimbus-agent/Nimbus/commit/6ada37de0fb5d33d6cfd0e85d896bafa45457471))
## [10.45.0](https://github.com/nimbus-agent/Nimbus/compare/v10.44.0...v10.45.0) (2026-11-10)
### Features
* **gateway:** record where each approval came from, and make room for a standing-approved status (Phase 10 SA1) ([#1958](https://github.com/nimbus-agent/Nimbus/issues/1958)) ([1c97307](https://github.com/nimbus-agent/Nimbus/commit/1c9730729fa161818258e7f95eb9f94d5499f7d6))
## [10.44.0](https://github.com/nimbus-agent/Nimbus/compare/v10.43.0...v10.44.0) (2026-11-10)
### Features
* **gateway:** the model can propose a Kubernetes apply, rollout restart or scale, in owner-approved namespaces, behind the full diff and a typed confirmation ([#1955](https://github.com/nimbus-agent/Nimbus/issues/1955)) ([be71be3](https://github.com/nimbus-agent/Nimbus/commit/be71be39c9ddd665f8ed8a1c935c888ad87c1389))
## [10.43.0](https://github.com/nimbus-agent/Nimbus/compare/v10.42.0...v10.43.0) (2026-11-10)
### Features
* **gateway:** the model can propose a Vercel, Netlify, Bitrise or Codemagic build or a TestFlight or Firebase release, each behind its before-state and a typed confirmation ([#1950](https://github.com/nimbus-agent/Nimbus/issues/1950)) ([5351174](https://github.com/nimbus-agent/Nimbus/commit/53511743fde07784ec46166bdd8e20a9cd8c81c2))
## [10.42.0](https://github.com/nimbus-agent/Nimbus/compare/v10.41.0...v10.42.0) (2026-11-09)
### Features
* **gateway:** the model can propose a Terraform apply or CloudFormation deploy, in owner-approved directories, behind the full plan ([#1945](https://github.com/nimbus-agent/Nimbus/issues/1945)) ([5ba90ee](https://github.com/nimbus-agent/Nimbus/commit/5ba90ee45c07f5a0ac7fe0f915273829d9f5859d))
## [10.41.0](https://github.com/nimbus-agent/Nimbus/compare/v10.40.0...v10.41.0) (2026-11-08)
### Features
* **gateway:** the model can propose a GitHub or GitLab commit, approved over a full gateway-rendered diff with a bound head ([#1943](https://github.com/nimbus-agent/Nimbus/issues/1943)) ([4dbe6ab](https://github.com/nimbus-agent/Nimbus/commit/4dbe6ab5cf46282cf7deed06df2eecb626c594b7))
## [10.40.0](https://github.com/nimbus-agent/Nimbus/compare/v10.39.0...v10.40.0) (2026-11-08)
### Features
* **gateway:** the model can propose 27 irreversible writes (merges, deletes, CI runs, cloud ops, GitOps, ML, warehouse), each behind its before-state and a typed confirmation ([#1940](https://github.com/nimbus-agent/Nimbus/issues/1940)) ([bf5df09](https://github.com/nimbus-agent/Nimbus/commit/bf5df09b6e83da270e6484d2bfbfd803f12b8349))
## [10.39.0](https://github.com/nimbus-agent/Nimbus/compare/v10.38.1...v10.39.0) (2026-11-08)
### Features
* **gateway:** one GitHub Enterprise Server instance through github.api_base ([#1936](https://github.com/nimbus-agent/Nimbus/issues/1936)) ([7686d74](https://github.com/nimbus-agent/Nimbus/commit/7686d74e52bee5b67f4d3161db705a1bcdbd2133))
## [10.38.1](https://github.com/nimbus-agent/Nimbus/compare/v10.38.0...v10.38.1) (2026-11-07)
### Bug Fixes
* **gateway:** the Teams webhook acks before it processes, and dedupes every activity on its id ([#1933](https://github.com/nimbus-agent/Nimbus/issues/1933)) ([062cfaf](https://github.com/nimbus-agent/Nimbus/commit/062cfaff52b4ff82982daf7cd02745048496c592))
## [10.38.0](https://github.com/nimbus-agent/Nimbus/compare/v10.37.0...v10.38.0) (2026-11-07)
### Features
* **gateway:** typed confirmation over ChatOps, a Slack modal and a Teams card input ([#1931](https://github.com/nimbus-agent/Nimbus/issues/1931)) ([091f51b](https://github.com/nimbus-agent/Nimbus/commit/091f51baab0163c2bc925a28d1138fa6239bc9c3))
## [10.37.0](https://github.com/nimbus-agent/Nimbus/compare/v10.36.0...v10.37.0) (2026-11-07)
### Features
* **gateway:** bound writes, a gate-run prepare step whose values alone reach dispatch (I54) ([#1929](https://github.com/nimbus-agent/Nimbus/issues/1929)) ([e7ecbe8](https://github.com/nimbus-agent/Nimbus/commit/e7ecbe8bc5d78b101f99b29d468af4325618cfa3))
## [10.36.0](https://github.com/nimbus-agent/Nimbus/compare/v10.35.0...v10.36.0) (2026-11-06)
### Features
* **gateway:** type-to-confirm on every Wave 4 prompt, on every door ([#1927](https://github.com/nimbus-agent/Nimbus/issues/1927)) ([15073bc](https://github.com/nimbus-agent/Nimbus/commit/15073bce79506de5cad3c890169536687278f3ee))
## [10.35.0](https://github.com/nimbus-agent/Nimbus/compare/v10.34.0...v10.35.0) (2026-11-06)
### Features
* **gateway:** offer the flag writes and the JSM Operations alert writes, and store an optional Jira cloud id ([#1925](https://github.com/nimbus-agent/Nimbus/issues/1925)) ([5f57ad5](https://github.com/nimbus-agent/Nimbus/commit/5f57ad5bba8aa6090bf97b5abf331a464aaefe8e))
## [10.34.0](https://github.com/nimbus-agent/Nimbus/compare/v10.33.0...v10.34.0) (2026-11-06)
### Features
* **gateway:** offer the GitHub and GitLab branch and PR/MR writes, refused on both doors for mentions, quick actions and remote content ([#1923](https://github.com/nimbus-agent/Nimbus/issues/1923)) ([a73ae94](https://github.com/nimbus-agent/Nimbus/commit/a73ae947f760b031d6f14d307259b6d8661b9848))
## [10.33.0](https://github.com/nimbus-agent/Nimbus/compare/v10.32.0...v10.33.0) (2026-11-06)
### Features
* **gateway:** pin connectors 0.6.0, classify the Wave 3 writes, offer the Drive, OneDrive, PR close and PagerDuty writes ([#1921](https://github.com/nimbus-agent/Nimbus/issues/1921)) ([0c79015](https://github.com/nimbus-agent/Nimbus/commit/0c79015c22b4a4ad3eb3558dcffeae79ecccf4ca))
## [10.32.0](https://github.com/nimbus-agent/Nimbus/compare/v10.31.0...v10.32.0) (2026-11-06)
### Features
* **gateway:** Waves 3-4 reclassification; the model is never offered a mail send ([#1918](https://github.com/nimbus-agent/Nimbus/issues/1918)) ([08ab190](https://github.com/nimbus-agent/Nimbus/commit/08ab1908ee479544d519a290bdbb58a62bfe4130))
## [10.31.0](https://github.com/nimbus-agent/Nimbus/compare/v10.30.0...v10.31.0) (2026-11-06)
### Features
* **gateway:** sent mail, Teams and forge Markdown cannot load remote content, on both doors ([#1916](https://github.com/nimbus-agent/Nimbus/issues/1916)) ([eabe782](https://github.com/nimbus-agent/Nimbus/commit/eabe782d57807f0ca4cab23861357e4714694232))
## [10.30.0](https://github.com/nimbus-agent/Nimbus/compare/v10.29.0...v10.30.0) (2026-11-06)
### Features
* **gateway:** model-written drafts and pages cannot load remote content, on both doors ([#1913](https://github.com/nimbus-agent/Nimbus/issues/1913)) ([9270fae](https://github.com/nimbus-agent/Nimbus/commit/9270faeb224aa0a915c8fd72c88a4219719d77f7))
## [10.29.0](https://github.com/nimbus-agent/Nimbus/compare/v10.28.0...v10.29.0) (2026-11-05)
### Features
* **gateway:** the model can propose an Obsidian daily-note append; the sandbox may write only today's note ([#1911](https://github.com/nimbus-agent/Nimbus/issues/1911)) ([babdf72](https://github.com/nimbus-agent/Nimbus/commit/babdf72ad44e58c5ab0b0841d94af1986157b462))
## [10.28.0](https://github.com/nimbus-agent/Nimbus/compare/v10.27.0...v10.28.0) (2026-11-05)
### Features
* **gateway:** connectors 0.5.0 — the Confluence knowledge-base guard reads page ancestors ([#1908](https://github.com/nimbus-agent/Nimbus/issues/1908)) ([936f3d8](https://github.com/nimbus-agent/Nimbus/commit/936f3d8ce15419cf4eddd2859ec11d64066b59df))
## [10.27.0](https://github.com/nimbus-agent/Nimbus/compare/v10.26.0...v10.27.0) (2026-11-05)
### Features
* **gateway:** the model can propose calendar invites and Drive files, each behind your approval ([#1906](https://github.com/nimbus-agent/Nimbus/issues/1906)) ([c536c08](https://github.com/nimbus-agent/Nimbus/commit/c536c0849e7ddffd1ce094f0518c4ee082b95577))
## [10.26.0](https://github.com/nimbus-agent/Nimbus/compare/v10.25.0...v10.26.0) (2026-11-05)
### Features
* **gateway:** the model can propose email drafts and page writes, each behind your approval ([#1903](https://github.com/nimbus-agent/Nimbus/issues/1903)) ([c14431b](https://github.com/nimbus-agent/Nimbus/commit/c14431b00706b23a086f8cc6941914debc4c9d06))
## [10.25.0](https://github.com/nimbus-agent/Nimbus/compare/v10.24.0...v10.25.0) (2026-11-05)
### Features
* **gateway:** the model can propose issue writes, each behind your approval ([#1901](https://github.com/nimbus-agent/Nimbus/issues/1901)) ([c5835c4](https://github.com/nimbus-agent/Nimbus/commit/c5835c41555cc8a819f1ded8e4fba9c22aa882c8))
## [10.24.0](https://github.com/nimbus-agent/Nimbus/compare/v10.23.0...v10.24.0) (2026-11-05)
### Features
* **engine:** a before-state can read twice and refuse a write before the prompt ([#1899](https://github.com/nimbus-agent/Nimbus/issues/1899)) ([f718759](https://github.com/nimbus-agent/Nimbus/commit/f718759b2d9f8a896102cf4bab3dd30298e3893b))
## [10.23.0](https://github.com/nimbus-agent/Nimbus/compare/v10.22.0...v10.23.0) (2026-11-05)
### Features
* **gateway:** the model can propose messages and comments, each behind your approval ([#1897](https://github.com/nimbus-agent/Nimbus/issues/1897)) ([2e9bf37](https://github.com/nimbus-agent/Nimbus/commit/2e9bf379e2ed85bd3dce74f7d87917df76751d20))
## [10.22.0](https://github.com/nimbus-agent/Nimbus/compare/v10.21.0...v10.22.0) (2026-11-05)
### Features
* **gateway:** connectors 0.4.0 — classify its new Wave-2 writes ([#1895](https://github.com/nimbus-agent/Nimbus/issues/1895)) ([e2e45e9](https://github.com/nimbus-agent/Nimbus/commit/e2e45e936296c67a800f19d4ddd6787d9bc282f8))
## [10.21.0](https://github.com/nimbus-agent/Nimbus/compare/v10.20.0...v10.21.0) (2026-11-05)
### Features
* **gateway:** the model door shows a write's current state before you approve it ([#1891](https://github.com/nimbus-agent/Nimbus/issues/1891)) ([137e77c](https://github.com/nimbus-agent/Nimbus/commit/137e77c70f2c30bb705d5d06423fbf5ef4e45673))
## [10.20.0](https://github.com/nimbus-agent/Nimbus/compare/v10.19.0...v10.20.0) (2026-11-05)
### Features
* **gateway:** a typed preview in the approval prompt for connector writes ([#1884](https://github.com/nimbus-agent/Nimbus/issues/1884)) ([535dc80](https://github.com/nimbus-agent/Nimbus/commit/535dc80202a8b3705477fd61cf06c9e276f59404))
* **gateway:** owner opt-in for model connector writes (nimbus connector writes) ([#1887](https://github.com/nimbus-agent/Nimbus/issues/1887)) ([6b6479f](https://github.com/nimbus-agent/Nimbus/commit/6b6479f5f019b791e38d7871778f48253f658d00))
* **gateway:** plumbing for the model's connector-write door ([#1888](https://github.com/nimbus-agent/Nimbus/issues/1888)) ([c2b356f](https://github.com/nimbus-agent/Nimbus/commit/c2b356f7c2753e2b61c6c6428dcf80ebd2005c5f))
* **gateway:** the model's connector-write door (I53) ([#1889](https://github.com/nimbus-agent/Nimbus/issues/1889)) ([6afc99a](https://github.com/nimbus-agent/Nimbus/commit/6afc99a3314b6e905bbac6ee2c916a8f97471159))
* **gateway:** Wave-2 framework for model connector writes ([#1890](https://github.com/nimbus-agent/Nimbus/issues/1890)) ([3d96472](https://github.com/nimbus-agent/Nimbus/commit/3d9647263e50fe671bd0d99b769b33bee7e6e2e4))
## [10.19.0](https://github.com/nimbus-agent/Nimbus/compare/v10.18.0...v10.19.0) (2026-11-04)
### Features
* **cli:** scaffold an extension from an OpenAPI document ([#1881](https://github.com/nimbus-agent/Nimbus/issues/1881)) ([42767ca](https://github.com/nimbus-agent/Nimbus/commit/42767caab96d8429e405229b34451473f7192df1))
* **extensions:** manifest funding and license, and nimbus extension sponsor ([#1878](https://github.com/nimbus-agent/Nimbus/issues/1878)) ([af08869](https://github.com/nimbus-agent/Nimbus/commit/af088696c9784ee26040798f620a4d9281d25ebe))
* **extensions:** nimbus extension clone writes an editable copy of a published extension ([#1880](https://github.com/nimbus-agent/Nimbus/issues/1880)) ([6012e3f](https://github.com/nimbus-agent/Nimbus/commit/6012e3f8df688852c21062af81c3ba8cf905511c))
## [10.18.0](https://github.com/nimbus-agent/Nimbus/compare/v10.17.0...v10.18.0) (2026-11-03)
### Features
* **eval:** record a golden suite from a package's own replies ([#1866](https://github.com/nimbus-agent/Nimbus/issues/1866)) ([eb03531](https://github.com/nimbus-agent/Nimbus/commit/eb03531d4cbbe56610710949892451b16e1c0a6b))
* **extensions:** an owner-approved network grant may be narrower than the manifest (I52) ([#1877](https://github.com/nimbus-agent/Nimbus/issues/1877)) ([518aae2](https://github.com/nimbus-agent/Nimbus/commit/518aae24bdc6020a181ecc67fdfc4b1c018def08))
* **extensions:** observe an extension's network on Linux, and nimbus extension audit ([#1872](https://github.com/nimbus-agent/Nimbus/issues/1872)) ([1e26967](https://github.com/nimbus-agent/Nimbus/commit/1e26967b4278ddd4f77ed5ee21e99b8f8d147aea))
* **extensions:** observe an extension's network on Windows and macOS ([#1873](https://github.com/nimbus-agent/Nimbus/issues/1873)) ([be0cc28](https://github.com/nimbus-agent/Nimbus/commit/be0cc28072e1aeac504b30fe4b79ce90e590b486))
* **extensions:** warn when an extension's observed network goes beyond what it declared ([#1875](https://github.com/nimbus-agent/Nimbus/issues/1875)) ([cfd928c](https://github.com/nimbus-agent/Nimbus/commit/cfd928c93374a1ad6f8aa3a378229e9ec43918bb))
### Bug Fixes
* **deps:** clear the postcss-selector-parser advisory and recheck katex ([#1871](https://github.com/nimbus-agent/Nimbus/issues/1871)) ([8ed853b](https://github.com/nimbus-agent/Nimbus/commit/8ed853bf6f295d72b7de2cb5ce4fb46200768437))
## [10.17.0](https://github.com/nimbus-agent/Nimbus/compare/v10.16.0...v10.17.0) (2026-11-02)
### Features
* **gateway:** index Metabase saved questions ([#1856](https://github.com/nimbus-agent/Nimbus/issues/1856)) ([878766d](https://github.com/nimbus-agent/Nimbus/commit/878766d65391e94c2fc1f3b636bdb93e230d0ee6))
* **registry:** publish a signed liveness.json from a scheduled, keyless check ([#1862](https://github.com/nimbus-agent/Nimbus/issues/1862)) ([caf8a0a](https://github.com/nimbus-agent/Nimbus/commit/caf8a0a51ded491d651b1637b1ed4e95524f6598))
## [10.16.0](https://github.com/nimbus-agent/Nimbus/compare/v10.15.0...v10.16.0) (2026-11-02)
### Features
* **registry:** show a registry's signed liveness checks on the Checked line ([932c79d](https://github.com/nimbus-agent/Nimbus/commit/932c79df4d0fd1b5bd20f830b68ddff05e58fd17))
## [10.15.0](https://github.com/nimbus-agent/Nimbus/compare/v10.14.2...v10.15.0) (2026-11-02)
### Features
* **extensions:** show what the sandbox will actually do, on every permission surface ([#1852](https://github.com/nimbus-agent/Nimbus/issues/1852)) ([51953ee](https://github.com/nimbus-agent/Nimbus/commit/51953ee8f308ec56fcc30ad6d31c7979e0e8df66))
* **extensions:** state who tested a package, and show a score drop on update ([#1854](https://github.com/nimbus-agent/Nimbus/issues/1854)) ([ec4ebf6](https://github.com/nimbus-agent/Nimbus/commit/ec4ebf6a20966e1683b74bf2daef800706bd9d52))
* **registry:** sign a Nimbus-owned baseline for every package, and let maintain add sign scores ([#1857](https://github.com/nimbus-agent/Nimbus/issues/1857)) ([81202a5](https://github.com/nimbus-agent/Nimbus/commit/81202a56afa77bd0ebe2325241fb4c69d084db18))
## [10.14.2](https://github.com/nimbus-agent/Nimbus/compare/v10.14.1...v10.14.2) (2026-11-01)
### Bug Fixes
* **sandbox:** Windows diagnostics report all_or_nothing, not per_host ([#1848](https://github.com/nimbus-agent/Nimbus/issues/1848)) ([770e59f](https://github.com/nimbus-agent/Nimbus/commit/770e59fbedaf7b13e4fd0317f307f153b8ef84fe))
## [10.14.1](https://github.com/nimbus-agent/Nimbus/compare/v10.14.0...v10.14.1) (2026-11-01)
### Bug Fixes
* **release:** build the rpm with rpmbuild so the apt and dnf repo can publish again ([#1845](https://github.com/nimbus-agent/Nimbus/issues/1845)) ([114cf69](https://github.com/nimbus-agent/Nimbus/commit/114cf699561212493feb171d1873f36add7a0b0e))
## [10.14.0](https://github.com/nimbus-agent/Nimbus/compare/v10.13.0...v10.14.0) (2026-11-01)
### Features
* **sandbox:** ship the Linux network forwarder, so a child reaches only its declared hosts ([#1841](https://github.com/nimbus-agent/Nimbus/issues/1841)) ([860cfd8](https://github.com/nimbus-agent/Nimbus/commit/860cfd87df3ce98cfacedbd85ed43ce0dc1dee05))
### Bug Fixes
* **sandbox:** let a macOS child with a declared network start, limited to its declared ports ([#1842](https://github.com/nimbus-agent/Nimbus/issues/1842)) ([c4730bb](https://github.com/nimbus-agent/Nimbus/commit/c4730bbbf0c03db327f6f1ddb03eee232111e77b))
## [10.13.0](https://github.com/nimbus-agent/Nimbus/compare/v10.12.0...v10.13.0) (2026-10-31)
### Features
* **connectors:** index a pull request's source branch and return it from resolve ([#1836](https://github.com/nimbus-agent/Nimbus/issues/1836)) ([a28f7d2](https://github.com/nimbus-agent/Nimbus/commit/a28f7d2f54a2bac1eba8321fa586efc2ecffb3c9))
## [10.12.0](https://github.com/nimbus-agent/Nimbus/compare/v10.11.1...v10.12.0) (2026-10-31)
### Features
* **sandbox:** enforce declared hosts on Linux through a local forwarder ([#1834](https://github.com/nimbus-agent/Nimbus/issues/1834)) ([e6908ed](https://github.com/nimbus-agent/Nimbus/commit/e6908edbbb6de62a7e370c17db0589dc45004061))
### Bug Fixes
* **connectors:** keep the port of a self-hosted connector's URL, and declare every host a connector calls ([#1830](https://github.com/nimbus-agent/Nimbus/issues/1830)) ([eb9bc7e](https://github.com/nimbus-agent/Nimbus/commit/eb9bc7eb97897effe9d5629198e45794b7c1441f))
## [10.11.1](https://github.com/nimbus-agent/Nimbus/compare/v10.11.0...v10.11.1) (2026-10-30)
### Bug Fixes
* **sandbox:** let bubblewrap start on stock Ubuntu 24.04, and detect when it cannot ([#1827](https://github.com/nimbus-agent/Nimbus/issues/1827)) ([17c7ce7](https://github.com/nimbus-agent/Nimbus/commit/17c7ce700f8dc65b7043af111959cc65b7b9feff))
## [10.11.0](https://github.com/nimbus-agent/Nimbus/compare/v10.10.0...v10.11.0) (2026-10-30)
### Features
* **eval:** nimbus eval --installed compares every installed extension's local score with its registry's, behind one approval ([#1824](https://github.com/nimbus-agent/Nimbus/issues/1824)) ([c5d0157](https://github.com/nimbus-agent/Nimbus/commit/c5d015721130beb46ea8c29f0135dbb5a3330c40))
* **registry:** registry CI scores extension evals in a secret-free job and signs a quality score; search and info show it ([#1822](https://github.com/nimbus-agent/Nimbus/issues/1822)) ([87ec34f](https://github.com/nimbus-agent/Nimbus/commit/87ec34f87a862071e9c16153d9222ecaa45e8b4c))
## [10.10.0](https://github.com/nimbus-agent/Nimbus/compare/v10.9.0...v10.10.0) (2026-10-29)
### Features
* **eval:** nimbus eval --extension evaluates an installed extension behind one owner approval (extension.eval) ([#1821](https://github.com/nimbus-agent/Nimbus/issues/1821)) ([0a1ce6a](https://github.com/nimbus-agent/Nimbus/commit/0a1ce6a1befd5a9b1cbf835b6d3771338b50fa9c))
* **eval:** nimbus eval --package runs an extension's eval suites in the sandbox, offline and without credentials (I49) ([#1819](https://github.com/nimbus-agent/Nimbus/issues/1819)) ([4e34677](https://github.com/nimbus-agent/Nimbus/commit/4e34677c274f03103a4a23f7ac625414a1921fff))
* **registry-format:** eval suite format, deterministic scorer, evals/ in packages and a registry-signed quality field ([#1817](https://github.com/nimbus-agent/Nimbus/issues/1817)) ([43cb6a4](https://github.com/nimbus-agent/Nimbus/commit/43cb6a45c334d3864e9bf5c939106a169639740a))
## [10.9.0](https://github.com/nimbus-agent/Nimbus/compare/v10.8.0...v10.9.0) (2026-10-29)
### Features
* **extensions:** an extension's connector requirements show their status in the install approval, info, list and doctor, and an attended install offers a walk through approvals and connecting ([#1811](https://github.com/nimbus-agent/Nimbus/issues/1811)) ([01c46ed](https://github.com/nimbus-agent/Nimbus/commit/01c46edfb1f48248fe48a750b16443300cd50364))
* **extensions:** an update that adds dependencies lists them in its approval and installs them from the right registry, all or nothing ([#1814](https://github.com/nimbus-agent/Nimbus/issues/1814)) ([f18d931](https://github.com/nimbus-agent/Nimbus/commit/f18d931849a1dc1cf56b7dd47e71cca634d17eec))
* **extensions:** registry installs fetch their dependencies from the right registry, in one approved plan ([#1810](https://github.com/nimbus-agent/Nimbus/issues/1810)) ([ac07b02](https://github.com/nimbus-agent/Nimbus/commit/ac07b0260a73575c201c2cd25b731de23708a8ec))
* **extensions:** starter packs install with their members, never run, keep explicitly installed dependencies, and offer to remove the members only they needed ([#1813](https://github.com/nimbus-agent/Nimbus/issues/1813)) ([2f15dce](https://github.com/nimbus-agent/Nimbus/commit/2f15dce125af1e6f043653b8c10a88738f7af604))
* **registry-format:** manifest format for cross-registry dependencies, connector requirements and starter packs ([#1806](https://github.com/nimbus-agent/Nimbus/issues/1806)) ([b3affbb](https://github.com/nimbus-agent/Nimbus/commit/b3affbb509f097f07224552618ccc054e08d17d8))
### Bug Fixes
* **deps:** re2js 2.9.1 (GHSA-gg6h-894w-4m9c); accept @hono/node-server GHSA-rmxm-3fg6-px4f (serveStatic never loaded) ([#1812](https://github.com/nimbus-agent/Nimbus/issues/1812)) ([8b637ea](https://github.com/nimbus-agent/Nimbus/commit/8b637ea3cbf2f29717347e11fd485f5fda4530c2))
* **extensions:** dependency follow-ups — air-gap reuse, truthful refusals, findable orphans, complete connector commands ([#1815](https://github.com/nimbus-agent/Nimbus/issues/1815)) ([a4ff6e1](https://github.com/nimbus-agent/Nimbus/commit/a4ff6e12fbf4d53289256e4c5611369b43ee8489))
## [10.8.0](https://github.com/nimbus-agent/Nimbus/compare/v10.7.0...v10.8.0) (2026-10-27)
### Features
* **trust:** the release bakes the Nimbus trust feed and a verified snapshot of it ([#1803](https://github.com/nimbus-agent/Nimbus/issues/1803)) ([47b4f6c](https://github.com/nimbus-agent/Nimbus/commit/47b4f6c93fa048c71d7f6e1d89f618b2a7cf92ca))
### Bug Fixes
* **deps:** @modelcontextprotocol/node 2.1.1 (GHSA-f897-62hf-6gxq) ([#1804](https://github.com/nimbus-agent/Nimbus/issues/1804)) ([19cdfe7](https://github.com/nimbus-agent/Nimbus/commit/19cdfe7a81ad0fce55c0a4e7708f0a47147aa062))
## [10.7.0](https://github.com/nimbus-agent/Nimbus/compare/v10.6.0...v10.7.0) (2026-10-27)
### Features
* **trust:** a registry vouches for a version's build provenance ([#1801](https://github.com/nimbus-agent/Nimbus/issues/1801)) ([1313e3d](https://github.com/nimbus-agent/Nimbus/commit/1313e3def340cdcac65b6b9fa8cdd0e525bb9edd))
* **trust:** nimbus trust maintain builds and signs the Nimbus trust feed ([#1799](https://github.com/nimbus-agent/Nimbus/issues/1799)) ([001b8eb](https://github.com/nimbus-agent/Nimbus/commit/001b8eb9c09696605f9060f878a481ca94737009))
* **trust:** registry maintainers revoke keys and take extensions down; nimbus extension report ([#1796](https://github.com/nimbus-agent/Nimbus/issues/1796)) ([9c67412](https://github.com/nimbus-agent/Nimbus/commit/9c6741245dffb6882e99f20d11cbae3b64de1e0d))
* **trust:** show a verified-publisher badge everywhere an extension's publisher appears (R6) ([#1794](https://github.com/nimbus-agent/Nimbus/issues/1794)) ([c3360b6](https://github.com/nimbus-agent/Nimbus/commit/c3360b67538f9a18b882d28dbfd234ae8008952c))
### Bug Fixes
* **deps:** qs 6.16.1 (GHSA-6pq8-jhm2-2vcw) ([#1802](https://github.com/nimbus-agent/Nimbus/issues/1802)) ([ae231c7](https://github.com/nimbus-agent/Nimbus/commit/ae231c70b2e3938ace3b944de69ffab948800f3a))
## [10.6.0](https://github.com/nimbus-agent/Nimbus/compare/v10.5.0...v10.6.0) (2026-10-27)
### Features
* **registry:** trust-layer formats and storage; refuse an equivocating registry index ([#1783](https://github.com/nimbus-agent/Nimbus/issues/1783)) ([4c0beb9](https://github.com/nimbus-agent/Nimbus/commit/4c0beb97f98c322377476be99f561b79d955a1bb))
* **trust:** publishers can rotate keys; a revoked key taints the keys it rotated to (rotation, R3–R5, R8) ([#1792](https://github.com/nimbus-agent/Nimbus/issues/1792)) ([88fe6de](https://github.com/nimbus-agent/Nimbus/commit/88fe6de0c9d60208be4c4b77645cf5a3c8c465bc))
* **trust:** publishers rotate and revoke keys through a registry (extension key rotate|revoke, publish --statement) ([#1793](https://github.com/nimbus-agent/Nimbus/issues/1793)) ([e575610](https://github.com/nimbus-agent/Nimbus/commit/e57561067bf9edb3ac47728ee19b605782857a92))
* **trust:** refuse revoked or taken-down extensions at install, update and spawn until the owner re-approves (I48) ([#1790](https://github.com/nimbus-agent/Nimbus/issues/1790)) ([e0321d8](https://github.com/nimbus-agent/Nimbus/commit/e0321d86c03c9f6b6cf78718ddf29641b86e3c69))
* **trust:** store trust statements, fetch the trust feed on a timer, nimbus trust status|refresh ([#1785](https://github.com/nimbus-agent/Nimbus/issues/1785)) ([ad7cb3c](https://github.com/nimbus-agent/Nimbus/commit/ad7cb3c885fe81d597f3cd644ad8e79eb61f4cda))
## [10.5.0](https://github.com/nimbus-agent/Nimbus/compare/v10.4.0...v10.5.0) (2026-10-25)
### Features
* **decisions:** role packs and your config choose which sources decisions are mined from ([#1774](https://github.com/nimbus-agent/Nimbus/issues/1774)) ([50391fb](https://github.com/nimbus-agent/Nimbus/commit/50391fb5cb51a1a56ada7b3cac8e05e3a457c687))
* **desktop:** onboarding asks what you do and installs the matching role pack ([#1782](https://github.com/nimbus-agent/Nimbus/issues/1782)) ([2e0dcd8](https://github.com/nimbus-agent/Nimbus/commit/2e0dcd8517d200b9d241b9243eec057c47dc3c9b))
* **glossary:** role packs and your config choose which sources glossary terms come from ([#1776](https://github.com/nimbus-agent/Nimbus/issues/1776)) ([fd29256](https://github.com/nimbus-agent/Nimbus/commit/fd292567daf9089b307b8cb87261d67d19262b71))
* **google-drive:** index Google Docs with their text; the Product pack (1.1.0) mines them ([#1780](https://github.com/nimbus-agent/Nimbus/issues/1780)) ([4fbb00a](https://github.com/nimbus-agent/Nimbus/commit/4fbb00af11fd09ded8a934a6c7ee9aa8abc6ee6b))
* **mcp-sink:** an MCP agent can propose obsidian.note.append ([#1779](https://github.com/nimbus-agent/Nimbus/issues/1779)) ([71eb151](https://github.com/nimbus-agent/Nimbus/commit/71eb15107912aceb9506a6c56263616c6706e5f2))
* **onboarding:** nimbus init asks what you do and works outside a git repository ([#1781](https://github.com/nimbus-agent/Nimbus/issues/1781)) ([0c00274](https://github.com/nimbus-agent/Nimbus/commit/0c00274b53e69025d0ba6b226b702d248c238e03))
### Bug Fixes
* **install:** Windows uninstaller runs on PowerShell 5.1, stops its own gateway and reports what it could not remove ([#1778](https://github.com/nimbus-agent/Nimbus/issues/1778)) ([a4c99cf](https://github.com/nimbus-agent/Nimbus/commit/a4c99cfd6e5819e5566b90481fd680780d0a3a84))
## [10.4.0](https://github.com/nimbus-agent/Nimbus/compare/v10.3.1...v10.4.0) (2026-10-25)
### Features
* **catalog:** agent visibility and a catalog of agents and connectors ([#1757](https://github.com/nimbus-agent/Nimbus/issues/1757)) ([81ff8ec](https://github.com/nimbus-agent/Nimbus/commit/81ff8ec0a5538bbd420171ff4e05569a36f52117))
* **fleet:** a bad fleet job drops only itself, and enabled = false disables one ([#1752](https://github.com/nimbus-agent/Nimbus/issues/1752)) ([0d932de](https://github.com/nimbus-agent/Nimbus/commit/0d932de0b276a987aadec861b347d69c6889bbe3))
* **oncall-push:** a role pack can turn the pushed brief on, live ([#1767](https://github.com/nimbus-agent/Nimbus/issues/1767)) ([232fa19](https://github.com/nimbus-agent/Nimbus/commit/232fa19136d896c6173b85f972fd2f312de8c0e4))
* **packs:** install and remove role packs behind the owner's pack.install approval ([#1764](https://github.com/nimbus-agent/Nimbus/issues/1764)) ([a7db19a](https://github.com/nimbus-agent/Nimbus/commit/a7db19aa4e3b7201946065ff2fdeb4cac5813b81))
* **registry-format:** role-pack manifest format and registry packs entry ([#1762](https://github.com/nimbus-agent/Nimbus/issues/1762)) ([e3ae39e](https://github.com/nimbus-agent/Nimbus/commit/e3ae39e6975d6514d3b242d966b305988e110053))
* **ui:** the desktop follows your role packs ([#1770](https://github.com/nimbus-agent/Nimbus/issues/1770)) ([7a14406](https://github.com/nimbus-agent/Nimbus/commit/7a14406ab829636b3d619d97233d45f9899505bb))
## [10.3.1](https://github.com/nimbus-agent/Nimbus/compare/v10.3.0...v10.3.1) (2026-10-24)
### Bug Fixes
* **admin-console:** mount views as DOM nodes instead of innerHTML (Sonar S5696) ([#1749](https://github.com/nimbus-agent/Nimbus/issues/1749)) ([d33a2f1](https://github.com/nimbus-agent/Nimbus/commit/d33a2f1db04038404d54d4b6701f1ca47b8b0bee))
* **deps:** clear main's red Security run (withdrawn braces advisory, tokio + clipboard-win) ([#1748](https://github.com/nimbus-agent/Nimbus/issues/1748)) ([baba9ce](https://github.com/nimbus-agent/Nimbus/commit/baba9cebe4bdab6efc1dbfdba4abe54fa667b669))
* **deps:** clear the 2026-10-24 advisories (zod, body-parser, undici, http-cache-semantics, fast-uri, nodemailer) ([#1754](https://github.com/nimbus-agent/Nimbus/issues/1754)) ([a2b5dda](https://github.com/nimbus-agent/Nimbus/commit/a2b5dda2c1334491aadfa5604eca32bdddb725c6))
## [10.3.0](https://github.com/nimbus-agent/Nimbus/compare/v10.2.0...v10.3.0) (2026-10-23)
### Features
* **extensions:** publish extensions to a GitHub-hosted registry (Phase 9.5 project 2) ([#1745](https://github.com/nimbus-agent/Nimbus/issues/1745)) ([e6648b4](https://github.com/nimbus-agent/Nimbus/commit/e6648b4311d6f0e093da379dd0f2009c523786f1))
## [10.2.0](https://github.com/nimbus-agent/Nimbus/compare/v10.1.2...v10.2.0) (2026-10-23)
### Features
* **extensions:** extension approve says when the sync it registered came up paused ([#1742](https://github.com/nimbus-agent/Nimbus/issues/1742)) ([b9ee967](https://github.com/nimbus-agent/Nimbus/commit/b9ee967e34f5e92054dc430a91a620c73c2521c4))
### Bug Fixes
* **extensions:** registering an extension's sync pauses it when the sandbox cannot confine it ([#1737](https://github.com/nimbus-agent/Nimbus/issues/1737)) ([196e675](https://github.com/nimbus-agent/Nimbus/commit/196e675827f679edb603c033f25cf1b9adee1288))
* **health:** an unconfigured connector reads not_configured from its first run ([#1741](https://github.com/nimbus-agent/Nimbus/issues/1741)) ([0805c0f](https://github.com/nimbus-agent/Nimbus/commit/0805c0f7175fca192231e5ad6b0a23e77cc51675))
* **index:** rebody forces a full run, and --since survives a run already in flight ([#1739](https://github.com/nimbus-agent/Nimbus/issues/1739)) ([4fb51b9](https://github.com/nimbus-agent/Nimbus/commit/4fb51b978c29008da68543fcec66e90c610062ea))
* **sync:** skip an unconfigured connector's sync instead of probing the Vault for it ([#1735](https://github.com/nimbus-agent/Nimbus/issues/1735)) ([1aeb34e](https://github.com/nimbus-agent/Nimbus/commit/1aeb34e8ee3adc86c87e37fe2af9c22c0635af5f))
## [10.1.2](https://github.com/nimbus-agent/Nimbus/compare/v10.1.1...v10.1.2) (2026-10-23)
### Bug Fixes
* **index:** rebody skips a service no connector is registered for instead of waiting forever ([#1730](https://github.com/nimbus-agent/Nimbus/issues/1730)) ([eb58154](https://github.com/nimbus-agent/Nimbus/commit/eb58154af68f436737539b1f3e559d58961f1d6e))
* **sync:** connector.sync waits for a run that started after it ([#1727](https://github.com/nimbus-agent/Nimbus/issues/1727)) ([002bc8b](https://github.com/nimbus-agent/Nimbus/commit/002bc8b94fd2bfc305f29c1cd1309465281d841f))
## [10.1.1](https://github.com/nimbus-agent/Nimbus/compare/v10.1.0...v10.1.1) (2026-10-23)
### Bug Fixes
* **extensions:** migrate accept pauses a sync the sandbox cannot confine before it answers ([#1729](https://github.com/nimbus-agent/Nimbus/issues/1729)) ([17518bd](https://github.com/nimbus-agent/Nimbus/commit/17518bd441a12b97fcea2755a76ee338ee564ce9))
* **extensions:** re-check a legacy-key binding before storing or reading an extension credential ([#1726](https://github.com/nimbus-agent/Nimbus/issues/1726)) ([4da0e18](https://github.com/nimbus-agent/Nimbus/commit/4da0e18b966ef96881b7cfb9a77f67bfffbafcae))
* **index:** pausing or resuming without a scheduler records the health transition ([#1728](https://github.com/nimbus-agent/Nimbus/issues/1728)) ([5b5906d](https://github.com/nimbus-agent/Nimbus/commit/5b5906d59bb77870bf65b97b6f113cb64e896683))
## [10.1.0](https://github.com/nimbus-agent/Nimbus/compare/v10.0.0...v10.1.0) (2026-10-23)
### Features
* **config:** layered config reader; profiles inherit from nimbus.toml ([#1714](https://github.com/nimbus-agent/Nimbus/issues/1714)) ([780303e](https://github.com/nimbus-agent/Nimbus/commit/780303ecd3570d85ab5c4a73403570fd5b38aeda))
* **config:** pack layers under the user's config, allowlisted and conflict-checked ([#1718](https://github.com/nimbus-agent/Nimbus/issues/1718)) ([b03e5c2](https://github.com/nimbus-agent/Nimbus/commit/b03e5c2fa1ceec5856697b70a7d674dd7f0d6704))
* **fleet:** fleet config changes apply without a restart ([#1724](https://github.com/nimbus-agent/Nimbus/issues/1724)) ([72a67fb](https://github.com/nimbus-agent/Nimbus/commit/72a67fb6c2eec81b97d31280ece6c2aa2645fc6c))
### Bug Fixes
* **cli:** vault set reads the value from a hidden prompt or stdin ([#1723](https://github.com/nimbus-agent/Nimbus/issues/1723)) ([c5cefb8](https://github.com/nimbus-agent/Nimbus/commit/c5cefb840fe42a856b1998c3930c218c4963c782))
* **deps:** ip-address 10.7.4 for GHSA-rxp7-6hxx-x8q5 ([#1717](https://github.com/nimbus-agent/Nimbus/issues/1717)) ([7d9701f](https://github.com/nimbus-agent/Nimbus/commit/7d9701f7874f2c00fa1f2660af0ac58f8327d615))
* **extensions:** say on Windows that a run approval's host list is not enforced ([#1716](https://github.com/nimbus-agent/Nimbus/issues/1716)) ([a012fed](https://github.com/nimbus-agent/Nimbus/commit/a012fed7603ed913824fc61bc73bf6fdf00ce919))
## [10.0.0](https://github.com/nimbus-agent/Nimbus/compare/v9.2.1...v10.0.0) (2026-10-22)
### ⚠ BREAKING CHANGES
* **security:** code-audit batch 1 — DNS-rebinding guard (I45), data-scoped HTTP reads, owner-only files, batched sync writes ([#1702](https://github.com/nimbus-agent/Nimbus/issues/1702))
### Features
* **connectors:** Readwise ships from the registry, not the binary ([#1713](https://github.com/nimbus-agent/Nimbus/issues/1713)) ([968f966](https://github.com/nimbus-agent/Nimbus/commit/968f966e4d2b5dceedbe7727d2818f630081ff1a))
* **desktop:** answer the Readwise migration from the desktop (I46) ([#1711](https://github.com/nimbus-agent/Nimbus/issues/1711)) ([fc5218a](https://github.com/nimbus-agent/Nimbus/commit/fc5218ab5a99ce4083e3fcbfc68a3eb94cbc2908))
* **extensions:** built-in official registry and connector migration ([#1709](https://github.com/nimbus-agent/Nimbus/issues/1709)) ([fb22b92](https://github.com/nimbus-agent/Nimbus/commit/fb22b9295f4a8b5c4d0fcd484c1b38122f855475))
* **extensions:** extensions can sync into the index ([#1705](https://github.com/nimbus-agent/Nimbus/issues/1705)) ([61e034a](https://github.com/nimbus-agent/Nimbus/commit/61e034a57a7aade40035365f5af30332787bbac0))
* **extensions:** owner-approved per-extension credentials ([#1703](https://github.com/nimbus-agent/Nimbus/issues/1703)) ([c5312fb](https://github.com/nimbus-agent/Nimbus/commit/c5312fb29d6f0b7d0718040e928c962d3e49be6c))
* **security:** code-audit batch 1 — DNS-rebinding guard (I45), data-scoped HTTP reads, owner-only files, batched sync writes ([#1702](https://github.com/nimbus-agent/Nimbus/issues/1702)) ([c77258c](https://github.com/nimbus-agent/Nimbus/commit/c77258c4ae7f596682a22a2ed457891b9dc19c98))
### Bug Fixes
* **deps:** MCP SDK 2.3.1 and vite 8.3.4 for today's advisories ([#1710](https://github.com/nimbus-agent/Nimbus/issues/1710)) ([4c3caa7](https://github.com/nimbus-agent/Nimbus/commit/4c3caa735fa371ddabf072ef7792e5e351a45bf4))
* **deps:** pin markdown-it 15.0.3 for GHSA-r7fv-28h4-cvq7 ([#1707](https://github.com/nimbus-agent/Nimbus/issues/1707)) ([538a5aa](https://github.com/nimbus-agent/Nimbus/commit/538a5aa7b7a4cc334cb1ae5d3a0993841bf19a3d))
## [9.2.1](https://github.com/nimbus-agent/Nimbus/compare/v9.2.0...v9.2.1) (2026-10-18)
### Bug Fixes
* **extensions:** make extension updates apply; one capped extraction pipeline ([#1695](https://github.com/nimbus-agent/Nimbus/issues/1695)) ([d69f54f](https://github.com/nimbus-agent/Nimbus/commit/d69f54f40569f5c2c3b1c33060a0cf08862ffea6))
## [9.2.0](https://github.com/nimbus-agent/Nimbus/compare/v9.1.0...v9.2.0) (2026-10-17)
### Features
* **extensions:** offer --model extensions to the engine agent (runtime PR 4 of 4) ([#1692](https://github.com/nimbus-agent/Nimbus/issues/1692)) ([075ebb2](https://github.com/nimbus-agent/Nimbus/commit/075ebb2c7af0c974b6074d91ac663b192963aeef))
## [9.1.0](https://github.com/nimbus-agent/Nimbus/compare/v9.0.0...v9.1.0) (2026-10-17)
### Features
* **extensions:** approved extensions run, sandboxed, under invariant I43 (S3 extension runtime PR 3) ([#1689](https://github.com/nimbus-agent/Nimbus/issues/1689)) ([d54fba6](https://github.com/nimbus-agent/Nimbus/commit/d54fba65b7673fce82e45c585c02388a36b75bcc))
## [9.0.0](https://github.com/nimbus-agent/Nimbus/compare/v8.0.0...v9.0.0) (2026-10-17)
### ⚠ BREAKING CHANGES
* **llm:** make LlmRegistryOptions.db required so an unledgered non-local route is a compile error ([#1372](https://github.com/nimbus-agent/Nimbus/issues/1372))
* **llm:** remove the inert remote_model key and document the vendor tables ([#1368](https://github.com/nimbus-agent/Nimbus/issues/1368))
* **llm:** ledger the ask intent classifier, and three defects found on a live install ([#1366](https://github.com/nimbus-agent/Nimbus/issues/1366))
* **llm:** the Mastra engine agent no longer falls back to a vendor API key found in the environment. An install that today relies on `ANTHROPIC_API_KEY` alone, with no `[llm.remote.*]` configuration, will stop constructing the agent — `nimbus ask` then answers from the local router if one is configured, and workflows refuse with a message naming the fix. To restore the previous behaviour, add `[llm.remote.anthropic] enabled = true` with a `model`, and store `anthropic.api_key` in the Vault. This is the point of the change rather than a side effect: a capability that turns itself on because a credential happens to exist is the air-gap defect's shape, one level up.
* **llm:** route the LLM by (provider, model) instead of provider kind ([#1352](https://github.com/nimbus-agent/Nimbus/issues/1352))
* **connectors:** delete packages/mcp-connectors — it ships from npm now ([#1347](https://github.com/nimbus-agent/Nimbus/issues/1347))
* **egress:** remove the EgressCompleteness.tier compat shim ([#1156](https://github.com/nimbus-agent/Nimbus/issues/1156))
### Features
* **agents:** a browser-viable why — agents.why answers about a pull request ([#1260](https://github.com/nimbus-agent/Nimbus/issues/1260)) ([55715b7](https://github.com/nimbus-agent/Nimbus/commit/55715b7e5989b60eef3d653fc1ba3fb56acc4faa))
* **agents:** attribute Sentry error issues to people ([#1182](https://github.com/nimbus-agent/Nimbus/issues/1182)) ([ffa54b3](https://github.com/nimbus-agent/Nimbus/commit/ffa54b3eafdbf2370b39e850e0a3ee0209894a7d))
* **agents:** give every interleaved brief disclosure one definition and a guard ([#1245](https://github.com/nimbus-agent/Nimbus/issues/1245)) ([5b9c115](https://github.com/nimbus-agent/Nimbus/commit/5b9c1152c6c0df19f0035ab401bd62413132b89b))
* **agents:** never let synthesis drop a brief's disclosures ([#1237](https://github.com/nimbus-agent/Nimbus/issues/1237)) ([f27b416](https://github.com/nimbus-agent/Nimbus/commit/f27b416b793fc096f59e73196a3b1717ca7e8764))
* **agents:** nimbus changelog — the fifteenth built-in agent ([#1496](https://github.com/nimbus-agent/Nimbus/issues/1496)) ([bc1139b](https://github.com/nimbus-agent/Nimbus/commit/bc1139b813040248de0a594de07a04a62a57bb61))
* **agents:** nimbus negotiate — a cited contribution brief ([#1166](https://github.com/nimbus-agent/Nimbus/issues/1166)) ([fa807e3](https://github.com/nimbus-agent/Nimbus/commit/fa807e30377ae6e121b58eacb0b304d85b73a4fe))
* **agents:** nimbus oncall — the seventeenth built-in agent ([#1509](https://github.com/nimbus-agent/Nimbus/issues/1509)) ([27c4211](https://github.com/nimbus-agent/Nimbus/commit/27c42111e1c44911c56f62b3c558d8808e0ccedb))
* **agents:** nimbus pre-mortem, with a service-scoped incident watcher condition ([#1146](https://github.com/nimbus-agent/Nimbus/issues/1146)) ([58e93fd](https://github.com/nimbus-agent/Nimbus/commit/58e93fd3e9e245c0ad17a3c8a3c51df815afda7a))
* **agents:** nimbus standup — the sixteenth built-in agent ([#1502](https://github.com/nimbus-agent/Nimbus/issues/1502)) ([3101702](https://github.com/nimbus-agent/Nimbus/commit/310170239b4a9ed4be1cb9092223dc1d64cc3cd7))
* **agents:** publish the gateway version on the roster response ([#1428](https://github.com/nimbus-agent/Nimbus/issues/1428)) ([d3ba71d](https://github.com/nimbus-agent/Nimbus/commit/d3ba71dd3d3513e828da301bd59472fdb2dfc456))
* **agents:** resolve a forge file coordinate to the reader's checkout ([#1424](https://github.com/nimbus-agent/Nimbus/issues/1424)) ([4770bdf](https://github.com/nimbus-agent/Nimbus/commit/4770bdffbcff9b7962f209e890d3b96f324dbb9b))
* **agents:** why, expert and ownership answer about an indexed item ([#1421](https://github.com/nimbus-agent/Nimbus/issues/1421)) ([b5fabb2](https://github.com/nimbus-agent/Nimbus/commit/b5fabb2d176f67b8286b8cdf237231ce565d9f49))
* **audit:** index lane census (report-only) ([#1561](https://github.com/nimbus-agent/Nimbus/issues/1561)) ([863f621](https://github.com/nimbus-agent/Nimbus/commit/863f621f23cfecd36d68462595478f9dbb40a249))
* **automation:** add incident_opened and deploy_failed watcher conditions ([#1138](https://github.com/nimbus-agent/Nimbus/issues/1138)) ([34601b2](https://github.com/nimbus-agent/Nimbus/commit/34601b24b98026e61f3785965cf38b38b1d414f6))
* **briefs:** research briefs draw on the whole index, not only clips ([#1253](https://github.com/nimbus-agent/Nimbus/issues/1253)) ([80c21df](https://github.com/nimbus-agent/Nimbus/commit/80c21dfa0590d1bbb6af88c6556a4a0cfb7da2d3))
* **build:** prove the connector registry can import from a package, before anything moves ([#1340](https://github.com/nimbus-agent/Nimbus/issues/1340)) ([3a1e813](https://github.com/nimbus-agent/Nimbus/commit/3a1e8138746f2f2b22ef49169ca920579d5a42b9))
* **captures:** batch accept proposed decisions, terms and links ([#1668](https://github.com/nimbus-agent/Nimbus/issues/1668)) ([64ab982](https://github.com/nimbus-agent/Nimbus/commit/64ab98286e87b20500bf322bacd04c8cc136e005))
* **captures:** purge a finished action's stored input; prune executed/failed after 90 days ([#1667](https://github.com/nimbus-agent/Nimbus/issues/1667)) ([e35e346](https://github.com/nimbus-agent/Nimbus/commit/e35e3460b6499c33f4c46736a0358fee39f56f14))
* **chatops:** invoke the built-in read-only agents from a Slack or Teams channel ([#1412](https://github.com/nimbus-agent/Nimbus/issues/1412)) ([a6a052e](https://github.com/nimbus-agent/Nimbus/commit/a6a052e2d019eb077a0b90d3a352c0d5d58cf590))
* **ci:** gate on connector version skew between the gateway and npm ([#1346](https://github.com/nimbus-agent/Nimbus/issues/1346)) ([1a2d38a](https://github.com/nimbus-agent/Nimbus/commit/1a2d38a42ab16d3d83a4a4d016944d2a74bc39d7))
* **ci:** gate on native dependencies reaching the gateway binary ([#1350](https://github.com/nimbus-agent/Nimbus/issues/1350)) ([b3ff071](https://github.com/nimbus-agent/Nimbus/commit/b3ff071c02caef844c0b8bf243e5c7b0fd4ea71b))
* **cli:** add nimbus tool run to invoke a saved generated tool ([#1521](https://github.com/nimbus-agent/Nimbus/issues/1521)) ([a89bd27](https://github.com/nimbus-agent/Nimbus/commit/a89bd2762c274d06ccf20d766eb300ebe0e871ed))
* **cli:** nimbus demo — a seeded synthetic org and a three-brief tour ([#1547](https://github.com/nimbus-agent/Nimbus/issues/1547)) ([b238a13](https://github.com/nimbus-agent/Nimbus/commit/b238a1386312746994a8a3ab4e668464c5dd1e5d))
* **cli:** nimbus explain last — an X-ray of the most recent nimbus ask ([#1514](https://github.com/nimbus-agent/Nimbus/issues/1514)) ([755c2b6](https://github.com/nimbus-agent/Nimbus/commit/755c2b6019479a1313ada85ab4d3db6726c4add4))
* **cli:** nimbus index health — index quality, not index size ([#1483](https://github.com/nimbus-agent/Nimbus/issues/1483)) ([93ac016](https://github.com/nimbus-agent/Nimbus/commit/93ac016d5a564f633732c4ba8f2eb6beb4bdb049))
* **cli:** nimbus init and nimbus demo end on the guided tour ([#1570](https://github.com/nimbus-agent/Nimbus/issues/1570)) ([fc8ce7c](https://github.com/nimbus-agent/Nimbus/commit/fc8ce7ce07de2ff8219d9647d922ae4576837a67))
* **cli:** nimbus tail — follow the gateway's operational event stream ([#1511](https://github.com/nimbus-agent/Nimbus/issues/1511)) ([9f70962](https://github.com/nimbus-agent/Nimbus/commit/9f70962084caa57c3eba05d99be40f99dd58187b))
* **cli:** nimbus wow — a guided tour of your own index, ending on a locality proof ([#1565](https://github.com/nimbus-agent/Nimbus/issues/1565)) ([8c78849](https://github.com/nimbus-agent/Nimbus/commit/8c788493e72711cebc38ec9f42726fb2c758bbcc))
* **clips:** a web clip can say who wrote it — optional source metadata on POST /v1/clips (2.5 S2) ([#1285](https://github.com/nimbus-agent/Nimbus/issues/1285)) ([1c7e818](https://github.com/nimbus-agent/Nimbus/commit/1c7e8184e04acf8b1eaddf6415e52fbda46b2001))
* **clips:** related answers about the resolved item, and its snippets come from the body ([#1232](https://github.com/nimbus-agent/Nimbus/issues/1232)) ([9f75fa3](https://github.com/nimbus-agent/Nimbus/commit/9f75fa3fe8c75a740ff86dbea09b8d80cca427b3))
* **computer-use:** I35 gate + D26 confinement for local computer-use actuation (browser lane, driver not yet wired) ([#1415](https://github.com/nimbus-agent/Nimbus/issues/1415)) ([461cebd](https://github.com/nimbus-agent/Nimbus/commit/461cebd634a96762b49270ba2dbb4b1d31d8aa9a))
* **computer-use:** raw-CDP browser lane driver; the browser egress class goes live ([#1418](https://github.com/nimbus-agent/Nimbus/issues/1418)) ([0c52e96](https://github.com/nimbus-agent/Nimbus/commit/0c52e9661282299c9927f0689c6a49bbeb0c56f6))
* **computer-use:** the terminal lane — a confined shell where nothing runs before the owner approves the whole line ([#1426](https://github.com/nimbus-agent/Nimbus/issues/1426)) ([9ad2be9](https://github.com/nimbus-agent/Nimbus/commit/9ad2be9c1d398c1eb1636115ae495e2869775d00))
* **connectors:** attribute PagerDuty incidents to people ([#1177](https://github.com/nimbus-agent/Nimbus/issues/1177)) ([20b51f6](https://github.com/nimbus-agent/Nimbus/commit/20b51f645fb118c388a4ba763514e9272ba627b2))
* **connectors:** consent-gated standalone connectors, so writes cannot run ungated off-gateway ([#1318](https://github.com/nimbus-agent/Nimbus/issues/1318)) ([e4d948a](https://github.com/nimbus-agent/Nimbus/commit/e4d948aa3c03b4a22d603b0f816d3f98bf2c3fe6))
* **connectors:** consume @nimbus-dev/connectors from npm ([#1343](https://github.com/nimbus-agent/Nimbus/issues/1343)) ([0b6ff53](https://github.com/nimbus-agent/Nimbus/commit/0b6ff53aac924d3f4251c74785d58fead450f9b8))
* **connectors:** gcloud login mode for the GCP connectors, detected and adopted ([#1557](https://github.com/nimbus-agent/Nimbus/issues/1557)) ([d01e198](https://github.com/nimbus-agent/Nimbus/commit/d01e198c3af72a188621ad407911a367ceb13c79))
* **connectors:** index GitHub PR reviews and size statistics ([#1159](https://github.com/nimbus-agent/Nimbus/issues/1159)) ([fb8a0c7](https://github.com/nimbus-agent/Nimbus/commit/fb8a0c7a1caeb8ffcf292b9b1f5ca472511e6855))
* **connectors:** index real Notion and Confluence page bodies ([#1039](https://github.com/nimbus-agent/Nimbus/issues/1039)) ([609409e](https://github.com/nimbus-agent/Nimbus/commit/609409ec07c6b72c9d817330a394e1b961ca27fb))
* **connectors:** index Sentry issues, and make the published installers able to install ([#1172](https://github.com/nimbus-agent/Nimbus/issues/1172)) ([ea37e0d](https://github.com/nimbus-agent/Nimbus/commit/ea37e0d0ca904aa9ea229146692ef945b4c80df3))
* **connectors:** nimbus connector detect — reuse existing gh, aws and kubectl logins ([#1554](https://github.com/nimbus-agent/Nimbus/issues/1554)) ([44a57ad](https://github.com/nimbus-agent/Nimbus/commit/44a57ad2ebc442bcaee6c5cd69736a136de14d4f))
* **connectors:** per-connector write action types across all 94 connectors ([#1321](https://github.com/nimbus-agent/Nimbus/issues/1321)) ([072b1fa](https://github.com/nimbus-agent/Nimbus/commit/072b1fa9682c682bfb11fe56ce8498ff32ec56f0))
* **doctor:** report embedding runtime state ([#1397](https://github.com/nimbus-agent/Nimbus/issues/1397)) ([9b3ed09](https://github.com/nimbus-agent/Nimbus/commit/9b3ed09d5e2f5677d812715234d8821b5de9eda2))
* **doctor:** warn when the on-call push cannot reach ChatOps ([#1618](https://github.com/nimbus-agent/Nimbus/issues/1618)) ([f560d92](https://github.com/nimbus-agent/Nimbus/commit/f560d929382731ad6f2bc98a4d63953fa17f1c32))
* **egress:** a targeted fetch names the client that asked for it (U2a) ([#1322](https://github.com/nimbus-agent/Nimbus/issues/1322)) ([8611b5c](https://github.com/nimbus-agent/Nimbus/commit/8611b5c72afab10338e93b438ecd27aeec3ec966))
* **egress:** ledger every non-local LLM route at the provider chokepoint ([#1357](https://github.com/nimbus-agent/Nimbus/issues/1357)) ([278e6b2](https://github.com/nimbus-agent/Nimbus/commit/278e6b2412d80d4cd7aa064e250a9a2f406b129a))
* **egress:** ledger every outbound ChatOps post ([#1403](https://github.com/nimbus-agent/Nimbus/issues/1403)) ([fcef76f](https://github.com/nimbus-agent/Nimbus/commit/fcef76f46e0e6a07f6028e91fb3ba2e6d6c1953e))
* **egress:** ledger remote embeddings and add per-task model routing ([#1384](https://github.com/nimbus-agent/Nimbus/issues/1384)) ([33273b2](https://github.com/nimbus-agent/Nimbus/commit/33273b27aa387d0fb8232847757b95d198efe602))
* **egress:** make the I29 completeness claim true — coverage vector, boot marker, required sink ([#1038](https://github.com/nimbus-agent/Nimbus/issues/1038)) ([a1169d9](https://github.com/nimbus-agent/Nimbus/commit/a1169d943aca41a339bb8fb1c6b32ee4f929e2fb))
* **egress:** record how a targeted fetch ended (U3a) ([#1325](https://github.com/nimbus-agent/Nimbus/issues/1325)) ([68db7d6](https://github.com/nimbus-agent/Nimbus/commit/68db7d63555782b7bb4f8c547c06e561fc8d75dd))
* **engine:** [persona] gives Nimbus a configurable voice ([#1248](https://github.com/nimbus-agent/Nimbus/issues/1248)) ([10b3175](https://github.com/nimbus-agent/Nimbus/commit/10b31750e57f1b3a6469b731b0942929b7f4d7fc))
* **engine:** disclose step-budget exhaustion, emit agent.gasLimitReached, make [llm] loop-guard keys live ([#1640](https://github.com/nimbus-agent/Nimbus/issues/1640)) ([57d9f25](https://github.com/nimbus-agent/Nimbus/commit/57d9f25becb23cecf73279288eb45c0da023691f))
* **engine:** negation predicates reach nimbus ask and MCP clients, refusing rather than guessing (W6-B.2) ([#1281](https://github.com/nimbus-agent/Nimbus/issues/1281)) ([5ce7505](https://github.com/nimbus-agent/Nimbus/commit/5ce7505be84d5cc3e5c0f36e96dae6872c1102b0))
* **engine:** nimbus ask --devil argues against the plan ([#1246](https://github.com/nimbus-agent/Nimbus/issues/1246)) ([becc386](https://github.com/nimbus-agent/Nimbus/commit/becc386cb9d114ed4bf9f292b3ce99cb7e97afa7))
* **exec:** sandboxed code execution behind the I33 owner gate (S2 slice 1) ([#1313](https://github.com/nimbus-agent/Nimbus/issues/1313)) ([25e2c3b](https://github.com/nimbus-agent/Nimbus/commit/25e2c3bdf8ba9b8718cf24994a31bffc36745899))
* expose the read-only agents as MCP tools, recorded in the egress ledger ([#1059](https://github.com/nimbus-agent/Nimbus/issues/1059)) ([dcc7bd7](https://github.com/nimbus-agent/Nimbus/commit/dcc7bd7d1a1bbdf04273b4769df7e0f637bbc209))
* **extensions:** run grants - approve an installed extension to run (S3 extension runtime PR 2) ([#1665](https://github.com/nimbus-agent/Nimbus/issues/1665)) ([37e2044](https://github.com/nimbus-agent/Nimbus/commit/37e2044edca30255e1b148f85cc5c0e3fc72e04e))
* **fleet:** add the overnight-fleet change digest (PR 2a) ([#1467](https://github.com/nimbus-agent/Nimbus/issues/1467)) ([4c54be8](https://github.com/nimbus-agent/Nimbus/commit/4c54be81e5363246037c5ccdd1928ff706611776))
* **fleet:** overnight sub-agent fleets on local compute — S2 PR 1 of 2 ([#1458](https://github.com/nimbus-agent/Nimbus/issues/1458)) ([d47d52e](https://github.com/nimbus-agent/Nimbus/commit/d47d52e220b56293e94628c091bac662404eb816))
* **fleet:** subject enumeration — sweep a corpus instead of naming one subject ([#1541](https://github.com/nimbus-agent/Nimbus/issues/1541)) ([c1bab10](https://github.com/nimbus-agent/Nimbus/commit/c1bab1081af5eb45d13eb0f21a6ee6d441745cc9))
* **gateway:** index Jira/Linear ticket depth and recover it via rebody --since ([#1128](https://github.com/nimbus-agent/Nimbus/issues/1128)) ([bdbecd1](https://github.com/nimbus-agent/Nimbus/commit/bdbecd16438824333aa5014bcf10a3ef19225a58))
* **gateway:** invoke read-only agents over the HTTP API, recorded in the egress ledger ([#1063](https://github.com/nimbus-agent/Nimbus/issues/1063)) ([4b4bedb](https://github.com/nimbus-agent/Nimbus/commit/4b4bedb4e000f79d63f2cddbbda2e2d92006a51e))
* **gateway:** ownership graph derived from already-indexed blame data ([#1064](https://github.com/nimbus-agent/Nimbus/issues/1064)) ([82c03d2](https://github.com/nimbus-agent/Nimbus/commit/82c03d27339290d11276f65cec795c9975432647))
* **gateway:** pre-mortem theme extraction pass (V53, PR A of 2) ([#1134](https://github.com/nimbus-agent/Nimbus/issues/1134)) ([cd1d9c2](https://github.com/nimbus-agent/Nimbus/commit/cd1d9c2e4c25e656af7db81b4de486a939139b69))
* **gateway:** read the ownership graph through the agents.ownership brief ([#1067](https://github.com/nimbus-agent/Nimbus/issues/1067)) ([e898a1e](https://github.com/nimbus-agent/Nimbus/commit/e898a1e9e204c8720050b44b73b37c52611690fc))
* **gateway:** resolve an indexed item by URL (V52 resolve_key) ([#1070](https://github.com/nimbus-agent/Nimbus/issues/1070)) ([0a32751](https://github.com/nimbus-agent/Nimbus/commit/0a32751f6e97af93b5fc405080df14bd7a77911d))
* **gateway:** scope the HTTP API bearer tokens ([#1062](https://github.com/nimbus-agent/Nimbus/issues/1062)) ([826b76a](https://github.com/nimbus-agent/Nimbus/commit/826b76a1a5352ac226bfcd3c6a88b901d6afe33a))
* **gateway:** targeted fetch-on-miss behind a derived host boundary ([#1072](https://github.com/nimbus-agent/Nimbus/issues/1072)) ([369f9af](https://github.com/nimbus-agent/Nimbus/commit/369f9af1a81e10599dc3d9b9f6c86c43bfa95fbc))
* **http:** GET /v1/items/resolve-ids — an item id back to its reference ([#1465](https://github.com/nimbus-agent/Nimbus/issues/1465)) ([8531752](https://github.com/nimbus-agent/Nimbus/commit/8531752330d23551738d815e9f6e2d6d72e75f77))
* **http:** GET /v1/metrics/stats — the bucketed DORA series, plus the change-failure-rate attribution fix ([#1493](https://github.com/nimbus-agent/Nimbus/issues/1493)) ([f6e852a](https://github.com/nimbus-agent/Nimbus/commit/f6e852a13fb81450a6952ce4817acffb1b3dcfbf))
* **http:** GET /v1/services/resolve — repo-URN-to-service resolution ([#1491](https://github.com/nimbus-agent/Nimbus/issues/1491)) ([7da3b84](https://github.com/nimbus-agent/Nimbus/commit/7da3b84dda806f712d1ca7753dc28da580a5eb67))
* **http:** read the egress ledger over HTTP, under its own scope (U1) ([#1319](https://github.com/nimbus-agent/Nimbus/issues/1319)) ([e42d66b](https://github.com/nimbus-agent/Nimbus/commit/e42d66be2728742a9f9224fe44e20d180458729a))
* **http:** resolve a forge file coordinate to a path in the reader's checkout ([#1447](https://github.com/nimbus-agent/Nimbus/issues/1447)) ([b472f67](https://github.com/nimbus-agent/Nimbus/commit/b472f67988de1f7ef16577e47da57f7c42f7e7db))
* **index:** canonical ci_run / pr / git_commit metadata contract (index lane A1) ([#1632](https://github.com/nimbus-agent/Nimbus/issues/1632)) ([232b778](https://github.com/nimbus-agent/Nimbus/commit/232b778339848c2689b3ed31f2d1a240f27d75c3))
* **index:** readers answer from the contract and disclose what they cannot (index lane A2) ([#1634](https://github.com/nimbus-agent/Nimbus/issues/1634)) ([3515729](https://github.com/nimbus-agent/Nimbus/commit/351572970cf90b541a1addcc98930aeef0a72c7a))
* **index:** the lane census is an enforced gate (index lane A3) ([#1635](https://github.com/nimbus-agent/Nimbus/issues/1635)) ([672ef16](https://github.com/nimbus-agent/Nimbus/commit/672ef168bf20305cb00884d22cf756bbd2758263))
* **ipc:** tag agent.chunk with a client-supplied streamId and add workflow.cancel ([#1165](https://github.com/nimbus-agent/Nimbus/issues/1165)) ([5779488](https://github.com/nimbus-agent/Nimbus/commit/5779488c77871113aeaecb7c9fa33c2b82ab540b))
* isolated demo root for nimbus --demo (invariant I41) ([#1545](https://github.com/nimbus-agent/Nimbus/issues/1545)) ([8791c19](https://github.com/nimbus-agent/Nimbus/commit/8791c1990e85f27364e0c8110da43709fba9b07f))
* **llm:** register four cloud vendors behind a default-off per-vendor opt-in ([#1359](https://github.com/nimbus-agent/Nimbus/issues/1359)) ([1a59735](https://github.com/nimbus-agent/Nimbus/commit/1a59735f7ee5cf3fcfe2866d804e149b3bbc3c73))
* **llm:** route the LLM by (provider, model) instead of provider kind ([#1352](https://github.com/nimbus-agent/Nimbus/issues/1352)) ([5ac042c](https://github.com/nimbus-agent/Nimbus/commit/5ac042c04fda879fdfd943eaacb99a09ae022cae))
* **mcp:** act door — agent-proposed connector actions, owner-accepted (S3, I28) ([#1660](https://github.com/nimbus-agent/Nimbus/issues/1660)) ([2714c57](https://github.com/nimbus-agent/Nimbus/commit/2714c574b79287a230fe97ad8d83eaa7853743be))
* **mcp:** capture sink — agent notes over MCP (S3, I28) ([#1653](https://github.com/nimbus-agent/Nimbus/issues/1653)) ([486aa79](https://github.com/nimbus-agent/Nimbus/commit/486aa798d3179c3e60a93ff1fe47b3bdc916991f))
* **mcp:** capture sink proposals — decisions, terms and links over MCP (S3, I28) ([#1657](https://github.com/nimbus-agent/Nimbus/issues/1657)) ([9b7ac3d](https://github.com/nimbus-agent/Nimbus/commit/9b7ac3d70983433f870e0740fbb420d36d78e434))
* **metrics:** nimbus stats charts a metric over time ([#1249](https://github.com/nimbus-agent/Nimbus/issues/1249)) ([ba316d4](https://github.com/nimbus-agent/Nimbus/commit/ba316d412fb25b83d78be798e757bd64c9fdfb80))
* **multimodal:** cloud byte-fetch for Photos, Drive and OneDrive (S2 PR 3 of 4) ([#1448](https://github.com/nimbus-agent/Nimbus/issues/1448)) ([3f7e7b6](https://github.com/nimbus-agent/Nimbus/commit/3f7e7b62668387cf61b40ff0a3ddcc6bf6cf69e9))
* **multimodal:** image understanding and sampled frame captions (S2 PR 2 of 4) ([#1438](https://github.com/nimbus-agent/Nimbus/issues/1438)) ([a24300a](https://github.com/nimbus-agent/Nimbus/commit/a24300a76e03d90a1cbe44833330a3b2a22dee35))
* **multimodal:** local audio/video understanding, indexed and searchable (S2 PR 1 of 4) ([#1429](https://github.com/nimbus-agent/Nimbus/issues/1429)) ([b995a96](https://github.com/nimbus-agent/Nimbus/commit/b995a96b2c135fa19614123df49c82033254065e))
* **multimodal:** remote vision arm with per-artifact grants, I37 and D27 — S2 PR 4 of 4 ([#1454](https://github.com/nimbus-agent/Nimbus/issues/1454)) ([580e893](https://github.com/nimbus-agent/Nimbus/commit/580e8930c7575a760cb838ce3fec4babddb0ae3a))
* **negotiate:** stop crediting agent-caused issues, messages and pages to the owner ([#1669](https://github.com/nimbus-agent/Nimbus/issues/1669)) ([6a7c84c](https://github.com/nimbus-agent/Nimbus/commit/6a7c84c193f5e4f5e45db68cc1d251822e542e1b))
* **notifications:** deliver OS notifications on Windows, macOS and Linux (pre-S3 E) ([#1646](https://github.com/nimbus-agent/Nimbus/issues/1646)) ([d0d7a61](https://github.com/nimbus-agent/Nimbus/commit/d0d7a613a8fab4477510d0dc9741b07045cda9de))
* **oncall:** post the pushed brief's headline to ChatOps (PR 2 of 3) ([#1600](https://github.com/nimbus-agent/Nimbus/issues/1600)) ([84a335e](https://github.com/nimbus-agent/Nimbus/commit/84a335ecc6045b8fac0278113d599f103a514a85))
* **oncall:** push the on-call brief when a P1 is assigned to you ([#1592](https://github.com/nimbus-agent/Nimbus/issues/1592)) ([7a4feb5](https://github.com/nimbus-agent/Nimbus/commit/7a4feb5e79947b4e9a1b381bc84f7aa7409a282d))
* **prfiles:** index PR changed-file paths behind an explicit coverage record ([#1258](https://github.com/nimbus-agent/Nimbus/issues/1258)) ([926fb80](https://github.com/nimbus-agent/Nimbus/commit/926fb80fd4f04515c6f92ef8aca40a0986746df4))
* **query:** first-class negation queries that refuse rather than answer from an empty index (W6-B.1) ([#1277](https://github.com/nimbus-agent/Nimbus/issues/1277)) ([10c20cb](https://github.com/nimbus-agent/Nimbus/commit/10c20cb0cbb2daaf83585ff81346acfdce7a247c))
* **sandbox:** a real Windows sandbox leg, and a policy-shaped runner interface ([#1294](https://github.com/nimbus-agent/Nimbus/issues/1294)) ([54c20c9](https://github.com/nimbus-agent/Nimbus/commit/54c20c98714a85b1a57d5166938c4cd2bedcc457))
* **search:** disclose keyword-only and mid-backfill results; typed embedding query timeout ([#1535](https://github.com/nimbus-agent/Nimbus/issues/1535)) ([c6c7e27](https://github.com/nimbus-agent/Nimbus/commit/c6c7e27b75901cbfa19f7b03b4514d6fb63d831c))
* **security:** I32 — clip source metadata is whitelist-constructed, so a page cannot deny ingestion of its own clip ([#1288](https://github.com/nimbus-agent/Nimbus/issues/1288)) ([5587c84](https://github.com/nimbus-agent/Nimbus/commit/5587c84e55eff015ea508a423fb7365e14ce94f9))
* **sync:** connectors reach credentials and the index only through scoped capabilities ([#1333](https://github.com/nimbus-agent/Nimbus/issues/1333)) ([23233d5](https://github.com/nimbus-agent/Nimbus/commit/23233d5b4ccecfcf92ab481d2e93a9315d5527f7))
* **telemetry:** measure agent invocation latency p50/p95 ([#1641](https://github.com/nimbus-agent/Nimbus/issues/1641)) ([082311b](https://github.com/nimbus-agent/Nimbus/commit/082311bbeaccc495dcdd920a62d4e8540eba1fac))
* **toolgen:** draft a tool body and its input schema, and bind credentials at create time ([#1481](https://github.com/nimbus-agent/Nimbus/issues/1481)) ([ecd1a04](https://github.com/nimbus-agent/Nimbus/commit/ecd1a04f8c8f47032992b2475cd67334f8afe0dd))
* **toolgen:** runtime tool generation PR 1 of 3 — the sandboxed substrate ([#1475](https://github.com/nimbus-agent/Nimbus/issues/1475)) ([4719bfb](https://github.com/nimbus-agent/Nimbus/commit/4719bfb1aaa1febd3ed0b68c180398714f121eea))
* **toolgen:** runtime tool generation PR 3 of 3 — persistence + signing ([#1487](https://github.com/nimbus-agent/Nimbus/issues/1487)) ([52644ce](https://github.com/nimbus-agent/Nimbus/commit/52644cef588e44f3d82621a4589ca682787bafba))
* **tooling:** close the gap between local gates and CI ([#1050](https://github.com/nimbus-agent/Nimbus/issues/1050)) ([0efd781](https://github.com/nimbus-agent/Nimbus/commit/0efd781af366606b6dc0ddb8e08a97027db55d5a))
* **ui:** On-call page for pushed briefs (PR 3 of 3) ([#1604](https://github.com/nimbus-agent/Nimbus/issues/1604)) ([88e161a](https://github.com/nimbus-agent/Nimbus/commit/88e161a279ac8e5e7ab8f54c68f17c4fe8ed0861))
* **ui:** read-only desktop Captures page ([#1672](https://github.com/nimbus-agent/Nimbus/issues/1672)) ([69d5e9d](https://github.com/nimbus-agent/Nimbus/commit/69d5e9d9c57883e2f02e8dc7468776988d0bb964))
* **updater:** refuse apply without an installer, audit apply phases, cache last check ([#1639](https://github.com/nimbus-agent/Nimbus/issues/1639)) ([749656c](https://github.com/nimbus-agent/Nimbus/commit/749656cae8b73485f90778b682b4e6dd36348cc3))
* **user-mcp:** let the model call opted-in user MCP tools for the local owner ([#1628](https://github.com/nimbus-agent/Nimbus/issues/1628)) ([fee3b25](https://github.com/nimbus-agent/Nimbus/commit/fee3b2552287d381ee7ae5085e62430bd76163d5))
* **user-mcp:** org-policy lock-off and I11 wrapping for model-offered tools; prove I38 end to end ([#1637](https://github.com/nimbus-agent/Nimbus/issues/1637)) ([0cf3df0](https://github.com/nimbus-agent/Nimbus/commit/0cf3df04ebf9d11e729813394561325b59637a7f))
* **user-mcp:** run user MCP servers confined, with owner-approved grants ([#1623](https://github.com/nimbus-agent/Nimbus/issues/1623)) ([7797aa1](https://github.com/nimbus-agent/Nimbus/commit/7797aa17b178229afd8f68348ab745b7c96f1bb0))
### Bug Fixes
* `nimbus config set` on a fresh machine, and an unactionable brief footer ([#1212](https://github.com/nimbus-agent/Nimbus/issues/1212)) ([c6824c7](https://github.com/nimbus-agent/Nimbus/commit/c6824c7a361af60a966d3aa9004e079ff3dbd914))
* **admin-console:** escape policy.version before it reaches innerHTML ([#1201](https://github.com/nimbus-agent/Nimbus/issues/1201)) ([f62fd85](https://github.com/nimbus-agent/Nimbus/commit/f62fd8553e1ebc14f67f0a16a784302e80cb55e2))
* **agents:** strip a fabricated reserved section at any level, and in its non-heading form ([#1302](https://github.com/nimbus-agent/Nimbus/issues/1302)) ([6742411](https://github.com/nimbus-agent/Nimbus/commit/6742411706b8c41b3730f93e91ba45bd5129fd75))
* **bitbucket:** 🧹 correct itemsUpserted overcount ([#1086](https://github.com/nimbus-agent/Nimbus/issues/1086)) ([9657921](https://github.com/nimbus-agent/Nimbus/commit/965792107ebcafba10667aab9bd5c7166388dc00))
* **build:** bundle the gateway workers so they exist in a compiled binary ([#1299](https://github.com/nimbus-agent/Nimbus/issues/1299)) ([934779b](https://github.com/nimbus-agent/Nimbus/commit/934779b29fcab02a7d234402e949a14b80264a92))
* **chatops:** escape every Slack-bound post at the wire ([#1617](https://github.com/nimbus-agent/Nimbus/issues/1617)) ([2e76680](https://github.com/nimbus-agent/Nimbus/commit/2e76680d8e7a15519630b0f3543be0177703817a))
* **ci:** accept repo as satisfying public_repo on WINGET_PAT, and add a scope-check script ([#1131](https://github.com/nimbus-agent/Nimbus/issues/1131)) ([ba54754](https://github.com/nimbus-agent/Nimbus/commit/ba54754432f3fb15d61020dff948b6ec8b4fdaf2))
* **ci:** close the pre-push gaps behind most red PR checks ([#1303](https://github.com/nimbus-agent/Nimbus/issues/1303)) ([0407fb0](https://github.com/nimbus-agent/Nimbus/commit/0407fb0c1410a15435c3e170b113a6163db8518e))
* **ci:** make the sandbox spawn suite report why it failed, and gate it on the platforms it is about ([#1298](https://github.com/nimbus-agent/Nimbus/issues/1298)) ([344e217](https://github.com/nimbus-agent/Nimbus/commit/344e2173300bec92886d7f329ba6fe220360c234))
* **ci:** retry a status-less transport failure in the dependency audit ([#1441](https://github.com/nimbus-agent/Nimbus/issues/1441)) ([4b1948b](https://github.com/nimbus-agent/Nimbus/commit/4b1948b79b57a7b66865dea4f7134306d0efbce9))
* **ci:** stop the AuditPanel vitest flake, clear the Sonar board, and make docs/README.md the only README ([#1252](https://github.com/nimbus-agent/Nimbus/issues/1252)) ([70f15ca](https://github.com/nimbus-agent/Nimbus/commit/70f15ca9ab2d0ad1ccb93acc01ab54ad3106c38f))
* **ci:** the sdk release-train tagPattern never matched a real tag, and that only warned ([#1445](https://github.com/nimbus-agent/Nimbus/issues/1445)) ([19a371c](https://github.com/nimbus-agent/Nimbus/commit/19a371c3d9e6251a208e2c20655204b44d59e6cc))
* clear the SonarCloud backlog, reduce duplication and raise test coverage ([#1603](https://github.com/nimbus-agent/Nimbus/issues/1603)) ([4663fbb](https://github.com/nimbus-agent/Nimbus/commit/4663fbb9b4c5139e449e0481b0b2d0dc3f357d6f))
* **cli:** a Gateway connection can always answer a HITL prompt ([#1305](https://github.com/nimbus-agent/Nimbus/issues/1305)) ([576ba6e](https://github.com/nimbus-agent/Nimbus/commit/576ba6e2d7d5fb4ea0cd8d81d0505b4c57f4f085))
* **cli:** make --format plain's underscore-italic pass linear ([#1608](https://github.com/nimbus-agent/Nimbus/issues/1608)) ([475735e](https://github.com/nimbus-agent/Nimbus/commit/475735ee7c9d54dca0b9d5a605506f420cd20d58))
* **cli:** nimbus start waits for the gateway state file, not only the socket ([#1549](https://github.com/nimbus-agent/Nimbus/issues/1549)) ([4267055](https://github.com/nimbus-agent/Nimbus/commit/4267055986ab9e6e12bc85543a8e0e9fa0f4f838))
* **clips:** embed web clips locally and stop advertising discarded text ([#1151](https://github.com/nimbus-agent/Nimbus/issues/1151)) ([0e3b183](https://github.com/nimbus-agent/Nimbus/commit/0e3b18336d1e1cb79080d09b660f20ca785c57ca))
* **cli:** refuse a nested-table key in nimbus config set/get ([#1387](https://github.com/nimbus-agent/Nimbus/issues/1387)) ([1a4338c](https://github.com/nimbus-agent/Nimbus/commit/1a4338c32582ae578dacc3babb34671b07b155f9))
* **cli:** stop blocking gateway RPCs dying on the 30s client timeout ([#1203](https://github.com/nimbus-agent/Nimbus/issues/1203)) ([3fc2132](https://github.com/nimbus-agent/Nimbus/commit/3fc2132255c86fbf04fce408e8f35cb123cb24ef))
* close three documented gaps in completed phases (I16 reasons, connector.startAuth, redaction fixtures) ([#1480](https://github.com/nimbus-agent/Nimbus/issues/1480)) ([da5d239](https://github.com/nimbus-agent/Nimbus/commit/da5d2399eae49412d82d4f2be94be1b2c50c7d25))
* **connectors:** align the aws sync interval with its AWS-CLI siblings ([#1377](https://github.com/nimbus-agent/Nimbus/issues/1377)) ([61173ae](https://github.com/nimbus-agent/Nimbus/commit/61173ae92dc87002d3bc844ce0c792257292d677))
* **connectors:** gcloud spawns authenticate as the configured GCP service-account key ([#1553](https://github.com/nimbus-agent/Nimbus/issues/1553)) ([e1d16b1](https://github.com/nimbus-agent/Nimbus/commit/e1d16b119a40364bd436773966672434de283077))
* **connectors:** index a Confluence page under its browser URL ([#1364](https://github.com/nimbus-agent/Nimbus/issues/1364)) ([c7a9e1a](https://github.com/nimbus-agent/Nimbus/commit/c7a9e1a53fcc5fc22e2830e38ad25009b7e5d6e5))
* **connectors:** let Jira, Confluence, GitLab, dbt and the Teams bot reach their configured host from the sandbox ([#1536](https://github.com/nimbus-agent/Nimbus/issues/1536)) ([d4465f9](https://github.com/nimbus-agent/Nimbus/commit/d4465f9c3c784532a056cfef0bc63433d2936af2))
* **connectors:** make connector auth refuse vault-key services with the exact vault set commands ([#1537](https://github.com/nimbus-agent/Nimbus/issues/1537)) ([02011df](https://github.com/nimbus-agent/Nimbus/commit/02011dfa35ceaee8231863de7d43ffb405beb0ef))
* **connectors:** report only what was actually verified in connector auth and targeted fetch ([#1141](https://github.com/nimbus-agent/Nimbus/issues/1141)) ([902cd42](https://github.com/nimbus-agent/Nimbus/commit/902cd4291f9fb5278e56e59a9c1ecebbb293b33c))
* **connectors:** stop connector CLI spawns flashing console windows on Windows ([#1370](https://github.com/nimbus-agent/Nimbus/issues/1370)) ([184dc42](https://github.com/nimbus-agent/Nimbus/commit/184dc42aed22b4156d1f8367f69e60118ebcffab))
* **coverage:** gate four runtime-bearing types files and give the sandbox harness a way to run ([#1230](https://github.com/nimbus-agent/Nimbus/issues/1230)) ([326493d](https://github.com/nimbus-agent/Nimbus/commit/326493d950392b38e38b2ed5d70410693d3b976a))
* **demo:** retry the demo-root delete for real on Windows; size the PAL boot test for CI ([#1673](https://github.com/nimbus-agent/Nimbus/issues/1673)) ([a264732](https://github.com/nimbus-agent/Nimbus/commit/a2647325c37f99bba373512c5a1b545022e94116))
* **deps:** bump the bundled connectors to 0.2.2 and drop the nodemailer override ([#1606](https://github.com/nimbus-agent/Nimbus/issues/1606)) ([58ad04f](https://github.com/nimbus-agent/Nimbus/commit/58ad04fad78a7c7f3c79f8602b41e7798fc05b62))
* **deps:** bump the devalue override to 5.9.4 for three new high advisories ([#1593](https://github.com/nimbus-agent/Nimbus/issues/1593)) ([693f62b](https://github.com/nimbus-agent/Nimbus/commit/693f62ba1885418b3dfd57db9e619810c53f509a))
* **deps:** bundle connectors 0.2.4, and name the right Workday task in the auth help ([#1614](https://github.com/nimbus-agent/Nimbus/issues/1614)) ([d25fbea](https://github.com/nimbus-agent/Nimbus/commit/d25fbea19f8d3042e68ec17eeacf5d3b96b962a9))
* **deps:** override [@modelcontextprotocol](https://github.com/modelcontextprotocol) client/core/server to the patched 2.2 line ([#1624](https://github.com/nimbus-agent/Nimbus/issues/1624)) ([a00d70d](https://github.com/nimbus-agent/Nimbus/commit/a00d70d8cc0bda237379f7a1eddb9babee2c47f7))
* **deps:** override past five new moderate advisories (ip-address, nodemailer, undici, markdown-it) ([#1577](https://github.com/nimbus-agent/Nimbus/issues/1577)) ([beec826](https://github.com/nimbus-agent/Nimbus/commit/beec82653ff9b0be85c073112b35b58a01754436))
* **deps:** override past new brace-expansion and fast-uri advisories ([#1586](https://github.com/nimbus-agent/Nimbus/issues/1586)) ([19327c5](https://github.com/nimbus-agent/Nimbus/commit/19327c5298a86c28d35363ee637a0263d7036f17))
* **deps:** unbreak main — move the override pins [#1469](https://github.com/nimbus-agent/Nimbus/issues/1469) outgrew, and restore the docs build ([#1474](https://github.com/nimbus-agent/Nimbus/issues/1474)) ([2cc6fcf](https://github.com/nimbus-agent/Nimbus/commit/2cc6fcf0870629919ee83110681a44503f2a674d))
* **docs:** correct the standalone connector install path, and measure client support ([#1323](https://github.com/nimbus-agent/Nimbus/issues/1323)) ([bdc6abf](https://github.com/nimbus-agent/Nimbus/commit/bdc6abf2bc44ad53933191f35537fdf1ea56c737))
* **docs:** derive four drifted invariant claims instead of hand-maintaining them ([#1221](https://github.com/nimbus-agent/Nimbus/issues/1221)) ([6fc59e5](https://github.com/nimbus-agent/Nimbus/commit/6fc59e518c1f269701e57f4b5d5af7bb0b1166db))
* **egress:** count the whole prove window, not the first page of it ([#1189](https://github.com/nimbus-agent/Nimbus/issues/1189)) ([1743437](https://github.com/nimbus-agent/Nimbus/commit/1743437229cc4b9fec8387fede74ced92f8d0453))
* **embedding:** cancel timed-out query embedding work, not just abandon it ([#1542](https://github.com/nimbus-agent/Nimbus/issues/1542)) ([35b0aa8](https://github.com/nimbus-agent/Nimbus/commit/35b0aa86cf38bdb5fdf74dc3b506f4a8b7f8cf52))
* **embedding:** embed the onnx addon so the compiled binary can load it ([#1402](https://github.com/nimbus-agent/Nimbus/issues/1402)) ([7ca8379](https://github.com/nimbus-agent/Nimbus/commit/7ca83798c1c2d40e91ab6839e5c94cf54646a88d))
* **embedding:** embed the onnxruntime runtime library, not just the addon ([#1405](https://github.com/nimbus-agent/Nimbus/issues/1405)) ([7d38e79](https://github.com/nimbus-agent/Nimbus/commit/7d38e79f5bdcf68b9a58763cc7267ab34f1843b5))
* **embedding:** report the backfill pass from the hybrid and openai runtimes ([#1538](https://github.com/nimbus-agent/Nimbus/issues/1538)) ([5d31dab](https://github.com/nimbus-agent/Nimbus/commit/5d31dabfbfda1cd7e0f576c98ca36a4e032d78bc))
* **embedding:** ship the onnx binding and stub sharp so the worker can start ([#1399](https://github.com/nimbus-agent/Nimbus/issues/1399)) ([2356e6a](https://github.com/nimbus-agent/Nimbus/commit/2356e6a7e4d25aab4baf954ce8a2e1d17df604f6))
* **extensions:** read the registry's entryHash as the entry file's hash everywhere ([#1662](https://github.com/nimbus-agent/Nimbus/issues/1662)) ([42102e0](https://github.com/nimbus-agent/Nimbus/commit/42102e06040d5810b002bf57621e91782e2b40d4))
* **fleet:** close the five follow-ups from the overnight-fleet merge ([#1462](https://github.com/nimbus-agent/Nimbus/issues/1462)) ([bf0559b](https://github.com/nimbus-agent/Nimbus/commit/bf0559b56c52ab79c9c48e94fd1d2ce1e649aa67))
* **gateway:** 🔒 Prevent command injection in tar extraction ([#1091](https://github.com/nimbus-agent/Nimbus/issues/1091)) ([575e2aa](https://github.com/nimbus-agent/Nimbus/commit/575e2aa5648d101c02f06450df4016500e3cfe50))
* **gateway:** enforce the connector allowlist at the federated invoke gate, and route ChatOps writes through the write transport ([#1615](https://github.com/nimbus-agent/Nimbus/issues/1615)) ([1c578cb](https://github.com/nimbus-agent/Nimbus/commit/1c578cbbda71f4645726b5348050ccfab2d200bf))
* **gateway:** log why the process exits instead of dying silently ([#1140](https://github.com/nimbus-agent/Nimbus/issues/1140)) ([322ea68](https://github.com/nimbus-agent/Nimbus/commit/322ea683266d97a96aaa05e182b6208365ad5dbe))
* **gateway:** make connectors spawnable from a compiled binary ([#1055](https://github.com/nimbus-agent/Nimbus/issues/1055)) ([b3a6f15](https://github.com/nimbus-agent/Nimbus/commit/b3a6f159e9f9c4b8b0ed44262067efec42dfaba4))
* **gateway:** refuse connector writes and code-executing connector tools at the federated invoke gate (I26) ([#1607](https://github.com/nimbus-agent/Nimbus/issues/1607)) ([eeb5245](https://github.com/nimbus-agent/Nimbus/commit/eeb5245bf3237abb4cf9e70407cddc1e527583ac))
* **gateway:** resolve bare connector tool ids on the caller's own MCP server ([#1610](https://github.com/nimbus-agent/Nimbus/issues/1610)) ([3e41d5b](https://github.com/nimbus-agent/Nimbus/commit/3e41d5b34c216d74e63c83473525718633f93210))
* **gateway:** resolve WAL mode race in http-api-test-server ([#1093](https://github.com/nimbus-agent/Nimbus/issues/1093)) ([1323567](https://github.com/nimbus-agent/Nimbus/commit/1323567a7a2d07bea4b39a6ba1b4a974cccc2b00))
* **gateway:** serve the admin console and OpenAPI doc from a compiled binary ([#1058](https://github.com/nimbus-agent/Nimbus/issues/1058)) ([36abf19](https://github.com/nimbus-agent/Nimbus/commit/36abf192457984a42e2d4e74b984603d51fbb376))
* **gateway:** stop console windows flashing on every Windows sync ([#1451](https://github.com/nimbus-agent/Nimbus/issues/1451)) ([2042740](https://github.com/nimbus-agent/Nimbus/commit/2042740e9aac2b8cbf87e9ab04e801a3f51e5df2))
* **index:** extract `export default` symbols in the code indexer ([#1391](https://github.com/nimbus-agent/Nimbus/issues/1391)) ([78751d2](https://github.com/nimbus-agent/Nimbus/commit/78751d2f54ab9898f7e1a0fc77ec3df226003357))
* **index:** one pre-migration backup per upgrade, none on a fresh install ([#1671](https://github.com/nimbus-agent/Nimbus/issues/1671)) ([9eb42b1](https://github.com/nimbus-agent/Nimbus/commit/9eb42b12b4ce7e15b011b2af29126d999faf8c46))
* **init:** --no-sync no longer ends by naming two commands that cannot work ([#1341](https://github.com/nimbus-agent/Nimbus/issues/1341)) ([829db8c](https://github.com/nimbus-agent/Nimbus/commit/829db8c1499ac131f0f998084d94beefc0cdb046))
* **install:** stop Windows PowerShell 5.1 native stderr from aborting gpg signature verification ([#1179](https://github.com/nimbus-agent/Nimbus/issues/1179)) ([6c991ea](https://github.com/nimbus-agent/Nimbus/commit/6c991eabf4cb110a4ddaf0ca844da62bfd437e7d))
* **install:** verify the release signature on Windows with a Git-for-Windows gpg ([#1175](https://github.com/nimbus-agent/Nimbus/issues/1175)) ([a68945e](https://github.com/nimbus-agent/Nimbus/commit/a68945e55cff9409536824d9fa7ff2c87d025fef))
* **jenkins:** build headers with Headers so a hostile crumb cannot reach a prototype ([#1336](https://github.com/nimbus-agent/Nimbus/issues/1336)) ([8edb94f](https://github.com/nimbus-agent/Nimbus/commit/8edb94f6d178cd7479ffc4ec71e59e6fbe5a4d6a))
* **lan:** never drop the tail of a large federation frame ([#1630](https://github.com/nimbus-agent/Nimbus/issues/1630)) ([814f470](https://github.com/nimbus-agent/Nimbus/commit/814f470b84f3057e0798136d30291517c9c9f12a))
* **llm:** a provider named __proto__ vanished from the availability map ([#1442](https://github.com/nimbus-agent/Nimbus/issues/1442)) ([c16855a](https://github.com/nimbus-agent/Nimbus/commit/c16855a7d09ba90cb129173852bfa281092ba114))
* **llm:** enforce_air_gap now refuses the remote classifier instead of doing nothing ([#1334](https://github.com/nimbus-agent/Nimbus/issues/1334)) ([be9841c](https://github.com/nimbus-agent/Nimbus/commit/be9841cbda3746e5c727caaf131b9013dfaec697))
* **llm:** ledger the ask intent classifier, and three defects found on a live install ([#1366](https://github.com/nimbus-agent/Nimbus/issues/1366)) ([8202ec6](https://github.com/nimbus-agent/Nimbus/commit/8202ec64199c524ff436f3d4d04822e9c9a8620c))
* **llm:** make llm.setDefault write the store the router actually reads ([#1410](https://github.com/nimbus-agent/Nimbus/issues/1410)) ([9f69790](https://github.com/nimbus-agent/Nimbus/commit/9f69790ca0e29795997e614732539dce5792bfae))
* **llm:** remove the inert remote_model key and document the vendor tables ([#1368](https://github.com/nimbus-agent/Nimbus/issues/1368)) ([0ca8232](https://github.com/nimbus-agent/Nimbus/commit/0ca82323f26dbd10dc59efa28eab3c43ba9c593e))
* **llm:** stop Ollama reasoning tokens truncating answers and costing ~16s per ask ([#1376](https://github.com/nimbus-agent/Nimbus/issues/1376)) ([abdbbdc](https://github.com/nimbus-agent/Nimbus/commit/abdbbdcf41ba91243f3d76e1b5ad301e01aba3a8))
* **logging:** stop logging every Error as {} ([#1393](https://github.com/nimbus-agent/Nimbus/issues/1393)) ([7734ab1](https://github.com/nimbus-agent/Nimbus/commit/7734ab10b68ea5c221b56cfc8ccfabe555ef80ca))
* **media:** show real sizes in the allow-remote consent preview ([#1534](https://github.com/nimbus-agent/Nimbus/issues/1534)) ([c6f927e](https://github.com/nimbus-agent/Nimbus/commit/c6f927ec0d5f88dc6d54d4f81482765236a324be))
* **metrics:** stop requiring a resolved status to attribute a change failure ([#1494](https://github.com/nimbus-agent/Nimbus/issues/1494)) ([011cbf7](https://github.com/nimbus-agent/Nimbus/commit/011cbf74a03164e4eb4b3b21a67661d33c557b91))
* **ownership:** stop the symbol sync wiping owner counts from the graph ([#1255](https://github.com/nimbus-agent/Nimbus/issues/1255)) ([34a08e3](https://github.com/nimbus-agent/Nimbus/commit/34a08e3005e554e935135409ff1a64469b56d5c8))
* **perf:** drift-check must use each surface own noise floor, not a hardcoded 10% ([#1374](https://github.com/nimbus-agent/Nimbus/issues/1374)) ([8607743](https://github.com/nimbus-agent/Nimbus/commit/860774328ca64b358c1259b3ab29178f9b63375b))
* **platform:** bundle a full SQLite with the macOS build so semantic search works without Homebrew ([#1507](https://github.com/nimbus-agent/Nimbus/issues/1507)) ([a3703cc](https://github.com/nimbus-agent/Nimbus/commit/a3703cc0b63bf7b9de4efce67bae91a2e71831a2))
* **platform:** load a full SQLite on macOS so sqlite-vec can load ([#1503](https://github.com/nimbus-agent/Nimbus/issues/1503)) ([107bf08](https://github.com/nimbus-agent/Nimbus/commit/107bf084021bfc7dbd08fae0e42d3d2690f5b7ed))
* **preflight:** an unknown service must not pass the deploy gate ([#1297](https://github.com/nimbus-agent/Nimbus/issues/1297)) ([6ae5a53](https://github.com/nimbus-agent/Nimbus/commit/6ae5a53fd3ca911373ca511dafa5ad48e29f1d69))
* prove the installed binary's claims in install-smoke and retract the dark ones from the docs ([#1627](https://github.com/nimbus-agent/Nimbus/issues/1627)) ([d40fbcd](https://github.com/nimbus-agent/Nimbus/commit/d40fbcd9cf23eeed2f7fdcce8572147c2d454332))
* **quality:** clear 9 Sonar issues, two of them real security bugs ([#1327](https://github.com/nimbus-agent/Nimbus/issues/1327)) ([6d828c5](https://github.com/nimbus-agent/Nimbus/commit/6d828c5c273e5c01d8d2ac44281ce7ef2753284b))
* **quality:** clear the SonarCloud board, prune the delivered plans and specs, and fix what that exposed ([#1497](https://github.com/nimbus-agent/Nimbus/issues/1497)) ([63bbdd9](https://github.com/nimbus-agent/Nimbus/commit/63bbdd920343b92f48952b71f6197f2de0a4bf94))
* **quality:** close two ReDoS regexes and clear 25 SonarCloud findings ([#1152](https://github.com/nimbus-agent/Nimbus/issues/1152)) ([1f89379](https://github.com/nimbus-agent/Nimbus/commit/1f893798d6466c8a860fcda2141f5832acdda9c2))
* **quality:** fix all 29 open Sonar findings in code, cut duplication 420 to 400 clones, and correct five stale doc facts ([#1439](https://github.com/nimbus-agent/Nimbus/issues/1439)) ([62a6a20](https://github.com/nimbus-agent/Nimbus/commit/62a6a20286e3d9a55d9507b4b25e8f36b13f8f8b))
* refuse index.regraph over LAN, retire the merge queue and Dependabot, and refresh the contributor docs ([#1596](https://github.com/nimbus-agent/Nimbus/issues/1596)) ([6f6f025](https://github.com/nimbus-agent/Nimbus/commit/6f6f02559c97b4e082101634d8e8af5061a1ca6c))
* **release:** gate the release PR at PR time, and reject a body release-please cannot parse ([#1227](https://github.com/nimbus-agent/Nimbus/issues/1227)) ([074daab](https://github.com/nimbus-agent/Nimbus/commit/074daab8d22b28212b4a8fd467d3783b76678e35))
* **release:** parse the squash message GitHub actually creates ([#1235](https://github.com/nimbus-agent/Nimbus/issues/1235)) ([044c16b](https://github.com/nimbus-agent/Nimbus/commit/044c16bd36b4aa06716a917d6a6e412ef9c8ef80))
* resolve macos-15 CI test failures and consolidate open connector PRs ([#1082](https://github.com/nimbus-agent/Nimbus/issues/1082)) ([9f9215b](https://github.com/nimbus-agent/Nimbus/commit/9f9215bfcca7ba4cdde0b66e4975881359882797))
* resolve the brief timeout from one definition, and make the ask context budget configurable ([#1354](https://github.com/nimbus-agent/Nimbus/issues/1354)) ([30c1ce6](https://github.com/nimbus-agent/Nimbus/commit/30c1ce61afedf459651a25dc1fb88cc32b1152f4))
* **sandbox:** stop concurrent sandbox users from deleting each other's profiles, and a macOS test hang ([#1680](https://github.com/nimbus-agent/Nimbus/issues/1680)) ([a7eca57](https://github.com/nimbus-agent/Nimbus/commit/a7eca5788c9b1aa6168a04c4a9b267aa91c04912))
* **sandbox:** stop the Windows helper leaking an ACE per run; tool run follow-ups ([#1524](https://github.com/nimbus-agent/Nimbus/issues/1524)) ([52fb7cf](https://github.com/nimbus-agent/Nimbus/commit/52fb7cfea808893955c6267caf08a5cb18aae943))
* **search:** stop the vector KNN re-running once per chunk row ([#1500](https://github.com/nimbus-agent/Nimbus/issues/1500)) ([1ac89f6](https://github.com/nimbus-agent/Nimbus/commit/1ac89f6808c5ed51f39fb8ea5d9ca8c42d3afc62))
* **security:** three allowlisted methods had no reachable handler; add the test I7 promised ([#1225](https://github.com/nimbus-agent/Nimbus/issues/1225)) ([f7d8c75](https://github.com/nimbus-agent/Nimbus/commit/f7d8c75cdd893a0cabd596f3792fc5aa05c43d05))
* **security:** wire the two I22/I18 defenses that were resolved but never read ([#1220](https://github.com/nimbus-agent/Nimbus/issues/1220)) ([84d3e62](https://github.com/nimbus-agent/Nimbus/commit/84d3e6294a0cf537824410044b93dbe8325a4c13))
* **sonar:** clear 23 findings, and document five that should not be applied ([#1434](https://github.com/nimbus-agent/Nimbus/issues/1434)) ([64d50af](https://github.com/nimbus-agent/Nimbus/commit/64d50af67ddf196c742da5492e6005a7b745b9e0))
* **sonar:** raw path literals, media flag validators, and the two findings the last pass added ([#1437](https://github.com/nimbus-agent/Nimbus/issues/1437)) ([6fe5240](https://github.com/nimbus-agent/Nimbus/commit/6fe52402b34a2be90dc86a6ab1dd0407246dca6e))
* **sonar:** resolve the six minor findings and annotate the S8786 false positive ([#1206](https://github.com/nimbus-agent/Nimbus/issues/1206)) ([fa65d95](https://github.com/nimbus-agent/Nimbus/commit/fa65d957c46ff46354f8c17d9d37cf4d13957c19))
* **sonar:** specific matchers and named decisions, minus two arity assertions ([#1436](https://github.com/nimbus-agent/Nimbus/issues/1436)) ([d1900c6](https://github.com/nimbus-agent/Nimbus/commit/d1900c6e5a679cf520053f33fd02e7fbbad280b4))
* **test:** re-home the F11 Google-spawn isolation tests off a process-global mock ([#1311](https://github.com/nimbus-agent/Nimbus/issues/1311)) ([f9c6f92](https://github.com/nimbus-agent/Nimbus/commit/f9c6f92ee2c2ef27b96c2df26b8a68ee4b8dd60d))
* **test:** stop the Windows deploy.preflight hook timeout and clear the Sonar backlog ([#1316](https://github.com/nimbus-agent/Nimbus/issues/1316)) ([139aa40](https://github.com/nimbus-agent/Nimbus/commit/139aa40307d73083bfeb955d264858d1ad2e54c9))
* the remaining 24 findings from the local-LLM audit ([#1307](https://github.com/nimbus-agent/Nimbus/issues/1307)) ([1f9ae09](https://github.com/nimbus-agent/Nimbus/commit/1f9ae09a1a27401de96241686e9b97868309b969))
* **tui:** render the watcher pane, and stop claiming OS notifications work ([#1204](https://github.com/nimbus-agent/Nimbus/issues/1204)) ([78cb49b](https://github.com/nimbus-agent/Nimbus/commit/78cb49b0b8242e8ce56245c4454cc6e49c507244))
* **user-mcp:** per-server dispatch listing, no sync.run egress rows, bounded Windows boot revoke ([#1629](https://github.com/nimbus-agent/Nimbus/issues/1629)) ([e1850af](https://github.com/nimbus-agent/Nimbus/commit/e1850af265e2ac81053fea2b0826ed2091286d32))
### Performance Improvements
* **connectors:** ⚡ batch fetch message metadata in Gmail sync ([#1099](https://github.com/nimbus-agent/Nimbus/issues/1099)) ([cf1dfe1](https://github.com/nimbus-agent/Nimbus/commit/cf1dfe1d50b61682a7a27849e4678ecd734bc078))
* **filesystem:** index only what changed since the last sync tick ([#1453](https://github.com/nimbus-agent/Nimbus/issues/1453)) ([ec284d1](https://github.com/nimbus-agent/Nimbus/commit/ec284d13fbf66f4c0b5680768441f253e4c9daf0))
* **gateway:** ⚡ batch API calls in SonarQube Sync to resolve N+1 issue ([#1089](https://github.com/nimbus-agent/Nimbus/issues/1089)) ([892e96b](https://github.com/nimbus-agent/Nimbus/commit/892e96b62839e9bc1a94d73b206a49fa1dd3233a))
* **index:** build a fresh database without a flush per migration step ([#1675](https://github.com/nimbus-agent/Nimbus/issues/1675)) ([9a0330f](https://github.com/nimbus-agent/Nimbus/commit/9a0330f69b267e2ee9d57e5383a0517b8d5eb3e4))
* **jenkins:** ⚡ batch jenkins job builds sync ([#1087](https://github.com/nimbus-agent/Nimbus/issues/1087)) ([d94d632](https://github.com/nimbus-agent/Nimbus/commit/d94d63274a0d8f4a29771816e77911363ea24c11))
* **test:** a migrated-once schema template and a deadline-bounded poll, for the Windows hot path ([#1291](https://github.com/nimbus-agent/Nimbus/issues/1291)) ([6e5fbfd](https://github.com/nimbus-agent/Nimbus/commit/6e5fbfdea1a3e095095aec665cc6e0f9d5d10711))
### Code Refactoring
* **connectors:** delete packages/mcp-connectors — it ships from npm now ([#1347](https://github.com/nimbus-agent/Nimbus/issues/1347)) ([2118cdd](https://github.com/nimbus-agent/Nimbus/commit/2118cdd4ba4954d9617485973b753f47fcbed03c))
* **egress:** remove the EgressCompleteness.tier compat shim ([#1156](https://github.com/nimbus-agent/Nimbus/issues/1156)) ([7b530dc](https://github.com/nimbus-agent/Nimbus/commit/7b530dcc15930a208d63af43ad3af9dd46f44d07))
* **llm:** make LlmRegistryOptions.db required so an unledgered non-local route is a compile error ([#1372](https://github.com/nimbus-agent/Nimbus/issues/1372)) ([97ce904](https://github.com/nimbus-agent/Nimbus/commit/97ce9043cb6c08e9e7c5c06a3db5bf71f0bda1c0))
## [8.0.0](https://github.com/nimbus-agent/Nimbus/compare/v7.47.1...v8.0.0) (2026-10-17)
### ⚠ BREAKING CHANGES
* **llm:** make LlmRegistryOptions.db required so an unledgered non-local route is a compile error ([#1372](https://github.com/nimbus-agent/Nimbus/issues/1372))
* **llm:** remove the inert remote_model key and document the vendor tables ([#1368](https://github.com/nimbus-agent/Nimbus/issues/1368))
* **llm:** ledger the ask intent classifier, and three defects found on a live install ([#1366](https://github.com/nimbus-agent/Nimbus/issues/1366))
* **llm:** the Mastra engine agent no longer falls back to a vendor API key found in the environment. An install that today relies on `ANTHROPIC_API_KEY` alone, with no `[llm.remote.*]` configuration, will stop constructing the agent — `nimbus ask` then answers from the local router if one is configured, and workflows refuse with a message naming the fix. To restore the previous behaviour, add `[llm.remote.anthropic] enabled = true` with a `model`, and store `anthropic.api_key` in the Vault. This is the point of the change rather than a side effect: a capability that turns itself on because a credential happens to exist is the air-gap defect's shape, one level up.
* **llm:** route the LLM by (provider, model) instead of provider kind ([#1352](https://github.com/nimbus-agent/Nimbus/issues/1352))
* **connectors:** delete packages/mcp-connectors — it ships from npm now ([#1347](https://github.com/nimbus-agent/Nimbus/issues/1347))
* **egress:** remove the EgressCompleteness.tier compat shim ([#1156](https://github.com/nimbus-agent/Nimbus/issues/1156))
### Features
* **agents:** a browser-viable why — agents.why answers about a pull request ([#1260](https://github.com/nimbus-agent/Nimbus/issues/1260)) ([55715b7](https://github.com/nimbus-agent/Nimbus/commit/55715b7e5989b60eef3d653fc1ba3fb56acc4faa))
* **agents:** attribute Sentry error issues to people ([#1182](https://github.com/nimbus-agent/Nimbus/issues/1182)) ([ffa54b3](https://github.com/nimbus-agent/Nimbus/commit/ffa54b3eafdbf2370b39e850e0a3ee0209894a7d))
* **agents:** give every interleaved brief disclosure one definition and a guard ([#1245](https://github.com/nimbus-agent/Nimbus/issues/1245)) ([5b9c115](https://github.com/nimbus-agent/Nimbus/commit/5b9c1152c6c0df19f0035ab401bd62413132b89b))
* **agents:** never let synthesis drop a brief's disclosures ([#1237](https://github.com/nimbus-agent/Nimbus/issues/1237)) ([f27b416](https://github.com/nimbus-agent/Nimbus/commit/f27b416b793fc096f59e73196a3b1717ca7e8764))
* **agents:** nimbus changelog — the fifteenth built-in agent ([#1496](https://github.com/nimbus-agent/Nimbus/issues/1496)) ([bc1139b](https://github.com/nimbus-agent/Nimbus/commit/bc1139b813040248de0a594de07a04a62a57bb61))
* **agents:** nimbus negotiate — a cited contribution brief ([#1166](https://github.com/nimbus-agent/Nimbus/issues/1166)) ([fa807e3](https://github.com/nimbus-agent/Nimbus/commit/fa807e30377ae6e121b58eacb0b304d85b73a4fe))
* **agents:** nimbus oncall — the seventeenth built-in agent ([#1509](https://github.com/nimbus-agent/Nimbus/issues/1509)) ([27c4211](https://github.com/nimbus-agent/Nimbus/commit/27c42111e1c44911c56f62b3c558d8808e0ccedb))
* **agents:** nimbus pre-mortem, with a service-scoped incident watcher condition ([#1146](https://github.com/nimbus-agent/Nimbus/issues/1146)) ([58e93fd](https://github.com/nimbus-agent/Nimbus/commit/58e93fd3e9e245c0ad17a3c8a3c51df815afda7a))
* **agents:** nimbus standup — the sixteenth built-in agent ([#1502](https://github.com/nimbus-agent/Nimbus/issues/1502)) ([3101702](https://github.com/nimbus-agent/Nimbus/commit/310170239b4a9ed4be1cb9092223dc1d64cc3cd7))
* **agents:** publish the gateway version on the roster response ([#1428](https://github.com/nimbus-agent/Nimbus/issues/1428)) ([d3ba71d](https://github.com/nimbus-agent/Nimbus/commit/d3ba71dd3d3513e828da301bd59472fdb2dfc456))
* **agents:** resolve a forge file coordinate to the reader's checkout ([#1424](https://github.com/nimbus-agent/Nimbus/issues/1424)) ([4770bdf](https://github.com/nimbus-agent/Nimbus/commit/4770bdffbcff9b7962f209e890d3b96f324dbb9b))
* **agents:** why, expert and ownership answer about an indexed item ([#1421](https://github.com/nimbus-agent/Nimbus/issues/1421)) ([b5fabb2](https://github.com/nimbus-agent/Nimbus/commit/b5fabb2d176f67b8286b8cdf237231ce565d9f49))
* **audit:** index lane census (report-only) ([#1561](https://github.com/nimbus-agent/Nimbus/issues/1561)) ([863f621](https://github.com/nimbus-agent/Nimbus/commit/863f621f23cfecd36d68462595478f9dbb40a249))
* **automation:** add incident_opened and deploy_failed watcher conditions ([#1138](https://github.com/nimbus-agent/Nimbus/issues/1138)) ([34601b2](https://github.com/nimbus-agent/Nimbus/commit/34601b24b98026e61f3785965cf38b38b1d414f6))
* **briefs:** research briefs draw on the whole index, not only clips ([#1253](https://github.com/nimbus-agent/Nimbus/issues/1253)) ([80c21df](https://github.com/nimbus-agent/Nimbus/commit/80c21dfa0590d1bbb6af88c6556a4a0cfb7da2d3))
* **build:** prove the connector registry can import from a package, before anything moves ([#1340](https://github.com/nimbus-agent/Nimbus/issues/1340)) ([3a1e813](https://github.com/nimbus-agent/Nimbus/commit/3a1e8138746f2f2b22ef49169ca920579d5a42b9))
* **captures:** batch accept proposed decisions, terms and links ([#1668](https://github.com/nimbus-agent/Nimbus/issues/1668)) ([64ab982](https://github.com/nimbus-agent/Nimbus/commit/64ab98286e87b20500bf322bacd04c8cc136e005))
* **captures:** purge a finished action's stored input; prune executed/failed after 90 days ([#1667](https://github.com/nimbus-agent/Nimbus/issues/1667)) ([e35e346](https://github.com/nimbus-agent/Nimbus/commit/e35e3460b6499c33f4c46736a0358fee39f56f14))
* **chatops:** invoke the built-in read-only agents from a Slack or Teams channel ([#1412](https://github.com/nimbus-agent/Nimbus/issues/1412)) ([a6a052e](https://github.com/nimbus-agent/Nimbus/commit/a6a052e2d019eb077a0b90d3a352c0d5d58cf590))
* **ci:** gate on connector version skew between the gateway and npm ([#1346](https://github.com/nimbus-agent/Nimbus/issues/1346)) ([1a2d38a](https://github.com/nimbus-agent/Nimbus/commit/1a2d38a42ab16d3d83a4a4d016944d2a74bc39d7))
* **ci:** gate on native dependencies reaching the gateway binary ([#1350](https://github.com/nimbus-agent/Nimbus/issues/1350)) ([b3ff071](https://github.com/nimbus-agent/Nimbus/commit/b3ff071c02caef844c0b8bf243e5c7b0fd4ea71b))
* **cli:** add nimbus tool run to invoke a saved generated tool ([#1521](https://github.com/nimbus-agent/Nimbus/issues/1521)) ([a89bd27](https://github.com/nimbus-agent/Nimbus/commit/a89bd2762c274d06ccf20d766eb300ebe0e871ed))
* **cli:** nimbus demo — a seeded synthetic org and a three-brief tour ([#1547](https://github.com/nimbus-agent/Nimbus/issues/1547)) ([b238a13](https://github.com/nimbus-agent/Nimbus/commit/b238a1386312746994a8a3ab4e668464c5dd1e5d))
* **cli:** nimbus explain last — an X-ray of the most recent nimbus ask ([#1514](https://github.com/nimbus-agent/Nimbus/issues/1514)) ([755c2b6](https://github.com/nimbus-agent/Nimbus/commit/755c2b6019479a1313ada85ab4d3db6726c4add4))
* **cli:** nimbus index health — index quality, not index size ([#1483](https://github.com/nimbus-agent/Nimbus/issues/1483)) ([93ac016](https://github.com/nimbus-agent/Nimbus/commit/93ac016d5a564f633732c4ba8f2eb6beb4bdb049))
* **cli:** nimbus init and nimbus demo end on the guided tour ([#1570](https://github.com/nimbus-agent/Nimbus/issues/1570)) ([fc8ce7c](https://github.com/nimbus-agent/Nimbus/commit/fc8ce7ce07de2ff8219d9647d922ae4576837a67))
* **cli:** nimbus tail — follow the gateway's operational event stream ([#1511](https://github.com/nimbus-agent/Nimbus/issues/1511)) ([9f70962](https://github.com/nimbus-agent/Nimbus/commit/9f70962084caa57c3eba05d99be40f99dd58187b))
* **cli:** nimbus wow — a guided tour of your own index, ending on a locality proof ([#1565](https://github.com/nimbus-agent/Nimbus/issues/1565)) ([8c78849](https://github.com/nimbus-agent/Nimbus/commit/8c788493e72711cebc38ec9f42726fb2c758bbcc))
* **clips:** a web clip can say who wrote it — optional source metadata on POST /v1/clips (2.5 S2) ([#1285](https://github.com/nimbus-agent/Nimbus/issues/1285)) ([1c7e818](https://github.com/nimbus-agent/Nimbus/commit/1c7e8184e04acf8b1eaddf6415e52fbda46b2001))
* **clips:** related answers about the resolved item, and its snippets come from the body ([#1232](https://github.com/nimbus-agent/Nimbus/issues/1232)) ([9f75fa3](https://github.com/nimbus-agent/Nimbus/commit/9f75fa3fe8c75a740ff86dbea09b8d80cca427b3))
* **computer-use:** I35 gate + D26 confinement for local computer-use actuation (browser lane, driver not yet wired) ([#1415](https://github.com/nimbus-agent/Nimbus/issues/1415)) ([461cebd](https://github.com/nimbus-agent/Nimbus/commit/461cebd634a96762b49270ba2dbb4b1d31d8aa9a))
* **computer-use:** raw-CDP browser lane driver; the browser egress class goes live ([#1418](https://github.com/nimbus-agent/Nimbus/issues/1418)) ([0c52e96](https://github.com/nimbus-agent/Nimbus/commit/0c52e9661282299c9927f0689c6a49bbeb0c56f6))
* **computer-use:** the terminal lane — a confined shell where nothing runs before the owner approves the whole line ([#1426](https://github.com/nimbus-agent/Nimbus/issues/1426)) ([9ad2be9](https://github.com/nimbus-agent/Nimbus/commit/9ad2be9c1d398c1eb1636115ae495e2869775d00))
* **connectors:** attribute PagerDuty incidents to people ([#1177](https://github.com/nimbus-agent/Nimbus/issues/1177)) ([20b51f6](https://github.com/nimbus-agent/Nimbus/commit/20b51f645fb118c388a4ba763514e9272ba627b2))
* **connectors:** consent-gated standalone connectors, so writes cannot run ungated off-gateway ([#1318](https://github.com/nimbus-agent/Nimbus/issues/1318)) ([e4d948a](https://github.com/nimbus-agent/Nimbus/commit/e4d948aa3c03b4a22d603b0f816d3f98bf2c3fe6))
* **connectors:** consume @nimbus-dev/connectors from npm ([#1343](https://github.com/nimbus-agent/Nimbus/issues/1343)) ([0b6ff53](https://github.com/nimbus-agent/Nimbus/commit/0b6ff53aac924d3f4251c74785d58fead450f9b8))
* **connectors:** gcloud login mode for the GCP connectors, detected and adopted ([#1557](https://github.com/nimbus-agent/Nimbus/issues/1557)) ([d01e198](https://github.com/nimbus-agent/Nimbus/commit/d01e198c3af72a188621ad407911a367ceb13c79))
* **connectors:** index GitHub PR reviews and size statistics ([#1159](https://github.com/nimbus-agent/Nimbus/issues/1159)) ([fb8a0c7](https://github.com/nimbus-agent/Nimbus/commit/fb8a0c7a1caeb8ffcf292b9b1f5ca472511e6855))
* **connectors:** index real Notion and Confluence page bodies ([#1039](https://github.com/nimbus-agent/Nimbus/issues/1039)) ([609409e](https://github.com/nimbus-agent/Nimbus/commit/609409ec07c6b72c9d817330a394e1b961ca27fb))
* **connectors:** index Sentry issues, and make the published installers able to install ([#1172](https://github.com/nimbus-agent/Nimbus/issues/1172)) ([ea37e0d](https://github.com/nimbus-agent/Nimbus/commit/ea37e0d0ca904aa9ea229146692ef945b4c80df3))
* **connectors:** nimbus connector detect — reuse existing gh, aws and kubectl logins ([#1554](https://github.com/nimbus-agent/Nimbus/issues/1554)) ([44a57ad](https://github.com/nimbus-agent/Nimbus/commit/44a57ad2ebc442bcaee6c5cd69736a136de14d4f))
* **connectors:** per-connector write action types across all 94 connectors ([#1321](https://github.com/nimbus-agent/Nimbus/issues/1321)) ([072b1fa](https://github.com/nimbus-agent/Nimbus/commit/072b1fa9682c682bfb11fe56ce8498ff32ec56f0))
* **doctor:** report embedding runtime state ([#1397](https://github.com/nimbus-agent/Nimbus/issues/1397)) ([9b3ed09](https://github.com/nimbus-agent/Nimbus/commit/9b3ed09d5e2f5677d812715234d8821b5de9eda2))
* **doctor:** warn when the on-call push cannot reach ChatOps ([#1618](https://github.com/nimbus-agent/Nimbus/issues/1618)) ([f560d92](https://github.com/nimbus-agent/Nimbus/commit/f560d929382731ad6f2bc98a4d63953fa17f1c32))
* **egress:** a targeted fetch names the client that asked for it (U2a) ([#1322](https://github.com/nimbus-agent/Nimbus/issues/1322)) ([8611b5c](https://github.com/nimbus-agent/Nimbus/commit/8611b5c72afab10338e93b438ecd27aeec3ec966))
* **egress:** ledger every non-local LLM route at the provider chokepoint ([#1357](https://github.com/nimbus-agent/Nimbus/issues/1357)) ([278e6b2](https://github.com/nimbus-agent/Nimbus/commit/278e6b2412d80d4cd7aa064e250a9a2f406b129a))
* **egress:** ledger every outbound ChatOps post ([#1403](https://github.com/nimbus-agent/Nimbus/issues/1403)) ([fcef76f](https://github.com/nimbus-agent/Nimbus/commit/fcef76f46e0e6a07f6028e91fb3ba2e6d6c1953e))
* **egress:** ledger remote embeddings and add per-task model routing ([#1384](https://github.com/nimbus-agent/Nimbus/issues/1384)) ([33273b2](https://github.com/nimbus-agent/Nimbus/commit/33273b27aa387d0fb8232847757b95d198efe602))
* **egress:** make the I29 completeness claim true — coverage vector, boot marker, required sink ([#1038](https://github.com/nimbus-agent/Nimbus/issues/1038)) ([a1169d9](https://github.com/nimbus-agent/Nimbus/commit/a1169d943aca41a339bb8fb1c6b32ee4f929e2fb))
* **egress:** record how a targeted fetch ended (U3a) ([#1325](https://github.com/nimbus-agent/Nimbus/issues/1325)) ([68db7d6](https://github.com/nimbus-agent/Nimbus/commit/68db7d63555782b7bb4f8c547c06e561fc8d75dd))
* **engine:** [persona] gives Nimbus a configurable voice ([#1248](https://github.com/nimbus-agent/Nimbus/issues/1248)) ([10b3175](https://github.com/nimbus-agent/Nimbus/commit/10b31750e57f1b3a6469b731b0942929b7f4d7fc))
* **engine:** disclose step-budget exhaustion, emit agent.gasLimitReached, make [llm] loop-guard keys live ([#1640](https://github.com/nimbus-agent/Nimbus/issues/1640)) ([57d9f25](https://github.com/nimbus-agent/Nimbus/commit/57d9f25becb23cecf73279288eb45c0da023691f))
* **engine:** negation predicates reach nimbus ask and MCP clients, refusing rather than guessing (W6-B.2) ([#1281](https://github.com/nimbus-agent/Nimbus/issues/1281)) ([5ce7505](https://github.com/nimbus-agent/Nimbus/commit/5ce7505be84d5cc3e5c0f36e96dae6872c1102b0))
* **engine:** nimbus ask --devil argues against the plan ([#1246](https://github.com/nimbus-agent/Nimbus/issues/1246)) ([becc386](https://github.com/nimbus-agent/Nimbus/commit/becc386cb9d114ed4bf9f292b3ce99cb7e97afa7))
* **exec:** sandboxed code execution behind the I33 owner gate (S2 slice 1) ([#1313](https://github.com/nimbus-agent/Nimbus/issues/1313)) ([25e2c3b](https://github.com/nimbus-agent/Nimbus/commit/25e2c3bdf8ba9b8718cf24994a31bffc36745899))
* expose the read-only agents as MCP tools, recorded in the egress ledger ([#1059](https://github.com/nimbus-agent/Nimbus/issues/1059)) ([dcc7bd7](https://github.com/nimbus-agent/Nimbus/commit/dcc7bd7d1a1bbdf04273b4769df7e0f637bbc209))
* **extensions:** run grants - approve an installed extension to run (S3 extension runtime PR 2) ([#1665](https://github.com/nimbus-agent/Nimbus/issues/1665)) ([37e2044](https://github.com/nimbus-agent/Nimbus/commit/37e2044edca30255e1b148f85cc5c0e3fc72e04e))
* **fleet:** add the overnight-fleet change digest (PR 2a) ([#1467](https://github.com/nimbus-agent/Nimbus/issues/1467)) ([4c54be8](https://github.com/nimbus-agent/Nimbus/commit/4c54be81e5363246037c5ccdd1928ff706611776))
* **fleet:** overnight sub-agent fleets on local compute — S2 PR 1 of 2 ([#1458](https://github.com/nimbus-agent/Nimbus/issues/1458)) ([d47d52e](https://github.com/nimbus-agent/Nimbus/commit/d47d52e220b56293e94628c091bac662404eb816))
* **fleet:** subject enumeration — sweep a corpus instead of naming one subject ([#1541](https://github.com/nimbus-agent/Nimbus/issues/1541)) ([c1bab10](https://github.com/nimbus-agent/Nimbus/commit/c1bab1081af5eb45d13eb0f21a6ee6d441745cc9))
* **gateway:** index Jira/Linear ticket depth and recover it via rebody --since ([#1128](https://github.com/nimbus-agent/Nimbus/issues/1128)) ([bdbecd1](https://github.com/nimbus-agent/Nimbus/commit/bdbecd16438824333aa5014bcf10a3ef19225a58))
* **gateway:** invoke read-only agents over the HTTP API, recorded in the egress ledger ([#1063](https://github.com/nimbus-agent/Nimbus/issues/1063)) ([4b4bedb](https://github.com/nimbus-agent/Nimbus/commit/4b4bedb4e000f79d63f2cddbbda2e2d92006a51e))
* **gateway:** ownership graph derived from already-indexed blame data ([#1064](https://github.com/nimbus-agent/Nimbus/issues/1064)) ([82c03d2](https://github.com/nimbus-agent/Nimbus/commit/82c03d27339290d11276f65cec795c9975432647))
* **gateway:** pre-mortem theme extraction pass (V53, PR A of 2) ([#1134](https://github.com/nimbus-agent/Nimbus/issues/1134)) ([cd1d9c2](https://github.com/nimbus-agent/Nimbus/commit/cd1d9c2e4c25e656af7db81b4de486a939139b69))
* **gateway:** read the ownership graph through the agents.ownership brief ([#1067](https://github.com/nimbus-agent/Nimbus/issues/1067)) ([e898a1e](https://github.com/nimbus-agent/Nimbus/commit/e898a1e9e204c8720050b44b73b37c52611690fc))
* **gateway:** resolve an indexed item by URL (V52 resolve_key) ([#1070](https://github.com/nimbus-agent/Nimbus/issues/1070)) ([0a32751](https://github.com/nimbus-agent/Nimbus/commit/0a32751f6e97af93b5fc405080df14bd7a77911d))
* **gateway:** scope the HTTP API bearer tokens ([#1062](https://github.com/nimbus-agent/Nimbus/issues/1062)) ([826b76a](https://github.com/nimbus-agent/Nimbus/commit/826b76a1a5352ac226bfcd3c6a88b901d6afe33a))
* **gateway:** targeted fetch-on-miss behind a derived host boundary ([#1072](https://github.com/nimbus-agent/Nimbus/issues/1072)) ([369f9af](https://github.com/nimbus-agent/Nimbus/commit/369f9af1a81e10599dc3d9b9f6c86c43bfa95fbc))
* **http:** GET /v1/items/resolve-ids — an item id back to its reference ([#1465](https://github.com/nimbus-agent/Nimbus/issues/1465)) ([8531752](https://github.com/nimbus-agent/Nimbus/commit/8531752330d23551738d815e9f6e2d6d72e75f77))
* **http:** GET /v1/metrics/stats — the bucketed DORA series, plus the change-failure-rate attribution fix ([#1493](https://github.com/nimbus-agent/Nimbus/issues/1493)) ([f6e852a](https://github.com/nimbus-agent/Nimbus/commit/f6e852a13fb81450a6952ce4817acffb1b3dcfbf))
* **http:** GET /v1/services/resolve — repo-URN-to-service resolution ([#1491](https://github.com/nimbus-agent/Nimbus/issues/1491)) ([7da3b84](https://github.com/nimbus-agent/Nimbus/commit/7da3b84dda806f712d1ca7753dc28da580a5eb67))
* **http:** read the egress ledger over HTTP, under its own scope (U1) ([#1319](https://github.com/nimbus-agent/Nimbus/issues/1319)) ([e42d66b](https://github.com/nimbus-agent/Nimbus/commit/e42d66be2728742a9f9224fe44e20d180458729a))
* **http:** resolve a forge file coordinate to a path in the reader's checkout ([#1447](https://github.com/nimbus-agent/Nimbus/issues/1447)) ([b472f67](https://github.com/nimbus-agent/Nimbus/commit/b472f67988de1f7ef16577e47da57f7c42f7e7db))
* **index:** canonical ci_run / pr / git_commit metadata contract (index lane A1) ([#1632](https://github.com/nimbus-agent/Nimbus/issues/1632)) ([232b778](https://github.com/nimbus-agent/Nimbus/commit/232b778339848c2689b3ed31f2d1a240f27d75c3))
* **index:** readers answer from the contract and disclose what they cannot (index lane A2) ([#1634](https://github.com/nimbus-agent/Nimbus/issues/1634)) ([3515729](https://github.com/nimbus-agent/Nimbus/commit/351572970cf90b541a1addcc98930aeef0a72c7a))
* **index:** the lane census is an enforced gate (index lane A3) ([#1635](https://github.com/nimbus-agent/Nimbus/issues/1635)) ([672ef16](https://github.com/nimbus-agent/Nimbus/commit/672ef168bf20305cb00884d22cf756bbd2758263))
* **ipc:** tag agent.chunk with a client-supplied streamId and add workflow.cancel ([#1165](https://github.com/nimbus-agent/Nimbus/issues/1165)) ([5779488](https://github.com/nimbus-agent/Nimbus/commit/5779488c77871113aeaecb7c9fa33c2b82ab540b))
* isolated demo root for nimbus --demo (invariant I41) ([#1545](https://github.com/nimbus-agent/Nimbus/issues/1545)) ([8791c19](https://github.com/nimbus-agent/Nimbus/commit/8791c1990e85f27364e0c8110da43709fba9b07f))
* **llm:** register four cloud vendors behind a default-off per-vendor opt-in ([#1359](https://github.com/nimbus-agent/Nimbus/issues/1359)) ([1a59735](https://github.com/nimbus-agent/Nimbus/commit/1a59735f7ee5cf3fcfe2866d804e149b3bbc3c73))
* **llm:** route the LLM by (provider, model) instead of provider kind ([#1352](https://github.com/nimbus-agent/Nimbus/issues/1352)) ([5ac042c](https://github.com/nimbus-agent/Nimbus/commit/5ac042c04fda879fdfd943eaacb99a09ae022cae))
* **mcp:** act door — agent-proposed connector actions, owner-accepted (S3, I28) ([#1660](https://github.com/nimbus-agent/Nimbus/issues/1660)) ([2714c57](https://github.com/nimbus-agent/Nimbus/commit/2714c574b79287a230fe97ad8d83eaa7853743be))
* **mcp:** capture sink — agent notes over MCP (S3, I28) ([#1653](https://github.com/nimbus-agent/Nimbus/issues/1653)) ([486aa79](https://github.com/nimbus-agent/Nimbus/commit/486aa798d3179c3e60a93ff1fe47b3bdc916991f))
* **mcp:** capture sink proposals — decisions, terms and links over MCP (S3, I28) ([#1657](https://github.com/nimbus-agent/Nimbus/issues/1657)) ([9b7ac3d](https://github.com/nimbus-agent/Nimbus/commit/9b7ac3d70983433f870e0740fbb420d36d78e434))
* **metrics:** nimbus stats charts a metric over time ([#1249](https://github.com/nimbus-agent/Nimbus/issues/1249)) ([ba316d4](https://github.com/nimbus-agent/Nimbus/commit/ba316d412fb25b83d78be798e757bd64c9fdfb80))
* **multimodal:** cloud byte-fetch for Photos, Drive and OneDrive (S2 PR 3 of 4) ([#1448](https://github.com/nimbus-agent/Nimbus/issues/1448)) ([3f7e7b6](https://github.com/nimbus-agent/Nimbus/commit/3f7e7b62668387cf61b40ff0a3ddcc6bf6cf69e9))
* **multimodal:** image understanding and sampled frame captions (S2 PR 2 of 4) ([#1438](https://github.com/nimbus-agent/Nimbus/issues/1438)) ([a24300a](https://github.com/nimbus-agent/Nimbus/commit/a24300a76e03d90a1cbe44833330a3b2a22dee35))
* **multimodal:** local audio/video understanding, indexed and searchable (S2 PR 1 of 4) ([#1429](https://github.com/nimbus-agent/Nimbus/issues/1429)) ([b995a96](https://github.com/nimbus-agent/Nimbus/commit/b995a96b2c135fa19614123df49c82033254065e))
* **multimodal:** remote vision arm with per-artifact grants, I37 and D27 — S2 PR 4 of 4 ([#1454](https://github.com/nimbus-agent/Nimbus/issues/1454)) ([580e893](https://github.com/nimbus-agent/Nimbus/commit/580e8930c7575a760cb838ce3fec4babddb0ae3a))
* **negotiate:** stop crediting agent-caused issues, messages and pages to the owner ([#1669](https://github.com/nimbus-agent/Nimbus/issues/1669)) ([6a7c84c](https://github.com/nimbus-agent/Nimbus/commit/6a7c84c193f5e4f5e45db68cc1d251822e542e1b))
* **notifications:** deliver OS notifications on Windows, macOS and Linux (pre-S3 E) ([#1646](https://github.com/nimbus-agent/Nimbus/issues/1646)) ([d0d7a61](https://github.com/nimbus-agent/Nimbus/commit/d0d7a613a8fab4477510d0dc9741b07045cda9de))
* **oncall:** post the pushed brief's headline to ChatOps (PR 2 of 3) ([#1600](https://github.com/nimbus-agent/Nimbus/issues/1600)) ([84a335e](https://github.com/nimbus-agent/Nimbus/commit/84a335ecc6045b8fac0278113d599f103a514a85))
* **oncall:** push the on-call brief when a P1 is assigned to you ([#1592](https://github.com/nimbus-agent/Nimbus/issues/1592)) ([7a4feb5](https://github.com/nimbus-agent/Nimbus/commit/7a4feb5e79947b4e9a1b381bc84f7aa7409a282d))
* **prfiles:** index PR changed-file paths behind an explicit coverage record ([#1258](https://github.com/nimbus-agent/Nimbus/issues/1258)) ([926fb80](https://github.com/nimbus-agent/Nimbus/commit/926fb80fd4f04515c6f92ef8aca40a0986746df4))
* **query:** first-class negation queries that refuse rather than answer from an empty index (W6-B.1) ([#1277](https://github.com/nimbus-agent/Nimbus/issues/1277)) ([10c20cb](https://github.com/nimbus-agent/Nimbus/commit/10c20cb0cbb2daaf83585ff81346acfdce7a247c))
* **sandbox:** a real Windows sandbox leg, and a policy-shaped runner interface ([#1294](https://github.com/nimbus-agent/Nimbus/issues/1294)) ([54c20c9](https://github.com/nimbus-agent/Nimbus/commit/54c20c98714a85b1a57d5166938c4cd2bedcc457))
* **search:** disclose keyword-only and mid-backfill results; typed embedding query timeout ([#1535](https://github.com/nimbus-agent/Nimbus/issues/1535)) ([c6c7e27](https://github.com/nimbus-agent/Nimbus/commit/c6c7e27b75901cbfa19f7b03b4514d6fb63d831c))
* **security:** I32 — clip source metadata is whitelist-constructed, so a page cannot deny ingestion of its own clip ([#1288](https://github.com/nimbus-agent/Nimbus/issues/1288)) ([5587c84](https://github.com/nimbus-agent/Nimbus/commit/5587c84e55eff015ea508a423fb7365e14ce94f9))
* **sync:** connectors reach credentials and the index only through scoped capabilities ([#1333](https://github.com/nimbus-agent/Nimbus/issues/1333)) ([23233d5](https://github.com/nimbus-agent/Nimbus/commit/23233d5b4ccecfcf92ab481d2e93a9315d5527f7))
* **telemetry:** measure agent invocation latency p50/p95 ([#1641](https://github.com/nimbus-agent/Nimbus/issues/1641)) ([082311b](https://github.com/nimbus-agent/Nimbus/commit/082311bbeaccc495dcdd920a62d4e8540eba1fac))
* **toolgen:** draft a tool body and its input schema, and bind credentials at create time ([#1481](https://github.com/nimbus-agent/Nimbus/issues/1481)) ([ecd1a04](https://github.com/nimbus-agent/Nimbus/commit/ecd1a04f8c8f47032992b2475cd67334f8afe0dd))
* **toolgen:** runtime tool generation PR 1 of 3 — the sandboxed substrate ([#1475](https://github.com/nimbus-agent/Nimbus/issues/1475)) ([4719bfb](https://github.com/nimbus-agent/Nimbus/commit/4719bfb1aaa1febd3ed0b68c180398714f121eea))
* **toolgen:** runtime tool generation PR 3 of 3 — persistence + signing ([#1487](https://github.com/nimbus-agent/Nimbus/issues/1487)) ([52644ce](https://github.com/nimbus-agent/Nimbus/commit/52644cef588e44f3d82621a4589ca682787bafba))
* **tooling:** close the gap between local gates and CI ([#1050](https://github.com/nimbus-agent/Nimbus/issues/1050)) ([0efd781](https://github.com/nimbus-agent/Nimbus/commit/0efd781af366606b6dc0ddb8e08a97027db55d5a))
* **ui:** On-call page for pushed briefs (PR 3 of 3) ([#1604](https://github.com/nimbus-agent/Nimbus/issues/1604)) ([88e161a](https://github.com/nimbus-agent/Nimbus/commit/88e161a279ac8e5e7ab8f54c68f17c4fe8ed0861))
* **ui:** read-only desktop Captures page ([#1672](https://github.com/nimbus-agent/Nimbus/issues/1672)) ([69d5e9d](https://github.com/nimbus-agent/Nimbus/commit/69d5e9d9c57883e2f02e8dc7468776988d0bb964))
* **updater:** refuse apply without an installer, audit apply phases, cache last check ([#1639](https://github.com/nimbus-agent/Nimbus/issues/1639)) ([749656c](https://github.com/nimbus-agent/Nimbus/commit/749656cae8b73485f90778b682b4e6dd36348cc3))
* **user-mcp:** let the model call opted-in user MCP tools for the local owner ([#1628](https://github.com/nimbus-agent/Nimbus/issues/1628)) ([fee3b25](https://github.com/nimbus-agent/Nimbus/commit/fee3b2552287d381ee7ae5085e62430bd76163d5))
* **user-mcp:** org-policy lock-off and I11 wrapping for model-offered tools; prove I38 end to end ([#1637](https://github.com/nimbus-agent/Nimbus/issues/1637)) ([0cf3df0](https://github.com/nimbus-agent/Nimbus/commit/0cf3df04ebf9d11e729813394561325b59637a7f))
* **user-mcp:** run user MCP servers confined, with owner-approved grants ([#1623](https://github.com/nimbus-agent/Nimbus/issues/1623)) ([7797aa1](https://github.com/nimbus-agent/Nimbus/commit/7797aa17b178229afd8f68348ab745b7c96f1bb0))
### Bug Fixes
* `nimbus config set` on a fresh machine, and an unactionable brief footer ([#1212](https://github.com/nimbus-agent/Nimbus/issues/1212)) ([c6824c7](https://github.com/nimbus-agent/Nimbus/commit/c6824c7a361af60a966d3aa9004e079ff3dbd914))
* **admin-console:** escape policy.version before it reaches innerHTML ([#1201](https://github.com/nimbus-agent/Nimbus/issues/1201)) ([f62fd85](https://github.com/nimbus-agent/Nimbus/commit/f62fd8553e1ebc14f67f0a16a784302e80cb55e2))
* **agents:** strip a fabricated reserved section at any level, and in its non-heading form ([#1302](https://github.com/nimbus-agent/Nimbus/issues/1302)) ([6742411](https://github.com/nimbus-agent/Nimbus/commit/6742411706b8c41b3730f93e91ba45bd5129fd75))
* **bitbucket:** 🧹 correct itemsUpserted overcount ([#1086](https://github.com/nimbus-agent/Nimbus/issues/1086)) ([9657921](https://github.com/nimbus-agent/Nimbus/commit/965792107ebcafba10667aab9bd5c7166388dc00))
* **build:** bundle the gateway workers so they exist in a compiled binary ([#1299](https://github.com/nimbus-agent/Nimbus/issues/1299)) ([934779b](https://github.com/nimbus-agent/Nimbus/commit/934779b29fcab02a7d234402e949a14b80264a92))
* **chatops:** escape every Slack-bound post at the wire ([#1617](https://github.com/nimbus-agent/Nimbus/issues/1617)) ([2e76680](https://github.com/nimbus-agent/Nimbus/commit/2e76680d8e7a15519630b0f3543be0177703817a))
* **ci:** accept repo as satisfying public_repo on WINGET_PAT, and add a scope-check script ([#1131](https://github.com/nimbus-agent/Nimbus/issues/1131)) ([ba54754](https://github.com/nimbus-agent/Nimbus/commit/ba54754432f3fb15d61020dff948b6ec8b4fdaf2))
* **ci:** close the pre-push gaps behind most red PR checks ([#1303](https://github.com/nimbus-agent/Nimbus/issues/1303)) ([0407fb0](https://github.com/nimbus-agent/Nimbus/commit/0407fb0c1410a15435c3e170b113a6163db8518e))
* **ci:** make the sandbox spawn suite report why it failed, and gate it on the platforms it is about ([#1298](https://github.com/nimbus-agent/Nimbus/issues/1298)) ([344e217](https://github.com/nimbus-agent/Nimbus/commit/344e2173300bec92886d7f329ba6fe220360c234))
* **ci:** retry a status-less transport failure in the dependency audit ([#1441](https://github.com/nimbus-agent/Nimbus/issues/1441)) ([4b1948b](https://github.com/nimbus-agent/Nimbus/commit/4b1948b79b57a7b66865dea4f7134306d0efbce9))
* **ci:** stop the AuditPanel vitest flake, clear the Sonar board, and make docs/README.md the only README ([#1252](https://github.com/nimbus-agent/Nimbus/issues/1252)) ([70f15ca](https://github.com/nimbus-agent/Nimbus/commit/70f15ca9ab2d0ad1ccb93acc01ab54ad3106c38f))
* **ci:** the sdk release-train tagPattern never matched a real tag, and that only warned ([#1445](https://github.com/nimbus-agent/Nimbus/issues/1445)) ([19a371c](https://github.com/nimbus-agent/Nimbus/commit/19a371c3d9e6251a208e2c20655204b44d59e6cc))
* clear the SonarCloud backlog, reduce duplication and raise test coverage ([#1603](https://github.com/nimbus-agent/Nimbus/issues/1603)) ([4663fbb](https://github.com/nimbus-agent/Nimbus/commit/4663fbb9b4c5139e449e0481b0b2d0dc3f357d6f))
* **cli:** a Gateway connection can always answer a HITL prompt ([#1305](https://github.com/nimbus-agent/Nimbus/issues/1305)) ([576ba6e](https://github.com/nimbus-agent/Nimbus/commit/576ba6e2d7d5fb4ea0cd8d81d0505b4c57f4f085))
* **cli:** make --format plain's underscore-italic pass linear ([#1608](https://github.com/nimbus-agent/Nimbus/issues/1608)) ([475735e](https://github.com/nimbus-agent/Nimbus/commit/475735ee7c9d54dca0b9d5a605506f420cd20d58))
* **cli:** nimbus start waits for the gateway state file, not only the socket ([#1549](https://github.com/nimbus-agent/Nimbus/issues/1549)) ([4267055](https://github.com/nimbus-agent/Nimbus/commit/4267055986ab9e6e12bc85543a8e0e9fa0f4f838))
* **clips:** embed web clips locally and stop advertising discarded text ([#1151](https://github.com/nimbus-agent/Nimbus/issues/1151)) ([0e3b183](https://github.com/nimbus-agent/Nimbus/commit/0e3b18336d1e1cb79080d09b660f20ca785c57ca))
* **cli:** refuse a nested-table key in nimbus config set/get ([#1387](https://github.com/nimbus-agent/Nimbus/issues/1387)) ([1a4338c](https://github.com/nimbus-agent/Nimbus/commit/1a4338c32582ae578dacc3babb34671b07b155f9))
* **cli:** stop blocking gateway RPCs dying on the 30s client timeout ([#1203](https://github.com/nimbus-agent/Nimbus/issues/1203)) ([3fc2132](https://github.com/nimbus-agent/Nimbus/commit/3fc2132255c86fbf04fce408e8f35cb123cb24ef))
* close three documented gaps in completed phases (I16 reasons, connector.startAuth, redaction fixtures) ([#1480](https://github.com/nimbus-agent/Nimbus/issues/1480)) ([da5d239](https://github.com/nimbus-agent/Nimbus/commit/da5d2399eae49412d82d4f2be94be1b2c50c7d25))
* **connectors:** align the aws sync interval with its AWS-CLI siblings ([#1377](https://github.com/nimbus-agent/Nimbus/issues/1377)) ([61173ae](https://github.com/nimbus-agent/Nimbus/commit/61173ae92dc87002d3bc844ce0c792257292d677))
* **connectors:** gcloud spawns authenticate as the configured GCP service-account key ([#1553](https://github.com/nimbus-agent/Nimbus/issues/1553)) ([e1d16b1](https://github.com/nimbus-agent/Nimbus/commit/e1d16b119a40364bd436773966672434de283077))
* **connectors:** index a Confluence page under its browser URL ([#1364](https://github.com/nimbus-agent/Nimbus/issues/1364)) ([c7a9e1a](https://github.com/nimbus-agent/Nimbus/commit/c7a9e1a53fcc5fc22e2830e38ad25009b7e5d6e5))
* **connectors:** let Jira, Confluence, GitLab, dbt and the Teams bot reach their configured host from the sandbox ([#1536](https://github.com/nimbus-agent/Nimbus/issues/1536)) ([d4465f9](https://github.com/nimbus-agent/Nimbus/commit/d4465f9c3c784532a056cfef0bc63433d2936af2))
* **connectors:** make connector auth refuse vault-key services with the exact vault set commands ([#1537](https://github.com/nimbus-agent/Nimbus/issues/1537)) ([02011df](https://github.com/nimbus-agent/Nimbus/commit/02011dfa35ceaee8231863de7d43ffb405beb0ef))
* **connectors:** report only what was actually verified in connector auth and targeted fetch ([#1141](https://github.com/nimbus-agent/Nimbus/issues/1141)) ([902cd42](https://github.com/nimbus-agent/Nimbus/commit/902cd4291f9fb5278e56e59a9c1ecebbb293b33c))
* **connectors:** stop connector CLI spawns flashing console windows on Windows ([#1370](https://github.com/nimbus-agent/Nimbus/issues/1370)) ([184dc42](https://github.com/nimbus-agent/Nimbus/commit/184dc42aed22b4156d1f8367f69e60118ebcffab))
* **coverage:** gate four runtime-bearing types files and give the sandbox harness a way to run ([#1230](https://github.com/nimbus-agent/Nimbus/issues/1230)) ([326493d](https://github.com/nimbus-agent/Nimbus/commit/326493d950392b38e38b2ed5d70410693d3b976a))
* **demo:** retry the demo-root delete for real on Windows; size the PAL boot test for CI ([#1673](https://github.com/nimbus-agent/Nimbus/issues/1673)) ([a264732](https://github.com/nimbus-agent/Nimbus/commit/a2647325c37f99bba373512c5a1b545022e94116))
* **deps:** bump the brace-expansion override to 5.0.9 (GHSA-rgw5-rvv9-x895) ([#1035](https://github.com/nimbus-agent/Nimbus/issues/1035)) ([8d66323](https://github.com/nimbus-agent/Nimbus/commit/8d663237a4ff3615e12cd6c8f106aa3c51b4f34e))
* **deps:** bump the bundled connectors to 0.2.2 and drop the nodemailer override ([#1606](https://github.com/nimbus-agent/Nimbus/issues/1606)) ([58ad04f](https://github.com/nimbus-agent/Nimbus/commit/58ad04fad78a7c7f3c79f8602b41e7798fc05b62))
* **deps:** bump the devalue override to 5.9.4 for three new high advisories ([#1593](https://github.com/nimbus-agent/Nimbus/issues/1593)) ([693f62b](https://github.com/nimbus-agent/Nimbus/commit/693f62ba1885418b3dfd57db9e619810c53f509a))
* **deps:** bundle connectors 0.2.4, and name the right Workday task in the auth help ([#1614](https://github.com/nimbus-agent/Nimbus/issues/1614)) ([d25fbea](https://github.com/nimbus-agent/Nimbus/commit/d25fbea19f8d3042e68ec17eeacf5d3b96b962a9))
* **deps:** override [@modelcontextprotocol](https://github.com/modelcontextprotocol) client/core/server to the patched 2.2 line ([#1624](https://github.com/nimbus-agent/Nimbus/issues/1624)) ([a00d70d](https://github.com/nimbus-agent/Nimbus/commit/a00d70d8cc0bda237379f7a1eddb9babee2c47f7))
* **deps:** override past five new moderate advisories (ip-address, nodemailer, undici, markdown-it) ([#1577](https://github.com/nimbus-agent/Nimbus/issues/1577)) ([beec826](https://github.com/nimbus-agent/Nimbus/commit/beec82653ff9b0be85c073112b35b58a01754436))
* **deps:** override past new brace-expansion and fast-uri advisories ([#1586](https://github.com/nimbus-agent/Nimbus/issues/1586)) ([19327c5](https://github.com/nimbus-agent/Nimbus/commit/19327c5298a86c28d35363ee637a0263d7036f17))
* **deps:** unbreak main — move the override pins [#1469](https://github.com/nimbus-agent/Nimbus/issues/1469) outgrew, and restore the docs build ([#1474](https://github.com/nimbus-agent/Nimbus/issues/1474)) ([2cc6fcf](https://github.com/nimbus-agent/Nimbus/commit/2cc6fcf0870629919ee83110681a44503f2a674d))
* **docs:** correct the standalone connector install path, and measure client support ([#1323](https://github.com/nimbus-agent/Nimbus/issues/1323)) ([bdc6abf](https://github.com/nimbus-agent/Nimbus/commit/bdc6abf2bc44ad53933191f35537fdf1ea56c737))
* **docs:** derive four drifted invariant claims instead of hand-maintaining them ([#1221](https://github.com/nimbus-agent/Nimbus/issues/1221)) ([6fc59e5](https://github.com/nimbus-agent/Nimbus/commit/6fc59e518c1f269701e57f4b5d5af7bb0b1166db))
* **egress:** count the whole prove window, not the first page of it ([#1189](https://github.com/nimbus-agent/Nimbus/issues/1189)) ([1743437](https://github.com/nimbus-agent/Nimbus/commit/1743437229cc4b9fec8387fede74ced92f8d0453))
* **embedding:** cancel timed-out query embedding work, not just abandon it ([#1542](https://github.com/nimbus-agent/Nimbus/issues/1542)) ([35b0aa8](https://github.com/nimbus-agent/Nimbus/commit/35b0aa86cf38bdb5fdf74dc3b506f4a8b7f8cf52))
* **embedding:** embed the onnx addon so the compiled binary can load it ([#1402](https://github.com/nimbus-agent/Nimbus/issues/1402)) ([7ca8379](https://github.com/nimbus-agent/Nimbus/commit/7ca83798c1c2d40e91ab6839e5c94cf54646a88d))
* **embedding:** embed the onnxruntime runtime library, not just the addon ([#1405](https://github.com/nimbus-agent/Nimbus/issues/1405)) ([7d38e79](https://github.com/nimbus-agent/Nimbus/commit/7d38e79f5bdcf68b9a58763cc7267ab34f1843b5))
* **embedding:** report the backfill pass from the hybrid and openai runtimes ([#1538](https://github.com/nimbus-agent/Nimbus/issues/1538)) ([5d31dab](https://github.com/nimbus-agent/Nimbus/commit/5d31dabfbfda1cd7e0f576c98ca36a4e032d78bc))
* **embedding:** ship the onnx binding and stub sharp so the worker can start ([#1399](https://github.com/nimbus-agent/Nimbus/issues/1399)) ([2356e6a](https://github.com/nimbus-agent/Nimbus/commit/2356e6a7e4d25aab4baf954ce8a2e1d17df604f6))
* **extensions:** read the registry's entryHash as the entry file's hash everywhere ([#1662](https://github.com/nimbus-agent/Nimbus/issues/1662)) ([42102e0](https://github.com/nimbus-agent/Nimbus/commit/42102e06040d5810b002bf57621e91782e2b40d4))
* **fleet:** close the five follow-ups from the overnight-fleet merge ([#1462](https://github.com/nimbus-agent/Nimbus/issues/1462)) ([bf0559b](https://github.com/nimbus-agent/Nimbus/commit/bf0559b56c52ab79c9c48e94fd1d2ce1e649aa67))
* **gateway:** 🔒 Prevent command injection in tar extraction ([#1091](https://github.com/nimbus-agent/Nimbus/issues/1091)) ([575e2aa](https://github.com/nimbus-agent/Nimbus/commit/575e2aa5648d101c02f06450df4016500e3cfe50))
* **gateway:** enforce the connector allowlist at the federated invoke gate, and route ChatOps writes through the write transport ([#1615](https://github.com/nimbus-agent/Nimbus/issues/1615)) ([1c578cb](https://github.com/nimbus-agent/Nimbus/commit/1c578cbbda71f4645726b5348050ccfab2d200bf))
* **gateway:** log why the process exits instead of dying silently ([#1140](https://github.com/nimbus-agent/Nimbus/issues/1140)) ([322ea68](https://github.com/nimbus-agent/Nimbus/commit/322ea683266d97a96aaa05e182b6208365ad5dbe))
* **gateway:** make connectors spawnable from a compiled binary ([#1055](https://github.com/nimbus-agent/Nimbus/issues/1055)) ([b3a6f15](https://github.com/nimbus-agent/Nimbus/commit/b3a6f159e9f9c4b8b0ed44262067efec42dfaba4))
* **gateway:** refuse connector writes and code-executing connector tools at the federated invoke gate (I26) ([#1607](https://github.com/nimbus-agent/Nimbus/issues/1607)) ([eeb5245](https://github.com/nimbus-agent/Nimbus/commit/eeb5245bf3237abb4cf9e70407cddc1e527583ac))
* **gateway:** resolve bare connector tool ids on the caller's own MCP server ([#1610](https://github.com/nimbus-agent/Nimbus/issues/1610)) ([3e41d5b](https://github.com/nimbus-agent/Nimbus/commit/3e41d5b34c216d74e63c83473525718633f93210))
* **gateway:** resolve WAL mode race in http-api-test-server ([#1093](https://github.com/nimbus-agent/Nimbus/issues/1093)) ([1323567](https://github.com/nimbus-agent/Nimbus/commit/1323567a7a2d07bea4b39a6ba1b4a974cccc2b00))
* **gateway:** serve the admin console and OpenAPI doc from a compiled binary ([#1058](https://github.com/nimbus-agent/Nimbus/issues/1058)) ([36abf19](https://github.com/nimbus-agent/Nimbus/commit/36abf192457984a42e2d4e74b984603d51fbb376))
* **gateway:** stop console windows flashing on every Windows sync ([#1451](https://github.com/nimbus-agent/Nimbus/issues/1451)) ([2042740](https://github.com/nimbus-agent/Nimbus/commit/2042740e9aac2b8cbf87e9ab04e801a3f51e5df2))
* **index:** extract `export default` symbols in the code indexer ([#1391](https://github.com/nimbus-agent/Nimbus/issues/1391)) ([78751d2](https://github.com/nimbus-agent/Nimbus/commit/78751d2f54ab9898f7e1a0fc77ec3df226003357))
* **index:** one pre-migration backup per upgrade, none on a fresh install ([#1671](https://github.com/nimbus-agent/Nimbus/issues/1671)) ([9eb42b1](https://github.com/nimbus-agent/Nimbus/commit/9eb42b12b4ce7e15b011b2af29126d999faf8c46))
* **init:** --no-sync no longer ends by naming two commands that cannot work ([#1341](https://github.com/nimbus-agent/Nimbus/issues/1341)) ([829db8c](https://github.com/nimbus-agent/Nimbus/commit/829db8c1499ac131f0f998084d94beefc0cdb046))
* **install:** stop Windows PowerShell 5.1 native stderr from aborting gpg signature verification ([#1179](https://github.com/nimbus-agent/Nimbus/issues/1179)) ([6c991ea](https://github.com/nimbus-agent/Nimbus/commit/6c991eabf4cb110a4ddaf0ca844da62bfd437e7d))
* **install:** verify the release signature on Windows with a Git-for-Windows gpg ([#1175](https://github.com/nimbus-agent/Nimbus/issues/1175)) ([a68945e](https://github.com/nimbus-agent/Nimbus/commit/a68945e55cff9409536824d9fa7ff2c87d025fef))
* **jenkins:** build headers with Headers so a hostile crumb cannot reach a prototype ([#1336](https://github.com/nimbus-agent/Nimbus/issues/1336)) ([8edb94f](https://github.com/nimbus-agent/Nimbus/commit/8edb94f6d178cd7479ffc4ec71e59e6fbe5a4d6a))
* **lan:** never drop the tail of a large federation frame ([#1630](https://github.com/nimbus-agent/Nimbus/issues/1630)) ([814f470](https://github.com/nimbus-agent/Nimbus/commit/814f470b84f3057e0798136d30291517c9c9f12a))
* **llm:** a provider named __proto__ vanished from the availability map ([#1442](https://github.com/nimbus-agent/Nimbus/issues/1442)) ([c16855a](https://github.com/nimbus-agent/Nimbus/commit/c16855a7d09ba90cb129173852bfa281092ba114))
* **llm:** enforce_air_gap now refuses the remote classifier instead of doing nothing ([#1334](https://github.com/nimbus-agent/Nimbus/issues/1334)) ([be9841c](https://github.com/nimbus-agent/Nimbus/commit/be9841cbda3746e5c727caaf131b9013dfaec697))
* **llm:** ledger the ask intent classifier, and three defects found on a live install ([#1366](https://github.com/nimbus-agent/Nimbus/issues/1366)) ([8202ec6](https://github.com/nimbus-agent/Nimbus/commit/8202ec64199c524ff436f3d4d04822e9c9a8620c))
* **llm:** make llm.setDefault write the store the router actually reads ([#1410](https://github.com/nimbus-agent/Nimbus/issues/1410)) ([9f69790](https://github.com/nimbus-agent/Nimbus/commit/9f69790ca0e29795997e614732539dce5792bfae))
* **llm:** remove the inert remote_model key and document the vendor tables ([#1368](https://github.com/nimbus-agent/Nimbus/issues/1368)) ([0ca8232](https://github.com/nimbus-agent/Nimbus/commit/0ca82323f26dbd10dc59efa28eab3c43ba9c593e))
* **llm:** stop Ollama reasoning tokens truncating answers and costing ~16s per ask ([#1376](https://github.com/nimbus-agent/Nimbus/issues/1376)) ([abdbbdc](https://github.com/nimbus-agent/Nimbus/commit/abdbbdcf41ba91243f3d76e1b5ad301e01aba3a8))
* **logging:** stop logging every Error as {} ([#1393](https://github.com/nimbus-agent/Nimbus/issues/1393)) ([7734ab1](https://github.com/nimbus-agent/Nimbus/commit/7734ab10b68ea5c221b56cfc8ccfabe555ef80ca))
* **media:** show real sizes in the allow-remote consent preview ([#1534](https://github.com/nimbus-agent/Nimbus/issues/1534)) ([c6f927e](https://github.com/nimbus-agent/Nimbus/commit/c6f927ec0d5f88dc6d54d4f81482765236a324be))
* **metrics:** stop requiring a resolved status to attribute a change failure ([#1494](https://github.com/nimbus-agent/Nimbus/issues/1494)) ([011cbf7](https://github.com/nimbus-agent/Nimbus/commit/011cbf74a03164e4eb4b3b21a67661d33c557b91))
* **ownership:** stop the symbol sync wiping owner counts from the graph ([#1255](https://github.com/nimbus-agent/Nimbus/issues/1255)) ([34a08e3](https://github.com/nimbus-agent/Nimbus/commit/34a08e3005e554e935135409ff1a64469b56d5c8))
* **perf:** drift-check must use each surface own noise floor, not a hardcoded 10% ([#1374](https://github.com/nimbus-agent/Nimbus/issues/1374)) ([8607743](https://github.com/nimbus-agent/Nimbus/commit/860774328ca64b358c1259b3ab29178f9b63375b))
* **platform:** bundle a full SQLite with the macOS build so semantic search works without Homebrew ([#1507](https://github.com/nimbus-agent/Nimbus/issues/1507)) ([a3703cc](https://github.com/nimbus-agent/Nimbus/commit/a3703cc0b63bf7b9de4efce67bae91a2e71831a2))
* **platform:** load a full SQLite on macOS so sqlite-vec can load ([#1503](https://github.com/nimbus-agent/Nimbus/issues/1503)) ([107bf08](https://github.com/nimbus-agent/Nimbus/commit/107bf084021bfc7dbd08fae0e42d3d2690f5b7ed))
* **preflight:** an unknown service must not pass the deploy gate ([#1297](https://github.com/nimbus-agent/Nimbus/issues/1297)) ([6ae5a53](https://github.com/nimbus-agent/Nimbus/commit/6ae5a53fd3ca911373ca511dafa5ad48e29f1d69))
* prove the installed binary's claims in install-smoke and retract the dark ones from the docs ([#1627](https://github.com/nimbus-agent/Nimbus/issues/1627)) ([d40fbcd](https://github.com/nimbus-agent/Nimbus/commit/d40fbcd9cf23eeed2f7fdcce8572147c2d454332))
* **quality:** clear 9 Sonar issues, two of them real security bugs ([#1327](https://github.com/nimbus-agent/Nimbus/issues/1327)) ([6d828c5](https://github.com/nimbus-agent/Nimbus/commit/6d828c5c273e5c01d8d2ac44281ce7ef2753284b))
* **quality:** clear the SonarCloud board, prune the delivered plans and specs, and fix what that exposed ([#1497](https://github.com/nimbus-agent/Nimbus/issues/1497)) ([63bbdd9](https://github.com/nimbus-agent/Nimbus/commit/63bbdd920343b92f48952b71f6197f2de0a4bf94))
* **quality:** close two ReDoS regexes and clear 25 SonarCloud findings ([#1152](https://github.com/nimbus-agent/Nimbus/issues/1152)) ([1f89379](https://github.com/nimbus-agent/Nimbus/commit/1f893798d6466c8a860fcda2141f5832acdda9c2))
* **quality:** fix all 29 open Sonar findings in code, cut duplication 420 to 400 clones, and correct five stale doc facts ([#1439](https://github.com/nimbus-agent/Nimbus/issues/1439)) ([62a6a20](https://github.com/nimbus-agent/Nimbus/commit/62a6a20286e3d9a55d9507b4b25e8f36b13f8f8b))
* refuse index.regraph over LAN, retire the merge queue and Dependabot, and refresh the contributor docs ([#1596](https://github.com/nimbus-agent/Nimbus/issues/1596)) ([6f6f025](https://github.com/nimbus-agent/Nimbus/commit/6f6f02559c97b4e082101634d8e8af5061a1ca6c))
* **release:** gate the release PR at PR time, and reject a body release-please cannot parse ([#1227](https://github.com/nimbus-agent/Nimbus/issues/1227)) ([074daab](https://github.com/nimbus-agent/Nimbus/commit/074daab8d22b28212b4a8fd467d3783b76678e35))
* **release:** parse the squash message GitHub actually creates ([#1235](https://github.com/nimbus-agent/Nimbus/issues/1235)) ([044c16b](https://github.com/nimbus-agent/Nimbus/commit/044c16bd36b4aa06716a917d6a6e412ef9c8ef80))
* resolve macos-15 CI test failures and consolidate open connector PRs ([#1082](https://github.com/nimbus-agent/Nimbus/issues/1082)) ([9f9215b](https://github.com/nimbus-agent/Nimbus/commit/9f9215bfcca7ba4cdde0b66e4975881359882797))
* resolve the brief timeout from one definition, and make the ask context budget configurable ([#1354](https://github.com/nimbus-agent/Nimbus/issues/1354)) ([30c1ce6](https://github.com/nimbus-agent/Nimbus/commit/30c1ce61afedf459651a25dc1fb88cc32b1152f4))
* **sandbox:** stop concurrent sandbox users from deleting each other's profiles, and a macOS test hang ([#1680](https://github.com/nimbus-agent/Nimbus/issues/1680)) ([a7eca57](https://github.com/nimbus-agent/Nimbus/commit/a7eca5788c9b1aa6168a04c4a9b267aa91c04912))
* **sandbox:** stop the Windows helper leaking an ACE per run; tool run follow-ups ([#1524](https://github.com/nimbus-agent/Nimbus/issues/1524)) ([52fb7cf](https://github.com/nimbus-agent/Nimbus/commit/52fb7cfea808893955c6267caf08a5cb18aae943))
* **search:** stop the vector KNN re-running once per chunk row ([#1500](https://github.com/nimbus-agent/Nimbus/issues/1500)) ([1ac89f6](https://github.com/nimbus-agent/Nimbus/commit/1ac89f6808c5ed51f39fb8ea5d9ca8c42d3afc62))
* **security:** three allowlisted methods had no reachable handler; add the test I7 promised ([#1225](https://github.com/nimbus-agent/Nimbus/issues/1225)) ([f7d8c75](https://github.com/nimbus-agent/Nimbus/commit/f7d8c75cdd893a0cabd596f3792fc5aa05c43d05))
* **security:** wire the two I22/I18 defenses that were resolved but never read ([#1220](https://github.com/nimbus-agent/Nimbus/issues/1220)) ([84d3e62](https://github.com/nimbus-agent/Nimbus/commit/84d3e6294a0cf537824410044b93dbe8325a4c13))
* **sonar:** clear 23 findings, and document five that should not be applied ([#1434](https://github.com/nimbus-agent/Nimbus/issues/1434)) ([64d50af](https://github.com/nimbus-agent/Nimbus/commit/64d50af67ddf196c742da5492e6005a7b745b9e0))
* **sonar:** raw path literals, media flag validators, and the two findings the last pass added ([#1437](https://github.com/nimbus-agent/Nimbus/issues/1437)) ([6fe5240](https://github.com/nimbus-agent/Nimbus/commit/6fe52402b34a2be90dc86a6ab1dd0407246dca6e))
* **sonar:** resolve the six minor findings and annotate the S8786 false positive ([#1206](https://github.com/nimbus-agent/Nimbus/issues/1206)) ([fa65d95](https://github.com/nimbus-agent/Nimbus/commit/fa65d957c46ff46354f8c17d9d37cf4d13957c19))
* **sonar:** specific matchers and named decisions, minus two arity assertions ([#1436](https://github.com/nimbus-agent/Nimbus/issues/1436)) ([d1900c6](https://github.com/nimbus-agent/Nimbus/commit/d1900c6e5a679cf520053f33fd02e7fbbad280b4))
* **test:** re-home the F11 Google-spawn isolation tests off a process-global mock ([#1311](https://github.com/nimbus-agent/Nimbus/issues/1311)) ([f9c6f92](https://github.com/nimbus-agent/Nimbus/commit/f9c6f92ee2c2ef27b96c2df26b8a68ee4b8dd60d))
* **test:** stop the Windows deploy.preflight hook timeout and clear the Sonar backlog ([#1316](https://github.com/nimbus-agent/Nimbus/issues/1316)) ([139aa40](https://github.com/nimbus-agent/Nimbus/commit/139aa40307d73083bfeb955d264858d1ad2e54c9))
* the remaining 24 findings from the local-LLM audit ([#1307](https://github.com/nimbus-agent/Nimbus/issues/1307)) ([1f9ae09](https://github.com/nimbus-agent/Nimbus/commit/1f9ae09a1a27401de96241686e9b97868309b969))
* **tui:** render the watcher pane, and stop claiming OS notifications work ([#1204](https://github.com/nimbus-agent/Nimbus/issues/1204)) ([78cb49b](https://github.com/nimbus-agent/Nimbus/commit/78cb49b0b8242e8ce56245c4454cc6e49c507244))
* **user-mcp:** per-server dispatch listing, no sync.run egress rows, bounded Windows boot revoke ([#1629](https://github.com/nimbus-agent/Nimbus/issues/1629)) ([e1850af](https://github.com/nimbus-agent/Nimbus/commit/e1850af265e2ac81053fea2b0826ed2091286d32))
### Performance Improvements
* **connectors:** ⚡ batch fetch message metadata in Gmail sync ([#1099](https://github.com/nimbus-agent/Nimbus/issues/1099)) ([cf1dfe1](https://github.com/nimbus-agent/Nimbus/commit/cf1dfe1d50b61682a7a27849e4678ecd734bc078))
* **filesystem:** index only what changed since the last sync tick ([#1453](https://github.com/nimbus-agent/Nimbus/issues/1453)) ([ec284d1](https://github.com/nimbus-agent/Nimbus/commit/ec284d13fbf66f4c0b5680768441f253e4c9daf0))
* **gateway:** ⚡ batch API calls in SonarQube Sync to resolve N+1 issue ([#1089](https://github.com/nimbus-agent/Nimbus/issues/1089)) ([892e96b](https://github.com/nimbus-agent/Nimbus/commit/892e96b62839e9bc1a94d73b206a49fa1dd3233a))
* **index:** build a fresh database without a flush per migration step ([#1675](https://github.com/nimbus-agent/Nimbus/issues/1675)) ([9a0330f](https://github.com/nimbus-agent/Nimbus/commit/9a0330f69b267e2ee9d57e5383a0517b8d5eb3e4))
* **jenkins:** ⚡ batch jenkins job builds sync ([#1087](https://github.com/nimbus-agent/Nimbus/issues/1087)) ([d94d632](https://github.com/nimbus-agent/Nimbus/commit/d94d63274a0d8f4a29771816e77911363ea24c11))
* **test:** a migrated-once schema template and a deadline-bounded poll, for the Windows hot path ([#1291](https://github.com/nimbus-agent/Nimbus/issues/1291)) ([6e5fbfd](https://github.com/nimbus-agent/Nimbus/commit/6e5fbfdea1a3e095095aec665cc6e0f9d5d10711))
### Code Refactoring
* **connectors:** delete packages/mcp-connectors — it ships from npm now ([#1347](https://github.com/nimbus-agent/Nimbus/issues/1347)) ([2118cdd](https://github.com/nimbus-agent/Nimbus/commit/2118cdd4ba4954d9617485973b753f47fcbed03c))
* **egress:** remove the EgressCompleteness.tier compat shim ([#1156](https://github.com/nimbus-agent/Nimbus/issues/1156)) ([7b530dc](https://github.com/nimbus-agent/Nimbus/commit/7b530dcc15930a208d63af43ad3af9dd46f44d07))
* **llm:** make LlmRegistryOptions.db required so an unledgered non-local route is a compile error ([#1372](https://github.com/nimbus-agent/Nimbus/issues/1372)) ([97ce904](https://github.com/nimbus-agent/Nimbus/commit/97ce9043cb6c08e9e7c5c06a3db5bf71f0bda1c0))
## [7.47.1](https://github.com/nimbus-agent/Nimbus/compare/v7.47.0...v7.47.1) (2026-10-17)
### Performance Improvements
* **index:** build a fresh database without a flush per migration step ([#1675](https://github.com/nimbus-agent/Nimbus/issues/1675)) ([9a0330f](https://github.com/nimbus-agent/Nimbus/commit/9a0330f69b267e2ee9d57e5383a0517b8d5eb3e4))
## [7.47.0](https://github.com/nimbus-agent/Nimbus/compare/v7.46.0...v7.47.0) (2026-10-16)
### Features
* **ui:** read-only desktop Captures page ([#1672](https://github.com/nimbus-agent/Nimbus/issues/1672)) ([69d5e9d](https://github.com/nimbus-agent/Nimbus/commit/69d5e9d9c57883e2f02e8dc7468776988d0bb964))
## [7.46.0](https://github.com/nimbus-agent/Nimbus/compare/v7.45.0...v7.46.0) (2026-10-16)
### Features
* **captures:** batch accept proposed decisions, terms and links ([#1668](https://github.com/nimbus-agent/Nimbus/issues/1668)) ([64ab982](https://github.com/nimbus-agent/Nimbus/commit/64ab98286e87b20500bf322bacd04c8cc136e005))
* **captures:** purge a finished action's stored input; prune executed/failed after 90 days ([#1667](https://github.com/nimbus-agent/Nimbus/issues/1667)) ([e35e346](https://github.com/nimbus-agent/Nimbus/commit/e35e3460b6499c33f4c46736a0358fee39f56f14))
* **extensions:** run grants - approve an installed extension to run (S3 extension runtime PR 2) ([#1665](https://github.com/nimbus-agent/Nimbus/issues/1665)) ([37e2044](https://github.com/nimbus-agent/Nimbus/commit/37e2044edca30255e1b148f85cc5c0e3fc72e04e))
* **negotiate:** stop crediting agent-caused issues, messages and pages to the owner ([#1669](https://github.com/nimbus-agent/Nimbus/issues/1669)) ([6a7c84c](https://github.com/nimbus-agent/Nimbus/commit/6a7c84c193f5e4f5e45db68cc1d251822e542e1b))
### Bug Fixes
* **index:** one pre-migration backup per upgrade, none on a fresh install ([#1671](https://github.com/nimbus-agent/Nimbus/issues/1671)) ([9eb42b1](https://github.com/nimbus-agent/Nimbus/commit/9eb42b12b4ce7e15b011b2af29126d999faf8c46))
## [7.45.0](https://github.com/nimbus-agent/Nimbus/compare/v7.44.0...v7.45.0) (2026-10-16)
### Features
* **mcp:** act door — agent-proposed connector actions, owner-accepted (S3, I28) ([#1660](https://github.com/nimbus-agent/Nimbus/issues/1660)) ([2714c57](https://github.com/nimbus-agent/Nimbus/commit/2714c574b79287a230fe97ad8d83eaa7853743be))
### Bug Fixes
* **extensions:** read the registry's entryHash as the entry file's hash everywhere ([#1662](https://github.com/nimbus-agent/Nimbus/issues/1662)) ([42102e0](https://github.com/nimbus-agent/Nimbus/commit/42102e06040d5810b002bf57621e91782e2b40d4))
## [7.44.0](https://github.com/nimbus-agent/Nimbus/compare/v7.43.0...v7.44.0) (2026-10-14)
### Features
* **mcp:** capture sink proposals — decisions, terms and links over MCP (S3, I28) ([#1657](https://github.com/nimbus-agent/Nimbus/issues/1657)) ([9b7ac3d](https://github.com/nimbus-agent/Nimbus/commit/9b7ac3d70983433f870e0740fbb420d36d78e434))
## [7.43.0](https://github.com/nimbus-agent/Nimbus/compare/v7.42.0...v7.43.0) (2026-10-13)
### Features
* **mcp:** capture sink — agent notes over MCP (S3, I28) ([#1653](https://github.com/nimbus-agent/Nimbus/issues/1653)) ([486aa79](https://github.com/nimbus-agent/Nimbus/commit/486aa798d3179c3e60a93ff1fe47b3bdc916991f))
## [7.42.0](https://github.com/nimbus-agent/Nimbus/compare/v7.41.0...v7.42.0) (2026-10-10)
### Features
* **notifications:** deliver OS notifications on Windows, macOS and Linux (pre-S3 E) ([#1646](https://github.com/nimbus-agent/Nimbus/issues/1646)) ([d0d7a61](https://github.com/nimbus-agent/Nimbus/commit/d0d7a613a8fab4477510d0dc9741b07045cda9de))
## [7.41.0](https://github.com/nimbus-agent/Nimbus/compare/v7.40.0...v7.41.0) (2026-10-10)
### Features
* **telemetry:** measure agent invocation latency p50/p95 ([#1641](https://github.com/nimbus-agent/Nimbus/issues/1641)) ([082311b](https://github.com/nimbus-agent/Nimbus/commit/082311bbeaccc495dcdd920a62d4e8540eba1fac))
* **updater:** refuse apply without an installer, audit apply phases, cache last check ([#1639](https://github.com/nimbus-agent/Nimbus/issues/1639)) ([749656c](https://github.com/nimbus-agent/Nimbus/commit/749656cae8b73485f90778b682b4e6dd36348cc3))
## [7.40.0](https://github.com/nimbus-agent/Nimbus/compare/v7.39.0...v7.40.0) (2026-10-09)
### Features
* **user-mcp:** org-policy lock-off and I11 wrapping for model-offered tools; prove I38 end to end ([#1637](https://github.com/nimbus-agent/Nimbus/issues/1637)) ([0cf3df0](https://github.com/nimbus-agent/Nimbus/commit/0cf3df04ebf9d11e729813394561325b59637a7f))
## [7.39.0](https://github.com/nimbus-agent/Nimbus/compare/v7.38.0...v7.39.0) (2026-10-09)
### Features
* **index:** the lane census is an enforced gate (index lane A3) ([#1635](https://github.com/nimbus-agent/Nimbus/issues/1635)) ([672ef16](https://github.com/nimbus-agent/Nimbus/commit/672ef168bf20305cb00884d22cf756bbd2758263))
## [7.38.0](https://github.com/nimbus-agent/Nimbus/compare/v7.37.1...v7.38.0) (2026-10-09)
### Features
* **index:** canonical ci_run / pr / git_commit metadata contract (index lane A1) ([#1632](https://github.com/nimbus-agent/Nimbus/issues/1632)) ([232b778](https://github.com/nimbus-agent/Nimbus/commit/232b778339848c2689b3ed31f2d1a240f27d75c3))
* **index:** readers answer from the contract and disclose what they cannot (index lane A2) ([#1634](https://github.com/nimbus-agent/Nimbus/issues/1634)) ([3515729](https://github.com/nimbus-agent/Nimbus/commit/351572970cf90b541a1addcc98930aeef0a72c7a))
## [7.37.1](https://github.com/nimbus-agent/Nimbus/compare/v7.37.0...v7.37.1) (2026-10-08)
### Bug Fixes
* **lan:** never drop the tail of a large federation frame ([#1630](https://github.com/nimbus-agent/Nimbus/issues/1630)) ([814f470](https://github.com/nimbus-agent/Nimbus/commit/814f470b84f3057e0798136d30291517c9c9f12a))
## [7.37.0](https://github.com/nimbus-agent/Nimbus/compare/v7.36.1...v7.37.0) (2026-10-08)
### Features
* **user-mcp:** let the model call opted-in user MCP tools for the local owner ([#1628](https://github.com/nimbus-agent/Nimbus/issues/1628)) ([fee3b25](https://github.com/nimbus-agent/Nimbus/commit/fee3b2552287d381ee7ae5085e62430bd76163d5))
* **user-mcp:** run user MCP servers confined, with owner-approved grants ([#1623](https://github.com/nimbus-agent/Nimbus/issues/1623)) ([7797aa1](https://github.com/nimbus-agent/Nimbus/commit/7797aa17b178229afd8f68348ab745b7c96f1bb0))
### Bug Fixes
* prove the installed binary's claims in install-smoke and retract the dark ones from the docs ([#1627](https://github.com/nimbus-agent/Nimbus/issues/1627)) ([d40fbcd](https://github.com/nimbus-agent/Nimbus/commit/d40fbcd9cf23eeed2f7fdcce8572147c2d454332))
* **user-mcp:** per-server dispatch listing, no sync.run egress rows, bounded Windows boot revoke ([#1629](https://github.com/nimbus-agent/Nimbus/issues/1629)) ([e1850af](https://github.com/nimbus-agent/Nimbus/commit/e1850af265e2ac81053fea2b0826ed2091286d32))
## [7.36.1](https://github.com/nimbus-agent/Nimbus/compare/v7.36.0...v7.36.1) (2026-10-07)
### Bug Fixes
* **deps:** override [@modelcontextprotocol](https://github.com/modelcontextprotocol) client/core/server to the patched 2.2 line ([#1624](https://github.com/nimbus-agent/Nimbus/issues/1624)) ([a00d70d](https://github.com/nimbus-agent/Nimbus/commit/a00d70d8cc0bda237379f7a1eddb9babee2c47f7))
## [7.36.0](https://github.com/nimbus-agent/Nimbus/compare/v7.35.1...v7.36.0) (2026-10-05)
### Features
* **doctor:** warn when the on-call push cannot reach ChatOps ([#1618](https://github.com/nimbus-agent/Nimbus/issues/1618)) ([f560d92](https://github.com/nimbus-agent/Nimbus/commit/f560d929382731ad6f2bc98a4d63953fa17f1c32))
### Bug Fixes
* **chatops:** escape every Slack-bound post at the wire ([#1617](https://github.com/nimbus-agent/Nimbus/issues/1617)) ([2e76680](https://github.com/nimbus-agent/Nimbus/commit/2e76680d8e7a15519630b0f3543be0177703817a))
## [7.35.1](https://github.com/nimbus-agent/Nimbus/compare/v7.35.0...v7.35.1) (2026-10-05)
### Bug Fixes
* **cli:** make --format plain's underscore-italic pass linear ([#1608](https://github.com/nimbus-agent/Nimbus/issues/1608)) ([475735e](https://github.com/nimbus-agent/Nimbus/commit/475735ee7c9d54dca0b9d5a605506f420cd20d58))
* **deps:** bump the bundled connectors to 0.2.2 and drop the nodemailer override ([#1606](https://github.com/nimbus-agent/Nimbus/issues/1606)) ([58ad04f](https://github.com/nimbus-agent/Nimbus/commit/58ad04fad78a7c7f3c79f8602b41e7798fc05b62))
* **deps:** bundle connectors 0.2.4, and name the right Workday task in the auth help ([#1614](https://github.com/nimbus-agent/Nimbus/issues/1614)) ([d25fbea](https://github.com/nimbus-agent/Nimbus/commit/d25fbea19f8d3042e68ec17eeacf5d3b96b962a9))
* **gateway:** enforce the connector allowlist at the federated invoke gate, and route ChatOps writes through the write transport ([#1615](https://github.com/nimbus-agent/Nimbus/issues/1615)) ([1c578cb](https://github.com/nimbus-agent/Nimbus/commit/1c578cbbda71f4645726b5348050ccfab2d200bf))
* **gateway:** refuse connector writes and code-executing connector tools at the federated invoke gate (I26) ([#1607](https://github.com/nimbus-agent/Nimbus/issues/1607)) ([eeb5245](https://github.com/nimbus-agent/Nimbus/commit/eeb5245bf3237abb4cf9e70407cddc1e527583ac))
* **gateway:** resolve bare connector tool ids on the caller's own MCP server ([#1610](https://github.com/nimbus-agent/Nimbus/issues/1610)) ([3e41d5b](https://github.com/nimbus-agent/Nimbus/commit/3e41d5b34c216d74e63c83473525718633f93210))
## [7.35.0](https://github.com/nimbus-agent/Nimbus/compare/v7.34.0...v7.35.0) (2026-10-04)
### Features
* **ui:** On-call page for pushed briefs (PR 3 of 3) ([#1604](https://github.com/nimbus-agent/Nimbus/issues/1604)) ([88e161a](https://github.com/nimbus-agent/Nimbus/commit/88e161a279ac8e5e7ab8f54c68f17c4fe8ed0861))
### Bug Fixes
* clear the SonarCloud backlog, reduce duplication and raise test coverage ([#1603](https://github.com/nimbus-agent/Nimbus/issues/1603)) ([4663fbb](https://github.com/nimbus-agent/Nimbus/commit/4663fbb9b4c5139e449e0481b0b2d0dc3f357d6f))
## [7.34.0](https://github.com/nimbus-agent/Nimbus/compare/v7.33.0...v7.34.0) (2026-10-04)
### Features
* **oncall:** post the pushed brief's headline to ChatOps (PR 2 of 3) ([#1600](https://github.com/nimbus-agent/Nimbus/issues/1600)) ([84a335e](https://github.com/nimbus-agent/Nimbus/commit/84a335ecc6045b8fac0278113d599f103a514a85))
## [7.33.0](https://github.com/nimbus-agent/Nimbus/compare/v7.32.2...v7.33.0) (2026-10-02)
### Features
* **oncall:** push the on-call brief when a P1 is assigned to you ([#1592](https://github.com/nimbus-agent/Nimbus/issues/1592)) ([7a4feb5](https://github.com/nimbus-agent/Nimbus/commit/7a4feb5e79947b4e9a1b381bc84f7aa7409a282d))
### Bug Fixes
* **deps:** bump the devalue override to 5.9.4 for three new high advisories ([#1593](https://github.com/nimbus-agent/Nimbus/issues/1593)) ([693f62b](https://github.com/nimbus-agent/Nimbus/commit/693f62ba1885418b3dfd57db9e619810c53f509a))
## [7.32.2](https://github.com/nimbus-agent/Nimbus/compare/v7.32.1...v7.32.2) (2026-09-30)
### Bug Fixes
* **deps:** override past new brace-expansion and fast-uri advisories ([#1586](https://github.com/nimbus-agent/Nimbus/issues/1586)) ([19327c5](https://github.com/nimbus-agent/Nimbus/commit/19327c5298a86c28d35363ee637a0263d7036f17))
## [7.32.1](https://github.com/nimbus-agent/Nimbus/compare/v7.32.0...v7.32.1) (2026-09-30)
### Bug Fixes
* **deps:** override past five new moderate advisories (ip-address, nodemailer, undici, markdown-it) ([#1577](https://github.com/nimbus-agent/Nimbus/issues/1577)) ([beec826](https://github.com/nimbus-agent/Nimbus/commit/beec82653ff9b0be85c073112b35b58a01754436))
## [7.32.0](https://github.com/nimbus-agent/Nimbus/compare/v7.31.0...v7.32.0) (2026-09-23)
### Features
* **cli:** nimbus init and nimbus demo end on the guided tour ([#1570](https://github.com/nimbus-agent/Nimbus/issues/1570)) ([fc8ce7c](https://github.com/nimbus-agent/Nimbus/commit/fc8ce7ce07de2ff8219d9647d922ae4576837a67))
## [7.31.0](https://github.com/nimbus-agent/Nimbus/compare/v7.30.0...v7.31.0) (2026-09-21)
### Features
* **cli:** nimbus wow — a guided tour of your own index, ending on a locality proof ([#1565](https://github.com/nimbus-agent/Nimbus/issues/1565)) ([8c78849](https://github.com/nimbus-agent/Nimbus/commit/8c788493e72711cebc38ec9f42726fb2c758bbcc))
## [7.30.0](https://github.com/nimbus-agent/Nimbus/compare/v7.29.0...v7.30.0) (2026-09-21)
### Features
* **audit:** index lane census (report-only) ([#1561](https://github.com/nimbus-agent/Nimbus/issues/1561)) ([863f621](https://github.com/nimbus-agent/Nimbus/commit/863f621f23cfecd36d68462595478f9dbb40a249))
## [7.29.0](https://github.com/nimbus-agent/Nimbus/compare/v7.28.0...v7.29.0) (2026-09-20)
### Features
* **connectors:** gcloud login mode for the GCP connectors, detected and adopted ([#1557](https://github.com/nimbus-agent/Nimbus/issues/1557)) ([d01e198](https://github.com/nimbus-agent/Nimbus/commit/d01e198c3af72a188621ad407911a367ceb13c79))
## [7.28.0](https://github.com/nimbus-agent/Nimbus/compare/v7.27.1...v7.28.0) (2026-09-20)
### Features
* **connectors:** nimbus connector detect — reuse existing gh, aws and kubectl logins ([#1554](https://github.com/nimbus-agent/Nimbus/issues/1554)) ([44a57ad](https://github.com/nimbus-agent/Nimbus/commit/44a57ad2ebc442bcaee6c5cd69736a136de14d4f))
### Bug Fixes
* **connectors:** gcloud spawns authenticate as the configured GCP service-account key ([#1553](https://github.com/nimbus-agent/Nimbus/issues/1553)) ([e1d16b1](https://github.com/nimbus-agent/Nimbus/commit/e1d16b119a40364bd436773966672434de283077))
## [7.27.1](https://github.com/nimbus-agent/Nimbus/compare/v7.27.0...v7.27.1) (2026-09-19)
### Bug Fixes
* **cli:** nimbus start waits for the gateway state file, not only the socket ([#1549](https://github.com/nimbus-agent/Nimbus/issues/1549)) ([4267055](https://github.com/nimbus-agent/Nimbus/commit/4267055986ab9e6e12bc85543a8e0e9fa0f4f838))
## [7.27.0](https://github.com/nimbus-agent/Nimbus/compare/v7.26.0...v7.27.0) (2026-09-19)
### Features
* **cli:** nimbus demo — a seeded synthetic org and a three-brief tour ([#1547](https://github.com/nimbus-agent/Nimbus/issues/1547)) ([b238a13](https://github.com/nimbus-agent/Nimbus/commit/b238a1386312746994a8a3ab4e668464c5dd1e5d))
* isolated demo root for nimbus --demo (invariant I41) ([#1545](https://github.com/nimbus-agent/Nimbus/issues/1545)) ([8791c19](https://github.com/nimbus-agent/Nimbus/commit/8791c1990e85f27364e0c8110da43709fba9b07f))
## [7.26.0](https://github.com/nimbus-agent/Nimbus/compare/v7.25.0...v7.26.0) (2026-09-18)
### Features
* **fleet:** subject enumeration — sweep a corpus instead of naming one subject ([#1541](https://github.com/nimbus-agent/Nimbus/issues/1541)) ([c1bab10](https://github.com/nimbus-agent/Nimbus/commit/c1bab1081af5eb45d13eb0f21a6ee6d441745cc9))
### Bug Fixes
* **connectors:** let Jira, Confluence, GitLab, dbt and the Teams bot reach their configured host from the sandbox ([#1536](https://github.com/nimbus-agent/Nimbus/issues/1536)) ([d4465f9](https://github.com/nimbus-agent/Nimbus/commit/d4465f9c3c784532a056cfef0bc63433d2936af2))
* **connectors:** make connector auth refuse vault-key services with the exact vault set commands ([#1537](https://github.com/nimbus-agent/Nimbus/issues/1537)) ([02011df](https://github.com/nimbus-agent/Nimbus/commit/02011dfa35ceaee8231863de7d43ffb405beb0ef))
* **embedding:** cancel timed-out query embedding work, not just abandon it ([#1542](https://github.com/nimbus-agent/Nimbus/issues/1542)) ([35b0aa8](https://github.com/nimbus-agent/Nimbus/commit/35b0aa86cf38bdb5fdf74dc3b506f4a8b7f8cf52))
* **embedding:** report the backfill pass from the hybrid and openai runtimes ([#1538](https://github.com/nimbus-agent/Nimbus/issues/1538)) ([5d31dab](https://github.com/nimbus-agent/Nimbus/commit/5d31dabfbfda1cd7e0f576c98ca36a4e032d78bc))
## [7.25.0](https://github.com/nimbus-agent/Nimbus/compare/v7.24.0...v7.25.0) (2026-09-17)
### Features
* **search:** disclose keyword-only and mid-backfill results; typed embedding query timeout ([#1535](https://github.com/nimbus-agent/Nimbus/issues/1535)) ([c6c7e27](https://github.com/nimbus-agent/Nimbus/commit/c6c7e27b75901cbfa19f7b03b4514d6fb63d831c))
### Bug Fixes
* **media:** show real sizes in the allow-remote consent preview ([#1534](https://github.com/nimbus-agent/Nimbus/issues/1534)) ([c6f927e](https://github.com/nimbus-agent/Nimbus/commit/c6f927ec0d5f88dc6d54d4f81482765236a324be))
* **sandbox:** stop the Windows helper leaking an ACE per run; tool run follow-ups ([#1524](https://github.com/nimbus-agent/Nimbus/issues/1524)) ([52fb7cf](https://github.com/nimbus-agent/Nimbus/commit/52fb7cfea808893955c6267caf08a5cb18aae943))
## [7.24.0](https://github.com/nimbus-agent/Nimbus/compare/v7.23.0...v7.24.0) (2026-09-16)
### Features
* **cli:** add nimbus tool run to invoke a saved generated tool ([#1521](https://github.com/nimbus-agent/Nimbus/issues/1521)) ([a89bd27](https://github.com/nimbus-agent/Nimbus/commit/a89bd2762c274d06ccf20d766eb300ebe0e871ed))
## [7.23.0](https://github.com/nimbus-agent/Nimbus/compare/v7.22.0...v7.23.0) (2026-09-15)
### Features
* **cli:** nimbus explain last — an X-ray of the most recent nimbus ask ([#1514](https://github.com/nimbus-agent/Nimbus/issues/1514)) ([755c2b6](https://github.com/nimbus-agent/Nimbus/commit/755c2b6019479a1313ada85ab4d3db6726c4add4))
* **cli:** nimbus tail — follow the gateway's operational event stream ([#1511](https://github.com/nimbus-agent/Nimbus/issues/1511)) ([9f70962](https://github.com/nimbus-agent/Nimbus/commit/9f70962084caa57c3eba05d99be40f99dd58187b))
## [7.22.0](https://github.com/nimbus-agent/Nimbus/compare/v7.21.1...v7.22.0) (2026-09-13)
### Features
* **agents:** nimbus oncall — the seventeenth built-in agent ([#1509](https://github.com/nimbus-agent/Nimbus/issues/1509)) ([27c4211](https://github.com/nimbus-agent/Nimbus/commit/27c42111e1c44911c56f62b3c558d8808e0ccedb))
## [7.21.1](https://github.com/nimbus-agent/Nimbus/compare/v7.21.0...v7.21.1) (2026-09-13)
### Bug Fixes
* **platform:** bundle a full SQLite with the macOS build so semantic search works without Homebrew ([#1507](https://github.com/nimbus-agent/Nimbus/issues/1507)) ([a3703cc](https://github.com/nimbus-agent/Nimbus/commit/a3703cc0b63bf7b9de4efce67bae91a2e71831a2))
## [7.21.0](https://github.com/nimbus-agent/Nimbus/compare/v7.20.1...v7.21.0) (2026-09-12)
### Features
* **agents:** nimbus standup — the sixteenth built-in agent ([#1502](https://github.com/nimbus-agent/Nimbus/issues/1502)) ([3101702](https://github.com/nimbus-agent/Nimbus/commit/310170239b4a9ed4be1cb9092223dc1d64cc3cd7))
### Bug Fixes
* **platform:** load a full SQLite on macOS so sqlite-vec can load ([#1503](https://github.com/nimbus-agent/Nimbus/issues/1503)) ([107bf08](https://github.com/nimbus-agent/Nimbus/commit/107bf084021bfc7dbd08fae0e42d3d2690f5b7ed))
## [7.20.1](https://github.com/nimbus-agent/Nimbus/compare/v7.20.0...v7.20.1) (2026-09-12)
### Bug Fixes
* **search:** stop the vector KNN re-running once per chunk row ([#1500](https://github.com/nimbus-agent/Nimbus/issues/1500)) ([1ac89f6](https://github.com/nimbus-agent/Nimbus/commit/1ac89f6808c5ed51f39fb8ea5d9ca8c42d3afc62))
## [7.20.0](https://github.com/nimbus-agent/Nimbus/compare/v7.19.1...v7.20.0) (2026-09-11)
### Features
* **agents:** nimbus changelog — the fifteenth built-in agent ([#1496](https://github.com/nimbus-agent/Nimbus/issues/1496)) ([bc1139b](https://github.com/nimbus-agent/Nimbus/commit/bc1139b813040248de0a594de07a04a62a57bb61))
## [7.19.1](https://github.com/nimbus-agent/Nimbus/compare/v7.19.0...v7.19.1) (2026-09-11)
### Bug Fixes
* **metrics:** stop requiring a resolved status to attribute a change failure ([#1494](https://github.com/nimbus-agent/Nimbus/issues/1494)) ([011cbf7](https://github.com/nimbus-agent/Nimbus/commit/011cbf74a03164e4eb4b3b21a67661d33c557b91))
* **quality:** clear the SonarCloud board, prune the delivered plans and specs, and fix what that exposed ([#1497](https://github.com/nimbus-agent/Nimbus/issues/1497)) ([63bbdd9](https://github.com/nimbus-agent/Nimbus/commit/63bbdd920343b92f48952b71f6197f2de0a4bf94))
## [7.19.0](https://github.com/nimbus-agent/Nimbus/compare/v7.18.0...v7.19.0) (2026-09-11)
### Features
* **http:** GET /v1/metrics/stats — the bucketed DORA series, plus the change-failure-rate attribution fix ([#1493](https://github.com/nimbus-agent/Nimbus/issues/1493)) ([f6e852a](https://github.com/nimbus-agent/Nimbus/commit/f6e852a13fb81450a6952ce4817acffb1b3dcfbf))
* **http:** GET /v1/services/resolve — repo-URN-to-service resolution ([#1491](https://github.com/nimbus-agent/Nimbus/issues/1491)) ([7da3b84](https://github.com/nimbus-agent/Nimbus/commit/7da3b84dda806f712d1ca7753dc28da580a5eb67))
## [7.18.0](https://github.com/nimbus-agent/Nimbus/compare/v7.17.0...v7.18.0) (2026-09-11)
### Features
* **toolgen:** runtime tool generation PR 3 of 3 — persistence + signing ([#1487](https://github.com/nimbus-agent/Nimbus/issues/1487)) ([52644ce](https://github.com/nimbus-agent/Nimbus/commit/52644cef588e44f3d82621a4589ca682787bafba))
## [7.17.0](https://github.com/nimbus-agent/Nimbus/compare/v7.16.0...v7.17.0) (2026-09-10)
### Features
* **cli:** nimbus index health — index quality, not index size ([#1483](https://github.com/nimbus-agent/Nimbus/issues/1483)) ([93ac016](https://github.com/nimbus-agent/Nimbus/commit/93ac016d5a564f633732c4ba8f2eb6beb4bdb049))
## [7.16.0](https://github.com/nimbus-agent/Nimbus/compare/v7.15.1...v7.16.0) (2026-09-10)
### Features
* **toolgen:** draft a tool body and its input schema, and bind credentials at create time ([#1481](https://github.com/nimbus-agent/Nimbus/issues/1481)) ([ecd1a04](https://github.com/nimbus-agent/Nimbus/commit/ecd1a04f8c8f47032992b2475cd67334f8afe0dd))
## [7.15.1](https://github.com/nimbus-agent/Nimbus/compare/v7.15.0...v7.15.1) (2026-09-10)
### Bug Fixes
* close three documented gaps in completed phases (I16 reasons, connector.startAuth, redaction fixtures) ([#1480](https://github.com/nimbus-agent/Nimbus/issues/1480)) ([da5d239](https://github.com/nimbus-agent/Nimbus/commit/da5d2399eae49412d82d4f2be94be1b2c50c7d25))
## [7.15.0](https://github.com/nimbus-agent/Nimbus/compare/v7.14.0...v7.15.0) (2026-09-09)
### Features
* **toolgen:** runtime tool generation PR 1 of 3 — the sandboxed substrate ([#1475](https://github.com/nimbus-agent/Nimbus/issues/1475)) ([4719bfb](https://github.com/nimbus-agent/Nimbus/commit/4719bfb1aaa1febd3ed0b68c180398714f121eea))
## [7.14.0](https://github.com/nimbus-agent/Nimbus/compare/v7.13.0...v7.14.0) (2026-09-08)
### Features
* **fleet:** add the overnight-fleet change digest (PR 2a) ([#1467](https://github.com/nimbus-agent/Nimbus/issues/1467)) ([4c54be8](https://github.com/nimbus-agent/Nimbus/commit/4c54be81e5363246037c5ccdd1928ff706611776))
### Bug Fixes
* **deps:** unbreak main — move the override pins [#1469](https://github.com/nimbus-agent/Nimbus/issues/1469) outgrew, and restore the docs build ([#1474](https://github.com/nimbus-agent/Nimbus/issues/1474)) ([2cc6fcf](https://github.com/nimbus-agent/Nimbus/commit/2cc6fcf0870629919ee83110681a44503f2a674d))
## [7.13.0](https://github.com/nimbus-agent/Nimbus/compare/v7.12.0...v7.13.0) (2026-09-07)
### Features
* **http:** GET /v1/items/resolve-ids — an item id back to its reference ([#1465](https://github.com/nimbus-agent/Nimbus/issues/1465)) ([8531752](https://github.com/nimbus-agent/Nimbus/commit/8531752330d23551738d815e9f6e2d6d72e75f77))
## [7.12.0](https://github.com/nimbus-agent/Nimbus/compare/v7.11.0...v7.12.0) (2026-09-07)
### Features
* **fleet:** overnight sub-agent fleets on local compute — S2 PR 1 of 2 ([#1458](https://github.com/nimbus-agent/Nimbus/issues/1458)) ([d47d52e](https://github.com/nimbus-agent/Nimbus/commit/d47d52e220b56293e94628c091bac662404eb816))
### Bug Fixes
* **fleet:** close the five follow-ups from the overnight-fleet merge ([#1462](https://github.com/nimbus-agent/Nimbus/issues/1462)) ([bf0559b](https://github.com/nimbus-agent/Nimbus/commit/bf0559b56c52ab79c9c48e94fd1d2ce1e649aa67))
## [7.11.0](https://github.com/nimbus-agent/Nimbus/compare/v7.10.1...v7.11.0) (2026-09-06)
### Features
* **multimodal:** remote vision arm with per-artifact grants, I37 and D27 — S2 PR 4 of 4 ([#1454](https://github.com/nimbus-agent/Nimbus/issues/1454)) ([580e893](https://github.com/nimbus-agent/Nimbus/commit/580e8930c7575a760cb838ce3fec4babddb0ae3a))
### Performance Improvements
* **filesystem:** index only what changed since the last sync tick ([#1453](https://github.com/nimbus-agent/Nimbus/issues/1453)) ([ec284d1](https://github.com/nimbus-agent/Nimbus/commit/ec284d13fbf66f4c0b5680768441f253e4c9daf0))
## [7.10.1](https://github.com/nimbus-agent/Nimbus/compare/v7.10.0...v7.10.1) (2026-09-05)
### Bug Fixes
* **gateway:** stop console windows flashing on every Windows sync ([#1451](https://github.com/nimbus-agent/Nimbus/issues/1451)) ([2042740](https://github.com/nimbus-agent/Nimbus/commit/2042740e9aac2b8cbf87e9ab04e801a3f51e5df2))
## [7.10.0](https://github.com/nimbus-agent/Nimbus/compare/v7.9.0...v7.10.0) (2026-09-05)
### Features
* **http:** resolve a forge file coordinate to a path in the reader's checkout ([#1447](https://github.com/nimbus-agent/Nimbus/issues/1447)) ([b472f67](https://github.com/nimbus-agent/Nimbus/commit/b472f67988de1f7ef16577e47da57f7c42f7e7db))
* **multimodal:** cloud byte-fetch for Photos, Drive and OneDrive (S2 PR 3 of 4) ([#1448](https://github.com/nimbus-agent/Nimbus/issues/1448)) ([3f7e7b6](https://github.com/nimbus-agent/Nimbus/commit/3f7e7b62668387cf61b40ff0a3ddcc6bf6cf69e9))
## [7.9.0](https://github.com/nimbus-agent/Nimbus/compare/v7.8.2...v7.9.0) (2026-09-04)
### Features
* **multimodal:** image understanding and sampled frame captions (S2 PR 2 of 4) ([#1438](https://github.com/nimbus-agent/Nimbus/issues/1438)) ([a24300a](https://github.com/nimbus-agent/Nimbus/commit/a24300a76e03d90a1cbe44833330a3b2a22dee35))
### Bug Fixes
* **ci:** retry a status-less transport failure in the dependency audit ([#1441](https://github.com/nimbus-agent/Nimbus/issues/1441)) ([4b1948b](https://github.com/nimbus-agent/Nimbus/commit/4b1948b79b57a7b66865dea4f7134306d0efbce9))
* **ci:** the sdk release-train tagPattern never matched a real tag, and that only warned ([#1445](https://github.com/nimbus-agent/Nimbus/issues/1445)) ([19a371c](https://github.com/nimbus-agent/Nimbus/commit/19a371c3d9e6251a208e2c20655204b44d59e6cc))
* **llm:** a provider named __proto__ vanished from the availability map ([#1442](https://github.com/nimbus-agent/Nimbus/issues/1442)) ([c16855a](https://github.com/nimbus-agent/Nimbus/commit/c16855a7d09ba90cb129173852bfa281092ba114))
## [7.8.2](https://github.com/nimbus-agent/Nimbus/compare/v7.8.1...v7.8.2) (2026-09-04)
### Bug Fixes
* **quality:** fix all 29 open Sonar findings in code, cut duplication 420 to 400 clones, and correct five stale doc facts ([#1439](https://github.com/nimbus-agent/Nimbus/issues/1439)) ([62a6a20](https://github.com/nimbus-agent/Nimbus/commit/62a6a20286e3d9a55d9507b4b25e8f36b13f8f8b))
## [7.8.1](https://github.com/nimbus-agent/Nimbus/compare/v7.8.0...v7.8.1) (2026-09-03)
### Bug Fixes
* **sonar:** clear 23 findings, and document five that should not be applied ([#1434](https://github.com/nimbus-agent/Nimbus/issues/1434)) ([64d50af](https://github.com/nimbus-agent/Nimbus/commit/64d50af67ddf196c742da5492e6005a7b745b9e0))
* **sonar:** raw path literals, media flag validators, and the two findings the last pass added ([#1437](https://github.com/nimbus-agent/Nimbus/issues/1437)) ([6fe5240](https://github.com/nimbus-agent/Nimbus/commit/6fe52402b34a2be90dc86a6ab1dd0407246dca6e))
* **sonar:** specific matchers and named decisions, minus two arity assertions ([#1436](https://github.com/nimbus-agent/Nimbus/issues/1436)) ([d1900c6](https://github.com/nimbus-agent/Nimbus/commit/d1900c6e5a679cf520053f33fd02e7fbbad280b4))
## [7.8.0](https://github.com/nimbus-agent/Nimbus/compare/v7.7.0...v7.8.0) (2026-09-03)
### Features
* **multimodal:** local audio/video understanding, indexed and searchable (S2 PR 1 of 4) ([#1429](https://github.com/nimbus-agent/Nimbus/issues/1429)) ([b995a96](https://github.com/nimbus-agent/Nimbus/commit/b995a96b2c135fa19614123df49c82033254065e))
## [7.7.0](https://github.com/nimbus-agent/Nimbus/compare/v7.6.0...v7.7.0) (2026-09-03)
### Features
* **agents:** publish the gateway version on the roster response ([#1428](https://github.com/nimbus-agent/Nimbus/issues/1428)) ([d3ba71d](https://github.com/nimbus-agent/Nimbus/commit/d3ba71dd3d3513e828da301bd59472fdb2dfc456))
## [7.6.0](https://github.com/nimbus-agent/Nimbus/compare/v7.5.0...v7.6.0) (2026-09-02)
### Features
* **agents:** resolve a forge file coordinate to the reader's checkout ([#1424](https://github.com/nimbus-agent/Nimbus/issues/1424)) ([4770bdf](https://github.com/nimbus-agent/Nimbus/commit/4770bdffbcff9b7962f209e890d3b96f324dbb9b))
* **computer-use:** the terminal lane — a confined shell where nothing runs before the owner approves the whole line ([#1426](https://github.com/nimbus-agent/Nimbus/issues/1426)) ([9ad2be9](https://github.com/nimbus-agent/Nimbus/commit/9ad2be9c1d398c1eb1636115ae495e2869775d00))
## [7.5.0](https://github.com/nimbus-agent/Nimbus/compare/v7.4.0...v7.5.0) (2026-09-01)
### Features
* **agents:** why, expert and ownership answer about an indexed item ([#1421](https://github.com/nimbus-agent/Nimbus/issues/1421)) ([b5fabb2](https://github.com/nimbus-agent/Nimbus/commit/b5fabb2d176f67b8286b8cdf237231ce565d9f49))
* **computer-use:** raw-CDP browser lane driver; the browser egress class goes live ([#1418](https://github.com/nimbus-agent/Nimbus/issues/1418)) ([0c52e96](https://github.com/nimbus-agent/Nimbus/commit/0c52e9661282299c9927f0689c6a49bbeb0c56f6))
## [7.4.0](https://github.com/nimbus-agent/Nimbus/compare/v7.3.0...v7.4.0) (2026-08-31)
### Features
* **computer-use:** I35 gate + D26 confinement for local computer-use actuation (browser lane, driver not yet wired) ([#1415](https://github.com/nimbus-agent/Nimbus/issues/1415)) ([461cebd](https://github.com/nimbus-agent/Nimbus/commit/461cebd634a96762b49270ba2dbb4b1d31d8aa9a))
## [7.3.0](https://github.com/nimbus-agent/Nimbus/compare/v7.2.1...v7.3.0) (2026-08-30)
### Features
* **chatops:** invoke the built-in read-only agents from a Slack or Teams channel ([#1412](https://github.com/nimbus-agent/Nimbus/issues/1412)) ([a6a052e](https://github.com/nimbus-agent/Nimbus/commit/a6a052e2d019eb077a0b90d3a352c0d5d58cf590))
## [7.2.1](https://github.com/nimbus-agent/Nimbus/compare/v7.2.0...v7.2.1) (2026-08-30)
### Bug Fixes
* **llm:** make llm.setDefault write the store the router actually reads ([#1410](https://github.com/nimbus-agent/Nimbus/issues/1410)) ([9f69790](https://github.com/nimbus-agent/Nimbus/commit/9f69790ca0e29795997e614732539dce5792bfae))
## [7.2.0](https://github.com/nimbus-agent/Nimbus/compare/v7.1.2...v7.2.0) (2026-08-30)
### Features
* **doctor:** report embedding runtime state ([#1397](https://github.com/nimbus-agent/Nimbus/issues/1397)) ([9b3ed09](https://github.com/nimbus-agent/Nimbus/commit/9b3ed09d5e2f5677d812715234d8821b5de9eda2))
* **egress:** ledger every outbound ChatOps post ([#1403](https://github.com/nimbus-agent/Nimbus/issues/1403)) ([fcef76f](https://github.com/nimbus-agent/Nimbus/commit/fcef76f46e0e6a07f6028e91fb3ba2e6d6c1953e))
### Bug Fixes
* **embedding:** embed the onnx addon so the compiled binary can load it ([#1402](https://github.com/nimbus-agent/Nimbus/issues/1402)) ([7ca8379](https://github.com/nimbus-agent/Nimbus/commit/7ca83798c1c2d40e91ab6839e5c94cf54646a88d))
* **embedding:** embed the onnxruntime runtime library, not just the addon ([#1405](https://github.com/nimbus-agent/Nimbus/issues/1405)) ([7d38e79](https://github.com/nimbus-agent/Nimbus/commit/7d38e79f5bdcf68b9a58763cc7267ab34f1843b5))
* **embedding:** ship the onnx binding and stub sharp so the worker can start ([#1399](https://github.com/nimbus-agent/Nimbus/issues/1399)) ([2356e6a](https://github.com/nimbus-agent/Nimbus/commit/2356e6a7e4d25aab4baf954ce8a2e1d17df604f6))
## [7.1.2](https://github.com/nimbus-agent/Nimbus/compare/v7.1.1...v7.1.2) (2026-08-29)
### Bug Fixes
* **index:** extract `export default` symbols in the code indexer ([#1391](https://github.com/nimbus-agent/Nimbus/issues/1391)) ([78751d2](https://github.com/nimbus-agent/Nimbus/commit/78751d2f54ab9898f7e1a0fc77ec3df226003357))
* **logging:** stop logging every Error as {} ([#1393](https://github.com/nimbus-agent/Nimbus/issues/1393)) ([7734ab1](https://github.com/nimbus-agent/Nimbus/commit/7734ab10b68ea5c221b56cfc8ccfabe555ef80ca))
## [7.1.1](https://github.com/nimbus-agent/Nimbus/compare/v7.1.0...v7.1.1) (2026-08-29)
### Bug Fixes
* **cli:** refuse a nested-table key in nimbus config set/get ([#1387](https://github.com/nimbus-agent/Nimbus/issues/1387)) ([1a4338c](https://github.com/nimbus-agent/Nimbus/commit/1a4338c32582ae578dacc3babb34671b07b155f9))
## [7.1.0](https://github.com/nimbus-agent/Nimbus/compare/v7.0.1...v7.1.0) (2026-08-29)
### Features
* **egress:** ledger remote embeddings and add per-task model routing ([#1384](https://github.com/nimbus-agent/Nimbus/issues/1384)) ([33273b2](https://github.com/nimbus-agent/Nimbus/commit/33273b27aa387d0fb8232847757b95d198efe602))
## [7.0.1](https://github.com/nimbus-agent/Nimbus/compare/v7.0.0...v7.0.1) (2026-08-29)
### Bug Fixes
* **connectors:** align the aws sync interval with its AWS-CLI siblings ([#1377](https://github.com/nimbus-agent/Nimbus/issues/1377)) ([61173ae](https://github.com/nimbus-agent/Nimbus/commit/61173ae92dc87002d3bc844ce0c792257292d677))
* **llm:** stop Ollama reasoning tokens truncating answers and costing ~16s per ask ([#1376](https://github.com/nimbus-agent/Nimbus/issues/1376)) ([abdbbdc](https://github.com/nimbus-agent/Nimbus/commit/abdbbdcf41ba91243f3d76e1b5ad301e01aba3a8))
## [7.0.0](https://github.com/nimbus-agent/Nimbus/compare/v6.0.1...v7.0.0) (2026-08-29)
### ⚠ BREAKING CHANGES
* **llm:** make LlmRegistryOptions.db required so an unledgered non-local route is a compile error ([#1372](https://github.com/nimbus-agent/Nimbus/issues/1372))
### Bug Fixes
* **perf:** drift-check must use each surface own noise floor, not a hardcoded 10% ([#1374](https://github.com/nimbus-agent/Nimbus/issues/1374)) ([8607743](https://github.com/nimbus-agent/Nimbus/commit/860774328ca64b358c1259b3ab29178f9b63375b))
### Code Refactoring
* **llm:** make LlmRegistryOptions.db required so an unledgered non-local route is a compile error ([#1372](https://github.com/nimbus-agent/Nimbus/issues/1372)) ([97ce904](https://github.com/nimbus-agent/Nimbus/commit/97ce9043cb6c08e9e7c5c06a3db5bf71f0bda1c0))
## [6.0.1](https://github.com/nimbus-agent/Nimbus/compare/v6.0.0...v6.0.1) (2026-08-28)
### Bug Fixes
* **connectors:** stop connector CLI spawns flashing console windows on Windows ([#1370](https://github.com/nimbus-agent/Nimbus/issues/1370)) ([184dc42](https://github.com/nimbus-agent/Nimbus/commit/184dc42aed22b4156d1f8367f69e60118ebcffab))
## [6.0.0](https://github.com/nimbus-agent/Nimbus/compare/v5.0.1...v6.0.0) (2026-08-28)
### ⚠ BREAKING CHANGES
* **llm:** remove the inert remote_model key and document the vendor tables ([#1368](https://github.com/nimbus-agent/Nimbus/issues/1368))
* **llm:** ledger the ask intent classifier, and three defects found on a live install ([#1366](https://github.com/nimbus-agent/Nimbus/issues/1366))
### Bug Fixes
* **llm:** ledger the ask intent classifier, and three defects found on a live install ([#1366](https://github.com/nimbus-agent/Nimbus/issues/1366)) ([8202ec6](https://github.com/nimbus-agent/Nimbus/commit/8202ec64199c524ff436f3d4d04822e9c9a8620c))
* **llm:** remove the inert remote_model key and document the vendor tables ([#1368](https://github.com/nimbus-agent/Nimbus/issues/1368)) ([0ca8232](https://github.com/nimbus-agent/Nimbus/commit/0ca82323f26dbd10dc59efa28eab3c43ba9c593e))
## [5.0.1](https://github.com/nimbus-agent/Nimbus/compare/v5.0.0...v5.0.1) (2026-08-28)
### Bug Fixes
* **connectors:** index a Confluence page under its browser URL ([#1364](https://github.com/nimbus-agent/Nimbus/issues/1364)) ([c7a9e1a](https://github.com/nimbus-agent/Nimbus/commit/c7a9e1a53fcc5fc22e2830e38ad25009b7e5d6e5))
## [5.0.0](https://github.com/nimbus-agent/Nimbus/compare/v4.1.0...v5.0.0) (2026-08-28)
### ⚠ BREAKING CHANGES
* **llm:** the Mastra engine agent no longer falls back to a vendor API key found in the environment. An install that today relies on `ANTHROPIC_API_KEY` alone, with no `[llm.remote.*]` configuration, will stop constructing the agent — `nimbus ask` then answers from the local router if one is configured, and workflows refuse with a message naming the fix. To restore the previous behaviour, add `[llm.remote.anthropic] enabled = true` with a `model`, and store `anthropic.api_key` in the Vault. This is the point of the change rather than a side effect: a capability that turns itself on because a credential happens to exist is the air-gap defect's shape, one level up.
### Features
* **llm:** register four cloud vendors behind a default-off per-vendor opt-in ([#1359](https://github.com/nimbus-agent/Nimbus/issues/1359)) ([1a59735](https://github.com/nimbus-agent/Nimbus/commit/1a59735f7ee5cf3fcfe2866d804e149b3bbc3c73))
## [4.1.0](https://github.com/nimbus-agent/Nimbus/compare/v4.0.1...v4.1.0) (2026-08-28)
### Features
* **egress:** ledger every non-local LLM route at the provider chokepoint ([#1357](https://github.com/nimbus-agent/Nimbus/issues/1357)) ([278e6b2](https://github.com/nimbus-agent/Nimbus/commit/278e6b2412d80d4cd7aa064e250a9a2f406b129a))
## [4.0.1](https://github.com/nimbus-agent/Nimbus/compare/v4.0.0...v4.0.1) (2026-08-28)
### Bug Fixes
* resolve the brief timeout from one definition, and make the ask context budget configurable ([#1354](https://github.com/nimbus-agent/Nimbus/issues/1354)) ([30c1ce6](https://github.com/nimbus-agent/Nimbus/commit/30c1ce61afedf459651a25dc1fb88cc32b1152f4))
## [4.0.0](https://github.com/nimbus-agent/Nimbus/compare/v3.1.0...v4.0.0) (2026-08-27)
### ⚠ BREAKING CHANGES
* **llm:** route the LLM by (provider, model) instead of provider kind ([#1352](https://github.com/nimbus-agent/Nimbus/issues/1352))
### Features
* **llm:** route the LLM by (provider, model) instead of provider kind ([#1352](https://github.com/nimbus-agent/Nimbus/issues/1352)) ([5ac042c](https://github.com/nimbus-agent/Nimbus/commit/5ac042c04fda879fdfd943eaacb99a09ae022cae))
## [3.1.0](https://github.com/nimbus-agent/Nimbus/compare/v3.0.0...v3.1.0) (2026-08-27)
### Features
* **ci:** gate on native dependencies reaching the gateway binary ([#1350](https://github.com/nimbus-agent/Nimbus/issues/1350)) ([b3ff071](https://github.com/nimbus-agent/Nimbus/commit/b3ff071c02caef844c0b8bf243e5c7b0fd4ea71b))
## [3.0.0](https://github.com/nimbus-agent/Nimbus/compare/v2.21.0...v3.0.0) (2026-08-27)
### ⚠ BREAKING CHANGES
* **connectors:** delete packages/mcp-connectors — it ships from npm now ([#1347](https://github.com/nimbus-agent/Nimbus/issues/1347))
### Features
* **ci:** gate on connector version skew between the gateway and npm ([#1346](https://github.com/nimbus-agent/Nimbus/issues/1346)) ([1a2d38a](https://github.com/nimbus-agent/Nimbus/commit/1a2d38a42ab16d3d83a4a4d016944d2a74bc39d7))
### Code Refactoring
* **connectors:** delete packages/mcp-connectors — it ships from npm now ([#1347](https://github.com/nimbus-agent/Nimbus/issues/1347)) ([2118cdd](https://github.com/nimbus-agent/Nimbus/commit/2118cdd4ba4954d9617485973b753f47fcbed03c))
## [2.21.0](https://github.com/nimbus-agent/Nimbus/compare/v2.20.0...v2.21.0) (2026-08-26)
### Features
* **connectors:** consume @nimbus-dev/connectors from npm ([#1343](https://github.com/nimbus-agent/Nimbus/issues/1343)) ([0b6ff53](https://github.com/nimbus-agent/Nimbus/commit/0b6ff53aac924d3f4251c74785d58fead450f9b8))
## [2.20.0](https://github.com/nimbus-agent/Nimbus/compare/v2.19.1...v2.20.0) (2026-08-25)
### Features
* **build:** prove the connector registry can import from a package, before anything moves ([#1340](https://github.com/nimbus-agent/Nimbus/issues/1340)) ([3a1e813](https://github.com/nimbus-agent/Nimbus/commit/3a1e8138746f2f2b22ef49169ca920579d5a42b9))
## [2.19.1](https://github.com/nimbus-agent/Nimbus/compare/v2.19.0...v2.19.1) (2026-08-25)
### Bug Fixes
* **jenkins:** build headers with Headers so a hostile crumb cannot reach a prototype ([#1336](https://github.com/nimbus-agent/Nimbus/issues/1336)) ([8edb94f](https://github.com/nimbus-agent/Nimbus/commit/8edb94f6d178cd7479ffc4ec71e59e6fbe5a4d6a))
## [2.19.0](https://github.com/nimbus-agent/Nimbus/compare/v2.18.1...v2.19.0) (2026-08-25)
### Features
* **sync:** connectors reach credentials and the index only through scoped capabilities ([#1333](https://github.com/nimbus-agent/Nimbus/issues/1333)) ([23233d5](https://github.com/nimbus-agent/Nimbus/commit/23233d5b4ccecfcf92ab481d2e93a9315d5527f7))
### Bug Fixes
* **llm:** enforce_air_gap now refuses the remote classifier instead of doing nothing ([#1334](https://github.com/nimbus-agent/Nimbus/issues/1334)) ([be9841c](https://github.com/nimbus-agent/Nimbus/commit/be9841cbda3746e5c727caaf131b9013dfaec697))
## [2.18.1](https://github.com/nimbus-agent/Nimbus/compare/v2.18.0...v2.18.1) (2026-08-25)
### Bug Fixes
* **quality:** clear 9 Sonar issues, two of them real security bugs ([#1327](https://github.com/nimbus-agent/Nimbus/issues/1327)) ([6d828c5](https://github.com/nimbus-agent/Nimbus/commit/6d828c5c273e5c01d8d2ac44281ce7ef2753284b))
## [2.18.0](https://github.com/nimbus-agent/Nimbus/compare/v2.17.0...v2.18.0) (2026-08-24)
### Features
* **egress:** record how a targeted fetch ended (U3a) ([#1325](https://github.com/nimbus-agent/Nimbus/issues/1325)) ([68db7d6](https://github.com/nimbus-agent/Nimbus/commit/68db7d63555782b7bb4f8c547c06e561fc8d75dd))
## [2.17.0](https://github.com/nimbus-agent/Nimbus/compare/v2.16.0...v2.17.0) (2026-08-24)
### Features
* **egress:** a targeted fetch names the client that asked for it (U2a) ([#1322](https://github.com/nimbus-agent/Nimbus/issues/1322)) ([8611b5c](https://github.com/nimbus-agent/Nimbus/commit/8611b5c72afab10338e93b438ecd27aeec3ec966))
### Bug Fixes
* **docs:** correct the standalone connector install path, and measure client support ([#1323](https://github.com/nimbus-agent/Nimbus/issues/1323)) ([bdc6abf](https://github.com/nimbus-agent/Nimbus/commit/bdc6abf2bc44ad53933191f35537fdf1ea56c737))
## [2.16.0](https://github.com/nimbus-agent/Nimbus/compare/v2.15.0...v2.16.0) (2026-08-23)
### Features
* **connectors:** per-connector write action types across all 94 connectors ([#1321](https://github.com/nimbus-agent/Nimbus/issues/1321)) ([072b1fa](https://github.com/nimbus-agent/Nimbus/commit/072b1fa9682c682bfb11fe56ce8498ff32ec56f0))
* **http:** read the egress ledger over HTTP, under its own scope (U1) ([#1319](https://github.com/nimbus-agent/Nimbus/issues/1319)) ([e42d66b](https://github.com/nimbus-agent/Nimbus/commit/e42d66be2728742a9f9224fe44e20d180458729a))
## [2.15.0](https://github.com/nimbus-agent/Nimbus/compare/v2.14.0...v2.15.0) (2026-08-23)
### Features
* **connectors:** consent-gated standalone connectors, so writes cannot run ungated off-gateway ([#1318](https://github.com/nimbus-agent/Nimbus/issues/1318)) ([e4d948a](https://github.com/nimbus-agent/Nimbus/commit/e4d948aa3c03b4a22d603b0f816d3f98bf2c3fe6))
### Bug Fixes
* **test:** stop the Windows deploy.preflight hook timeout and clear the Sonar backlog ([#1316](https://github.com/nimbus-agent/Nimbus/issues/1316)) ([139aa40](https://github.com/nimbus-agent/Nimbus/commit/139aa40307d73083bfeb955d264858d1ad2e54c9))
## [2.14.0](https://github.com/nimbus-agent/Nimbus/compare/v2.13.4...v2.14.0) (2026-08-23)
### Features
* **exec:** sandboxed code execution behind the I33 owner gate (S2 slice 1) ([#1313](https://github.com/nimbus-agent/Nimbus/issues/1313)) ([25e2c3b](https://github.com/nimbus-agent/Nimbus/commit/25e2c3bdf8ba9b8718cf24994a31bffc36745899))
## [2.13.4](https://github.com/nimbus-agent/Nimbus/compare/v2.13.3...v2.13.4) (2026-08-23)
### Bug Fixes
* **test:** re-home the F11 Google-spawn isolation tests off a process-global mock ([#1311](https://github.com/nimbus-agent/Nimbus/issues/1311)) ([f9c6f92](https://github.com/nimbus-agent/Nimbus/commit/f9c6f92ee2c2ef27b96c2df26b8a68ee4b8dd60d))
## [2.13.3](https://github.com/nimbus-agent/Nimbus/compare/v2.13.2...v2.13.3) (2026-08-22)
### Bug Fixes
* the remaining 24 findings from the local-LLM audit ([#1307](https://github.com/nimbus-agent/Nimbus/issues/1307)) ([1f9ae09](https://github.com/nimbus-agent/Nimbus/commit/1f9ae09a1a27401de96241686e9b97868309b969))
## [2.13.2](https://github.com/nimbus-agent/Nimbus/compare/v2.13.1...v2.13.2) (2026-08-22)
### Bug Fixes
* **cli:** a Gateway connection can always answer a HITL prompt ([#1305](https://github.com/nimbus-agent/Nimbus/issues/1305)) ([576ba6e](https://github.com/nimbus-agent/Nimbus/commit/576ba6e2d7d5fb4ea0cd8d81d0505b4c57f4f085))
## [2.13.1](https://github.com/nimbus-agent/Nimbus/compare/v2.13.0...v2.13.1) (2026-08-22)
### Bug Fixes
* **agents:** strip a fabricated reserved section at any level, and in its non-heading form ([#1302](https://github.com/nimbus-agent/Nimbus/issues/1302)) ([6742411](https://github.com/nimbus-agent/Nimbus/commit/6742411706b8c41b3730f93e91ba45bd5129fd75))
* **build:** bundle the gateway workers so they exist in a compiled binary ([#1299](https://github.com/nimbus-agent/Nimbus/issues/1299)) ([934779b](https://github.com/nimbus-agent/Nimbus/commit/934779b29fcab02a7d234402e949a14b80264a92))
* **ci:** close the pre-push gaps behind most red PR checks ([#1303](https://github.com/nimbus-agent/Nimbus/issues/1303)) ([0407fb0](https://github.com/nimbus-agent/Nimbus/commit/0407fb0c1410a15435c3e170b113a6163db8518e))
* **ci:** make the sandbox spawn suite report why it failed, and gate it on the platforms it is about ([#1298](https://github.com/nimbus-agent/Nimbus/issues/1298)) ([344e217](https://github.com/nimbus-agent/Nimbus/commit/344e2173300bec92886d7f329ba6fe220360c234))
* **preflight:** an unknown service must not pass the deploy gate ([#1297](https://github.com/nimbus-agent/Nimbus/issues/1297)) ([6ae5a53](https://github.com/nimbus-agent/Nimbus/commit/6ae5a53fd3ca911373ca511dafa5ad48e29f1d69))
## [2.13.0](https://github.com/nimbus-agent/Nimbus/compare/v2.12.1...v2.13.0) (2026-08-21)
### Features
* **sandbox:** a real Windows sandbox leg, and a policy-shaped runner interface ([#1294](https://github.com/nimbus-agent/Nimbus/issues/1294)) ([54c20c9](https://github.com/nimbus-agent/Nimbus/commit/54c20c98714a85b1a57d5166938c4cd2bedcc457))
## [2.12.1](https://github.com/nimbus-agent/Nimbus/compare/v2.12.0...v2.12.1) (2026-08-21)
### Performance Improvements
* **test:** a migrated-once schema template and a deadline-bounded poll, for the Windows hot path ([#1291](https://github.com/nimbus-agent/Nimbus/issues/1291)) ([6e5fbfd](https://github.com/nimbus-agent/Nimbus/commit/6e5fbfdea1a3e095095aec665cc6e0f9d5d10711))
## [2.12.0](https://github.com/nimbus-agent/Nimbus/compare/v2.11.0...v2.12.0) (2026-08-21)
### Features
* **security:** I32 — clip source metadata is whitelist-constructed, so a page cannot deny ingestion of its own clip ([#1288](https://github.com/nimbus-agent/Nimbus/issues/1288)) ([5587c84](https://github.com/nimbus-agent/Nimbus/commit/5587c84e55eff015ea508a423fb7365e14ce94f9))
## [2.11.0](https://github.com/nimbus-agent/Nimbus/compare/v2.10.0...v2.11.0) (2026-08-21)
### Features
* **clips:** a web clip can say who wrote it — optional source metadata on POST /v1/clips (2.5 S2) ([#1285](https://github.com/nimbus-agent/Nimbus/issues/1285)) ([1c7e818](https://github.com/nimbus-agent/Nimbus/commit/1c7e8184e04acf8b1eaddf6415e52fbda46b2001))
## [2.10.0](https://github.com/nimbus-agent/Nimbus/compare/v2.9.0...v2.10.0) (2026-08-21)
### Features
* **engine:** negation predicates reach nimbus ask and MCP clients, refusing rather than guessing (W6-B.2) ([#1281](https://github.com/nimbus-agent/Nimbus/issues/1281)) ([5ce7505](https://github.com/nimbus-agent/Nimbus/commit/5ce7505be84d5cc3e5c0f36e96dae6872c1102b0))
## [2.9.0](https://github.com/nimbus-agent/Nimbus/compare/v2.8.0...v2.9.0) (2026-08-20)
### Features
* **query:** first-class negation queries that refuse rather than answer from an empty index (W6-B.1) ([#1277](https://github.com/nimbus-agent/Nimbus/issues/1277)) ([10c20cb](https://github.com/nimbus-agent/Nimbus/commit/10c20cb0cbb2daaf83585ff81346acfdce7a247c))
## [2.8.0](https://github.com/nimbus-agent/Nimbus/compare/v2.7.1...v2.8.0) (2026-08-20)
### Features
* **prfiles:** index PR changed-file paths behind an explicit coverage record ([#1258](https://github.com/nimbus-agent/Nimbus/issues/1258)) ([926fb80](https://github.com/nimbus-agent/Nimbus/commit/926fb80fd4f04515c6f92ef8aca40a0986746df4))
## [2.7.1](https://github.com/nimbus-agent/Nimbus/compare/v2.7.0...v2.7.1) (2026-08-19)
### Bug Fixes
* **ownership:** stop the symbol sync wiping owner counts from the graph ([#1255](https://github.com/nimbus-agent/Nimbus/issues/1255)) ([34a08e3](https://github.com/nimbus-agent/Nimbus/commit/34a08e3005e554e935135409ff1a64469b56d5c8))
## [2.7.0](https://github.com/nimbus-agent/Nimbus/compare/v2.6.0...v2.7.0) (2026-08-19)
### Features
* **briefs:** research briefs draw on the whole index, not only clips ([#1253](https://github.com/nimbus-agent/Nimbus/issues/1253)) ([80c21df](https://github.com/nimbus-agent/Nimbus/commit/80c21dfa0590d1bbb6af88c6556a4a0cfb7da2d3))
* **engine:** [persona] gives Nimbus a configurable voice ([#1248](https://github.com/nimbus-agent/Nimbus/issues/1248)) ([10b3175](https://github.com/nimbus-agent/Nimbus/commit/10b31750e57f1b3a6469b731b0942929b7f4d7fc))
* **engine:** nimbus ask --devil argues against the plan ([#1246](https://github.com/nimbus-agent/Nimbus/issues/1246)) ([becc386](https://github.com/nimbus-agent/Nimbus/commit/becc386cb9d114ed4bf9f292b3ce99cb7e97afa7))
* **metrics:** nimbus stats charts a metric over time ([#1249](https://github.com/nimbus-agent/Nimbus/issues/1249)) ([ba316d4](https://github.com/nimbus-agent/Nimbus/commit/ba316d412fb25b83d78be798e757bd64c9fdfb80))
### Bug Fixes
* **ci:** stop the AuditPanel vitest flake, clear the Sonar board, and make docs/README.md the only README ([#1252](https://github.com/nimbus-agent/Nimbus/issues/1252)) ([70f15ca](https://github.com/nimbus-agent/Nimbus/commit/70f15ca9ab2d0ad1ccb93acc01ab54ad3106c38f))
## [2.6.0](https://github.com/nimbus-agent/Nimbus/compare/v2.5.0...v2.6.0) (2026-08-18)
### Features
* **agents:** give every interleaved brief disclosure one definition and a guard ([#1245](https://github.com/nimbus-agent/Nimbus/issues/1245)) ([5b9c115](https://github.com/nimbus-agent/Nimbus/commit/5b9c1152c6c0df19f0035ab401bd62413132b89b))
* **agents:** never let synthesis drop a brief's disclosures ([#1237](https://github.com/nimbus-agent/Nimbus/issues/1237)) ([f27b416](https://github.com/nimbus-agent/Nimbus/commit/f27b416b793fc096f59e73196a3b1717ca7e8764))
### Bug Fixes
* **release:** parse the squash message GitHub actually creates ([#1235](https://github.com/nimbus-agent/Nimbus/issues/1235)) ([044c16b](https://github.com/nimbus-agent/Nimbus/commit/044c16bd36b4aa06716a917d6a6e412ef9c8ef80))
## [2.5.0](https://github.com/nimbus-agent/Nimbus/compare/v2.4.9...v2.5.0) (2026-08-16)
### Features
* **clips:** related answers about the resolved item, and its snippets come from the body ([#1232](https://github.com/nimbus-agent/Nimbus/issues/1232)) ([9f75fa3](https://github.com/nimbus-agent/Nimbus/commit/9f75fa3fe8c75a740ff86dbea09b8d80cca427b3))
## [2.4.9](https://github.com/nimbus-agent/Nimbus/compare/v2.4.8...v2.4.9) (2026-08-16)
### Bug Fixes
* **coverage:** gate four runtime-bearing types files and give the sandbox harness a way to run ([#1230](https://github.com/nimbus-agent/Nimbus/issues/1230)) ([326493d](https://github.com/nimbus-agent/Nimbus/commit/326493d950392b38e38b2ed5d70410693d3b976a))
## [2.4.8](https://github.com/nimbus-agent/Nimbus/compare/v2.4.7...v2.4.8) (2026-08-16)
### Bug Fixes
* **release:** gate the release PR at PR time, and reject a body release-please cannot parse ([#1227](https://github.com/nimbus-agent/Nimbus/issues/1227)) ([074daab](https://github.com/nimbus-agent/Nimbus/commit/074daab8d22b28212b4a8fd467d3783b76678e35))
## [2.4.7](https://github.com/nimbus-agent/Nimbus/compare/v2.4.6...v2.4.7) (2026-08-16)
### Bug Fixes
* **security:** three allowlisted methods had no reachable handler; add the test I7 promised ([#1225](https://github.com/nimbus-agent/Nimbus/issues/1225)) ([f7d8c75](https://github.com/nimbus-agent/Nimbus/commit/f7d8c75cdd893a0cabd596f3792fc5aa05c43d05))
## [2.4.6](https://github.com/nimbus-agent/Nimbus/compare/v2.4.5...v2.4.6) (2026-08-16)
### Bug Fixes
* **docs:** derive four drifted invariant claims instead of hand-maintaining them ([#1221](https://github.com/nimbus-agent/Nimbus/issues/1221)) ([6fc59e5](https://github.com/nimbus-agent/Nimbus/commit/6fc59e518c1f269701e57f4b5d5af7bb0b1166db))
* **security:** wire the two I22/I18 defenses that were resolved but never read ([#1220](https://github.com/nimbus-agent/Nimbus/issues/1220)) ([84d3e62](https://github.com/nimbus-agent/Nimbus/commit/84d3e6294a0cf537824410044b93dbe8325a4c13))
## [2.4.5](https://github.com/nimbus-agent/Nimbus/compare/v2.4.4...v2.4.5) (2026-08-15)
### Bug Fixes
* `nimbus config set` on a fresh machine, and an unactionable brief footer ([#1212](https://github.com/nimbus-agent/Nimbus/issues/1212)) ([c6824c7](https://github.com/nimbus-agent/Nimbus/commit/c6824c7a361af60a966d3aa9004e079ff3dbd914))
## [2.4.4](https://github.com/nimbus-agent/Nimbus/compare/v2.4.3...v2.4.4) (2026-08-15)
### Bug Fixes
* **sonar:** resolve the six minor findings and annotate the S8786 false positive ([#1206](https://github.com/nimbus-agent/Nimbus/issues/1206)) ([fa65d95](https://github.com/nimbus-agent/Nimbus/commit/fa65d957c46ff46354f8c17d9d37cf4d13957c19))
* **tui:** render the watcher pane, and stop claiming OS notifications work ([#1204](https://github.com/nimbus-agent/Nimbus/issues/1204)) ([78cb49b](https://github.com/nimbus-agent/Nimbus/commit/78cb49b0b8242e8ce56245c4454cc6e49c507244))
## [2.4.3](https://github.com/nimbus-agent/Nimbus/compare/v2.4.2...v2.4.3) (2026-08-15)
### Bug Fixes
* **admin-console:** escape policy.version before it reaches innerHTML ([#1201](https://github.com/nimbus-agent/Nimbus/issues/1201)) ([f62fd85](https://github.com/nimbus-agent/Nimbus/commit/f62fd8553e1ebc14f67f0a16a784302e80cb55e2))
* **cli:** stop blocking gateway RPCs dying on the 30s client timeout ([#1203](https://github.com/nimbus-agent/Nimbus/issues/1203)) ([3fc2132](https://github.com/nimbus-agent/Nimbus/commit/3fc2132255c86fbf04fce408e8f35cb123cb24ef))
## [2.4.2](https://github.com/nimbus-agent/Nimbus/compare/v2.4.1...v2.4.2) (2026-08-15)
### Bug Fixes
* **egress:** count the whole prove window, not the first page of it ([#1189](https://github.com/nimbus-agent/Nimbus/issues/1189)) ([1743437](https://github.com/nimbus-agent/Nimbus/commit/1743437229cc4b9fec8387fede74ced92f8d0453))
## [2.4.1](https://github.com/nimbus-agent/Nimbus/compare/v2.4.0...v2.4.1) (2026-08-14)
### Bug Fixes
* **install:** stop Windows PowerShell 5.1 native stderr from aborting gpg signature verification ([#1179](https://github.com/nimbus-agent/Nimbus/issues/1179)) ([6c991ea](https://github.com/nimbus-agent/Nimbus/commit/6c991eabf4cb110a4ddaf0ca844da62bfd437e7d))
## [2.4.0](https://github.com/nimbus-agent/Nimbus/compare/v2.3.1...v2.4.0) (2026-08-14)
### Features
* **connectors:** attribute PagerDuty incidents to people ([#1177](https://github.com/nimbus-agent/Nimbus/issues/1177)) ([20b51f6](https://github.com/nimbus-agent/Nimbus/commit/20b51f645fb118c388a4ba763514e9272ba627b2))
## [2.3.1](https://github.com/nimbus-agent/Nimbus/compare/v2.3.0...v2.3.1) (2026-08-14)
### Bug Fixes
* **install:** verify the release signature on Windows with a Git-for-Windows gpg ([#1175](https://github.com/nimbus-agent/Nimbus/issues/1175)) ([a68945e](https://github.com/nimbus-agent/Nimbus/commit/a68945e55cff9409536824d9fa7ff2c87d025fef))
## [2.3.0](https://github.com/nimbus-agent/Nimbus/compare/v2.2.0...v2.3.0) (2026-08-13)
### Features
* **connectors:** index Sentry issues, and make the published installers able to install ([#1172](https://github.com/nimbus-agent/Nimbus/issues/1172)) ([ea37e0d](https://github.com/nimbus-agent/Nimbus/commit/ea37e0d0ca904aa9ea229146692ef945b4c80df3))
## [2.2.0](https://github.com/nimbus-agent/Nimbus/compare/v2.1.0...v2.2.0) (2026-08-13)
### Features
* **agents:** nimbus negotiate — a cited contribution brief ([#1166](https://github.com/nimbus-agent/Nimbus/issues/1166)) ([fa807e3](https://github.com/nimbus-agent/Nimbus/commit/fa807e30377ae6e121b58eacb0b304d85b73a4fe))
* **ipc:** tag agent.chunk with a client-supplied streamId and add workflow.cancel ([#1165](https://github.com/nimbus-agent/Nimbus/issues/1165)) ([5779488](https://github.com/nimbus-agent/Nimbus/commit/5779488c77871113aeaecb7c9fa33c2b82ab540b))
## [2.1.0](https://github.com/nimbus-agent/Nimbus/compare/v2.0.0...v2.1.0) (2026-08-12)
### Features
* **connectors:** index GitHub PR reviews and size statistics ([#1159](https://github.com/nimbus-agent/Nimbus/issues/1159)) ([fb8a0c7](https://github.com/nimbus-agent/Nimbus/commit/fb8a0c7a1caeb8ffcf292b9b1f5ca472511e6855))
## [2.0.0](https://github.com/nimbus-agent/Nimbus/compare/v1.29.0...v2.0.0) (2026-08-11)
### ⚠ BREAKING CHANGES
* **egress:** remove the EgressCompleteness.tier compat shim ([#1156](https://github.com/nimbus-agent/Nimbus/issues/1156))
### Bug Fixes
* **clips:** embed web clips locally and stop advertising discarded text ([#1151](https://github.com/nimbus-agent/Nimbus/issues/1151)) ([0e3b183](https://github.com/nimbus-agent/Nimbus/commit/0e3b18336d1e1cb79080d09b660f20ca785c57ca))
* **quality:** close two ReDoS regexes and clear 25 SonarCloud findings ([#1152](https://github.com/nimbus-agent/Nimbus/issues/1152)) ([1f89379](https://github.com/nimbus-agent/Nimbus/commit/1f893798d6466c8a860fcda2141f5832acdda9c2))
### Code Refactoring
* **egress:** remove the EgressCompleteness.tier compat shim ([#1156](https://github.com/nimbus-agent/Nimbus/issues/1156)) ([7b530dc](https://github.com/nimbus-agent/Nimbus/commit/7b530dcc15930a208d63af43ad3af9dd46f44d07))
## [1.29.0](https://github.com/nimbus-agent/Nimbus/compare/v1.28.0...v1.29.0) (2026-08-11)
### Features
* **agents:** nimbus pre-mortem, with a service-scoped incident watcher condition ([#1146](https://github.com/nimbus-agent/Nimbus/issues/1146)) ([58e93fd](https://github.com/nimbus-agent/Nimbus/commit/58e93fd3e9e245c0ad17a3c8a3c51df815afda7a))
### Bug Fixes
* **connectors:** report only what was actually verified in connector auth and targeted fetch ([#1141](https://github.com/nimbus-agent/Nimbus/issues/1141)) ([902cd42](https://github.com/nimbus-agent/Nimbus/commit/902cd4291f9fb5278e56e59a9c1ecebbb293b33c))
* **gateway:** log why the process exits instead of dying silently ([#1140](https://github.com/nimbus-agent/Nimbus/issues/1140)) ([322ea68](https://github.com/nimbus-agent/Nimbus/commit/322ea683266d97a96aaa05e182b6208365ad5dbe))
## [1.28.0](https://github.com/nimbus-agent/Nimbus/compare/v1.27.0...v1.28.0) (2026-08-10)
### Features
* **automation:** add incident_opened and deploy_failed watcher conditions ([#1138](https://github.com/nimbus-agent/Nimbus/issues/1138)) ([34601b2](https://github.com/nimbus-agent/Nimbus/commit/34601b24b98026e61f3785965cf38b38b1d414f6))
## [1.27.0](https://github.com/nimbus-agent/Nimbus/compare/v1.26.1...v1.27.0) (2026-08-09)
### Features
* **gateway:** pre-mortem theme extraction pass (V53, PR A of 2) ([#1134](https://github.com/nimbus-agent/Nimbus/issues/1134)) ([cd1d9c2](https://github.com/nimbus-agent/Nimbus/commit/cd1d9c2e4c25e656af7db81b4de486a939139b69))
## [1.26.1](https://github.com/nimbus-agent/Nimbus/compare/v1.26.0...v1.26.1) (2026-08-09)
### Bug Fixes
* **ci:** accept repo as satisfying public_repo on WINGET_PAT, and add a scope-check script ([#1131](https://github.com/nimbus-agent/Nimbus/issues/1131)) ([ba54754](https://github.com/nimbus-agent/Nimbus/commit/ba54754432f3fb15d61020dff948b6ec8b4fdaf2))
## [1.26.0](https://github.com/nimbus-agent/Nimbus/compare/v1.25.2...v1.26.0) (2026-08-09)
### Features
* **gateway:** index Jira/Linear ticket depth and recover it via rebody --since ([#1128](https://github.com/nimbus-agent/Nimbus/issues/1128)) ([bdbecd1](https://github.com/nimbus-agent/Nimbus/commit/bdbecd16438824333aa5014bcf10a3ef19225a58))
## [1.25.2](https://github.com/nimbus-agent/Nimbus/compare/v1.25.1...v1.25.2) (2026-08-08)
### Bug Fixes
* **bitbucket:** 🧹 correct itemsUpserted overcount ([#1086](https://github.com/nimbus-agent/Nimbus/issues/1086)) ([9657921](https://github.com/nimbus-agent/Nimbus/commit/965792107ebcafba10667aab9bd5c7166388dc00))
* **gateway:** 🔒 Prevent command injection in tar extraction ([#1091](https://github.com/nimbus-agent/Nimbus/issues/1091)) ([575e2aa](https://github.com/nimbus-agent/Nimbus/commit/575e2aa5648d101c02f06450df4016500e3cfe50))
* **gateway:** resolve WAL mode race in http-api-test-server ([#1093](https://github.com/nimbus-agent/Nimbus/issues/1093)) ([1323567](https://github.com/nimbus-agent/Nimbus/commit/1323567a7a2d07bea4b39a6ba1b4a974cccc2b00))
### Performance Improvements
* **connectors:** ⚡ batch fetch message metadata in Gmail sync ([#1099](https://github.com/nimbus-agent/Nimbus/issues/1099)) ([cf1dfe1](https://github.com/nimbus-agent/Nimbus/commit/cf1dfe1d50b61682a7a27849e4678ecd734bc078))
* **gateway:** ⚡ batch API calls in SonarQube Sync to resolve N+1 issue ([#1089](https://github.com/nimbus-agent/Nimbus/issues/1089)) ([892e96b](https://github.com/nimbus-agent/Nimbus/commit/892e96b62839e9bc1a94d73b206a49fa1dd3233a))
* **jenkins:** ⚡ batch jenkins job builds sync ([#1087](https://github.com/nimbus-agent/Nimbus/issues/1087)) ([d94d632](https://github.com/nimbus-agent/Nimbus/commit/d94d63274a0d8f4a29771816e77911363ea24c11))
## [1.25.1](https://github.com/nimbus-agent/Nimbus/compare/v1.25.0...v1.25.1) (2026-08-08)
### Bug Fixes
* resolve macos-15 CI test failures and consolidate open connector PRs ([#1082](https://github.com/nimbus-agent/Nimbus/issues/1082)) ([9f9215b](https://github.com/nimbus-agent/Nimbus/commit/9f9215bfcca7ba4cdde0b66e4975881359882797))
## [1.25.0](https://github.com/nimbus-agent/Nimbus/compare/v1.24.0...v1.25.0) (2026-08-08)
### Features
* **gateway:** resolve an indexed item by URL (V52 resolve_key) ([#1070](https://github.com/nimbus-agent/Nimbus/issues/1070)) ([0a32751](https://github.com/nimbus-agent/Nimbus/commit/0a32751f6e97af93b5fc405080df14bd7a77911d))
* **gateway:** targeted fetch-on-miss behind a derived host boundary ([#1072](https://github.com/nimbus-agent/Nimbus/issues/1072)) ([369f9af](https://github.com/nimbus-agent/Nimbus/commit/369f9af1a81e10599dc3d9b9f6c86c43bfa95fbc))
## [1.24.0](https://github.com/nimbus-agent/Nimbus/compare/v1.23.0...v1.24.0) (2026-08-07)
### Features
* **gateway:** read the ownership graph through the agents.ownership brief ([#1067](https://github.com/nimbus-agent/Nimbus/issues/1067)) ([e898a1e](https://github.com/nimbus-agent/Nimbus/commit/e898a1e9e204c8720050b44b73b37c52611690fc))
## [1.23.0](https://github.com/nimbus-agent/Nimbus/compare/v1.22.0...v1.23.0) (2026-08-07)
### Features
* **gateway:** invoke read-only agents over the HTTP API, recorded in the egress ledger ([#1063](https://github.com/nimbus-agent/Nimbus/issues/1063)) ([4b4bedb](https://github.com/nimbus-agent/Nimbus/commit/4b4bedb4e000f79d63f2cddbbda2e2d92006a51e))
* **gateway:** ownership graph derived from already-indexed blame data ([#1064](https://github.com/nimbus-agent/Nimbus/issues/1064)) ([82c03d2](https://github.com/nimbus-agent/Nimbus/commit/82c03d27339290d11276f65cec795c9975432647))
* **gateway:** scope the HTTP API bearer tokens ([#1062](https://github.com/nimbus-agent/Nimbus/issues/1062)) ([826b76a](https://github.com/nimbus-agent/Nimbus/commit/826b76a1a5352ac226bfcd3c6a88b901d6afe33a))
### Bug Fixes
* **gateway:** serve the admin console and OpenAPI doc from a compiled binary ([#1058](https://github.com/nimbus-agent/Nimbus/issues/1058)) ([36abf19](https://github.com/nimbus-agent/Nimbus/commit/36abf192457984a42e2d4e74b984603d51fbb376))
## [1.22.0](https://github.com/nimbus-agent/Nimbus/compare/v1.21.0...v1.22.0) (2026-08-06)
### Features
* expose the read-only agents as MCP tools, recorded in the egress ledger ([#1059](https://github.com/nimbus-agent/Nimbus/issues/1059)) ([dcc7bd7](https://github.com/nimbus-agent/Nimbus/commit/dcc7bd7d1a1bbdf04273b4769df7e0f637bbc209))
## [1.21.0](https://github.com/nimbus-agent/Nimbus/compare/v1.20.0...v1.21.0) (2026-08-05)
### Features
* **tooling:** close the gap between local gates and CI ([#1050](https://github.com/nimbus-agent/Nimbus/issues/1050)) ([0efd781](https://github.com/nimbus-agent/Nimbus/commit/0efd781af366606b6dc0ddb8e08a97027db55d5a))
### Bug Fixes
* **gateway:** make connectors spawnable from a compiled binary ([#1055](https://github.com/nimbus-agent/Nimbus/issues/1055)) ([b3a6f15](https://github.com/nimbus-agent/Nimbus/commit/b3a6f159e9f9c4b8b0ed44262067efec42dfaba4))
## [1.20.0](https://github.com/nimbus-agent/Nimbus/compare/v1.19.1...v1.20.0) (2026-08-04)
### Features
* **connectors:** index real Notion and Confluence page bodies ([#1039](https://github.com/nimbus-agent/Nimbus/issues/1039)) ([609409e](https://github.com/nimbus-agent/Nimbus/commit/609409ec07c6b72c9d817330a394e1b961ca27fb))
* **egress:** make the I29 completeness claim true — coverage vector, boot marker, required sink ([#1038](https://github.com/nimbus-agent/Nimbus/issues/1038)) ([a1169d9](https://github.com/nimbus-agent/Nimbus/commit/a1169d943aca41a339bb8fb1c6b32ee4f929e2fb))
## [1.19.1](https://github.com/nimbus-agent/Nimbus/compare/v1.19.0...v1.19.1) (2026-08-03)
### Bug Fixes
* **deps:** bump the brace-expansion override to 5.0.9 (GHSA-rgw5-rvv9-x895) ([#1035](https://github.com/nimbus-agent/Nimbus/issues/1035)) ([8d66323](https://github.com/nimbus-agent/Nimbus/commit/8d663237a4ff3615e12cd6c8f106aa3c51b4f34e))
## [1.19.0](https://github.com/nimbus-agent/Nimbus/compare/v1.18.1...v1.19.0) (2026-08-03)
### Features
* **cli:** nimbus index rebody, and correct the full-body-store connector accounting ([#1032](https://github.com/nimbus-agent/Nimbus/issues/1032)) ([9ab8c69](https://github.com/nimbus-agent/Nimbus/commit/9ab8c697f4aa81e843e4670a888f19d654c1c9cc))
## [1.18.1](https://github.com/nimbus-agent/Nimbus/compare/v1.18.0...v1.18.1) (2026-08-03)
### Bug Fixes
* **connectors:** metadata_only redaction must erase embedding chunks and the right vectors ([#1026](https://github.com/nimbus-agent/Nimbus/issues/1026)) ([bae0d86](https://github.com/nimbus-agent/Nimbus/commit/bae0d86aea42d3161da828b53be69f19e8bd1614))
* **ipc:** forbid the clip namespace over LAN — clip.pair opens the I30 pairing window ([#1027](https://github.com/nimbus-agent/Nimbus/issues/1027)) ([7bd2cdc](https://github.com/nimbus-agent/Nimbus/commit/7bd2cdc128e4f5ab8fcdb3a8301bc8cdd6efade5))
## [1.18.0](https://github.com/nimbus-agent/Nimbus/compare/v1.17.0...v1.18.0) (2026-08-02)
### Features
* **index:** full-body store — V48 item.body, uncapped keyword search, and full bodies for the prose sources ([#1023](https://github.com/nimbus-agent/Nimbus/issues/1023)) ([faa23a8](https://github.com/nimbus-agent/Nimbus/commit/faa23a8b50fe7d8e9ae293adcb7e912572a1a900))
### Bug Fixes
* **share:** fail closed on unverified share replay ([#1021](https://github.com/nimbus-agent/Nimbus/issues/1021)) ([e210723](https://github.com/nimbus-agent/Nimbus/commit/e210723c8885f77c9be560ff3ccb3cff90e9018e))
## [1.17.0](https://github.com/nimbus-agent/Nimbus/compare/v1.16.1...v1.17.0) (2026-08-02)
### Features
* **decisions:** add nimbus decisions, the implicit ADR extractor ([#1019](https://github.com/nimbus-agent/Nimbus/issues/1019)) ([e999122](https://github.com/nimbus-agent/Nimbus/commit/e99912257b32315641c1ac43c1f75790146679c5))
## [1.16.1](https://github.com/nimbus-agent/Nimbus/compare/v1.16.0...v1.16.1) (2026-08-01)
### Bug Fixes
* **deps:** reconcile overrides, align the sdk floor onto the BOM fix, and gate both ([#1017](https://github.com/nimbus-agent/Nimbus/issues/1017)) ([6dfdc81](https://github.com/nimbus-agent/Nimbus/commit/6dfdc81edfc73e0f8ff2ba3558004352c264e5d8))
## [1.16.0](https://github.com/nimbus-agent/Nimbus/compare/v1.15.1...v1.16.0) (2026-08-01)
### Features
* **cli:** implement --json on the six commands that documented it ([#1011](https://github.com/nimbus-agent/Nimbus/issues/1011)) ([d3d252e](https://github.com/nimbus-agent/Nimbus/commit/d3d252e8c6ea3342fb5b9b80391eb056d952ff3c))
### Bug Fixes
* **cli:** make nimbus connector remove work by answering the gateway HITL gate ([#1013](https://github.com/nimbus-agent/Nimbus/issues/1013)) ([8f646c7](https://github.com/nimbus-agent/Nimbus/commit/8f646c76918a2ccab380d7c2fb5bd6cf2823c675))
* **release:** prune the yum channel, keeping the newest N and the published release ([#1010](https://github.com/nimbus-agent/Nimbus/issues/1010)) ([7dc717a](https://github.com/nimbus-agent/Nimbus/commit/7dc717a0fc0f8b8138a3e62bf3fdde867c44b06a))
## [1.15.1](https://github.com/nimbus-agent/Nimbus/compare/v1.15.0...v1.15.1) (2026-08-01)
### Bug Fixes
* **cli:** stop share argument errors crashing, and retire seven false coverage exclusions ([#1004](https://github.com/nimbus-agent/Nimbus/issues/1004)) ([982b4d2](https://github.com/nimbus-agent/Nimbus/commit/982b4d2a2605338a539077db56d9d02c38ccbd01))
## [1.15.0](https://github.com/nimbus-agent/Nimbus/compare/v1.14.2...v1.15.0) (2026-08-01)
### Features
* **glossary:** author and correct terms in nimbus.toml ([#993](https://github.com/nimbus-agent/Nimbus/issues/993)) ([b25c0f1](https://github.com/nimbus-agent/Nimbus/commit/b25c0f1a119700b7f2d50294c6165dc09eb89ce2))
## [1.14.2](https://github.com/nimbus-agent/Nimbus/compare/v1.14.1...v1.14.2) (2026-07-31)
### Bug Fixes
* **extensions:** accept entrypoint as a fallback for entry ([#991](https://github.com/nimbus-agent/Nimbus/issues/991)) ([d796cfb](https://github.com/nimbus-agent/Nimbus/commit/d796cfbf44934c6c4019ee956b943beb6418f9d1))
## [1.14.1](https://github.com/nimbus-agent/Nimbus/compare/v1.14.0...v1.14.1) (2026-07-31)
### Bug Fixes
* **glossary:** stop --refresh hanging when the gateway dies mid-pass ([#989](https://github.com/nimbus-agent/Nimbus/issues/989)) ([c571fe1](https://github.com/nimbus-agent/Nimbus/commit/c571fe18122cdaa81c6fa41fc2d37a20a65145a0))
## [1.14.0](https://github.com/nimbus-agent/Nimbus/compare/v1.13.1...v1.14.0) (2026-07-31)
### Features
* **glossary:** consolidate through a local-only LLM, upgrade snippet definitions, and wire --refresh/--rebuild ([#987](https://github.com/nimbus-agent/Nimbus/issues/987)) ([9d8def2](https://github.com/nimbus-agent/Nimbus/commit/9d8def2ea3fe048044dbb908e4fc877f6ca784e5))
## [1.13.1](https://github.com/nimbus-agent/Nimbus/compare/v1.13.0...v1.13.1) (2026-07-31)
### Bug Fixes
* **gateway:** remove the data-export staging directory ([#985](https://github.com/nimbus-agent/Nimbus/issues/985)) ([606788c](https://github.com/nimbus-agent/Nimbus/commit/606788c3c9b440a254d402f53f2aaba2f4d361f4))
## [1.13.0](https://github.com/nimbus-agent/Nimbus/compare/v1.12.1...v1.13.0) (2026-07-31)
### Features
* **glossary:** nimbus glossary — implicit-knowledge terminology agent ([#981](https://github.com/nimbus-agent/Nimbus/issues/981)) ([bb0069c](https://github.com/nimbus-agent/Nimbus/commit/bb0069c06b411ede044cacb135dac66f65982483))
## [1.12.1](https://github.com/nimbus-agent/Nimbus/compare/v1.12.0...v1.12.1) (2026-07-30)
### Bug Fixes
* **db:** finalize prepared statements so close() releases the database file ([#970](https://github.com/nimbus-agent/Nimbus/issues/970)) ([fa4aca2](https://github.com/nimbus-agent/Nimbus/commit/fa4aca2602a79cd64349c3e003ca01708f042976))
## [1.12.0](https://github.com/nimbus-agent/Nimbus/compare/v1.11.0...v1.12.0) (2026-07-30)
### Documentation
* **claude:** record that release tags are immutable, and how to recover ([#962](https://github.com/nimbus-agent/Nimbus/issues/962)) ([039176c](https://github.com/nimbus-agent/Nimbus/commit/039176c781f6f2617c581d50c8a8921c152f3cfc))
## [1.11.0](https://github.com/nimbus-agent/Nimbus/compare/v1.10.0...v1.11.0) (2026-07-30)
> **Never published — superseded by 1.12.0.** This tag's release build failed its
> Unit + Coverage gate, which skipped every build and publish job, so no GitHub Release,
> installer, or updater manifest was ever produced for `v1.11.0`; the git tag is its only
> trace. The tag is immutable under the *Protected release tags* ruleset and was left in
> place rather than moved, so the feature below shipped in 1.12.0 instead.
> See [#957](https://github.com/nimbus-agent/Nimbus/issues/957).
### Features
* **p6:** gate ruleset bypass actors — owner-run audit + credential-free attestation ([#954](https://github.com/nimbus-agent/Nimbus/issues/954)) ([2a3187b](https://github.com/nimbus-agent/Nimbus/commit/2a3187bd4942e33b128a09df3e59d9680d275960))
## [1.10.0](https://github.com/nimbus-agent/Nimbus/compare/v1.9.0...v1.10.0) (2026-07-30)
### Features
* **ci:** audit:review-coverage — close P3's org-wide half ([#948](https://github.com/nimbus-agent/Nimbus/issues/948)) ([5ad05a8](https://github.com/nimbus-agent/Nimbus/commit/5ad05a8c69e98624897f3996b6989fc145e69bba))
## [1.9.0](https://github.com/nimbus-agent/Nimbus/compare/v1.8.0...v1.9.0) (2026-07-30)
### Features
* **connectors:** index Readwise books as `readwise:book` ([#926](https://github.com/nimbus-agent/Nimbus/issues/926)) ([83b83f4](https://github.com/nimbus-agent/Nimbus/commit/83b83f491479c3ca8f0f8f45e12d4d08c0b425f2))
## [1.8.0](https://github.com/nimbus-agent/Nimbus/compare/v1.7.0...v1.8.0) (2026-07-29)
### Features
* **connectors:** index Google Meet participant detail on conference records ([#927](https://github.com/nimbus-agent/Nimbus/issues/927)) ([69282ef](https://github.com/nimbus-agent/Nimbus/commit/69282ef9712ec966afd9b5e6f4bc11527aa77d35))
### Bug Fixes
* **ci:** repair the coverage-gate count assertion broken by [#936](https://github.com/nimbus-agent/Nimbus/issues/936) ([#941](https://github.com/nimbus-agent/Nimbus/issues/941)) ([af9d246](https://github.com/nimbus-agent/Nimbus/commit/af9d246b5f06dceaeee4f43e8665c8b70932e956))
* **cli:** handle the embedding warm-up error in `nimbus search` ([#937](https://github.com/nimbus-agent/Nimbus/issues/937)) ([8640972](https://github.com/nimbus-agent/Nimbus/commit/8640972adbc81a88c7999597a6feaf381491fc39))
## [1.7.0](https://github.com/nimbus-agent/Nimbus/compare/v1.6.0...v1.7.0) (2026-07-29)
### Features
* **ci:** split secret-health's "expiring" from "dead" so a new failure is visible ([#922](https://github.com/nimbus-agent/Nimbus/issues/922)) ([2adae3c](https://github.com/nimbus-agent/Nimbus/commit/2adae3cc3d036ca97b1771ae9f880fbea5929881))
* **connectors:** index Mercury transactions (`mercury:transaction`) ([#924](https://github.com/nimbus-agent/Nimbus/issues/924)) ([d9a4708](https://github.com/nimbus-agent/Nimbus/commit/d9a4708318fc0ccd321f1e1dd96ad6fc074e863d))
* **connectors:** index Raindrop collections as `raindrop:collection` ([#929](https://github.com/nimbus-agent/Nimbus/issues/929)) ([bbe2be7](https://github.com/nimbus-agent/Nimbus/commit/bbe2be71a72fbea2f336ae47787c9aa535f755a0))
### Bug Fixes
* **cli:** make `nimbus init` fail loudly when the Gateway never starts ([#933](https://github.com/nimbus-agent/Nimbus/issues/933)) ([a28e3f0](https://github.com/nimbus-agent/Nimbus/commit/a28e3f049fbe85ef275d0c10149bf2fce95d2120))
* **gateway:** bind IPC before the embedding model loads ([#928](https://github.com/nimbus-agent/Nimbus/issues/928)) ([#934](https://github.com/nimbus-agent/Nimbus/issues/934)) ([79b18f0](https://github.com/nimbus-agent/Nimbus/commit/79b18f0e484d22a381324f660aa0631dce1385d5))
* **security:** close the last two bun audit advisories — @hono/node-server fixed, @ai-sdk/provider-utils accepted with a re-check date ([#923](https://github.com/nimbus-agent/Nimbus/issues/923)) ([ede61eb](https://github.com/nimbus-agent/Nimbus/commit/ede61eb4772b443abc1f7d24f843f04b8b90d7b5))
* **vault:** probe the Linux Secret Service instead of secret-tool's PATH ([#935](https://github.com/nimbus-agent/Nimbus/issues/935)) ([ccba4aa](https://github.com/nimbus-agent/Nimbus/commit/ccba4aa2dde285c7145ca2b6a94f3a6677954199))
## [1.6.0](https://github.com/nimbus-agent/Nimbus/compare/v1.5.1...v1.6.0) (2026-07-29)
### Features
* **audit:** detect when main is red ([#917](https://github.com/nimbus-agent/Nimbus/issues/917)) ([0f0b140](https://github.com/nimbus-agent/Nimbus/commit/0f0b14029396f4bc6cc5f73ce6427f115d03d1e5))
* **ci:** widen audit:org-settings-drift from 2 settings to 12 across 4 endpoints ([#918](https://github.com/nimbus-agent/Nimbus/issues/918)) ([04961ba](https://github.com/nimbus-agent/Nimbus/commit/04961ba9edf1d2ba0ccd2a9c4f122996df546783))
## [1.5.1](https://github.com/nimbus-agent/Nimbus/compare/v1.5.0...v1.5.1) (2026-07-28)
### Bug Fixes
* **docs:** serve .well-known/security.txt by disabling Jekyll filtering ([#915](https://github.com/nimbus-agent/Nimbus/issues/915)) ([393e7de](https://github.com/nimbus-agent/Nimbus/commit/393e7de7982e1a74f5544c1571b463bf66207c52))
## [1.5.0](https://github.com/nimbus-agent/Nimbus/compare/v1.4.3...v1.5.0) (2026-07-28)
### Features
* **ci:** close out P4b — after-measurement, co-gate enforcement, sweep proof ([#901](https://github.com/nimbus-agent/Nimbus/issues/901)) ([eaa1999](https://github.com/nimbus-agent/Nimbus/commit/eaa199953e2253cf03d24b7efb82d64a12bbb872))
## [1.4.3](https://github.com/nimbus-agent/Nimbus/compare/v1.4.2...v1.4.3) (2026-07-28)
### Bug Fixes
* **cast-driver:** normalize macOS's /private tmpdir alias — unbreaks main on macOS ([#899](https://github.com/nimbus-agent/Nimbus/issues/899)) ([de0a5f2](https://github.com/nimbus-agent/Nimbus/commit/de0a5f28c3313eef2c5f54c1c5aa616586bb6d50))
## [1.4.2](https://github.com/nimbus-agent/Nimbus/compare/v1.4.1...v1.4.2) (2026-07-28)
### Bug Fixes
* **cast-driver:** print the diff on DRIFT so a macOS-only failure is diagnosable ([#897](https://github.com/nimbus-agent/Nimbus/issues/897)) ([b9d074c](https://github.com/nimbus-agent/Nimbus/commit/b9d074cd25629eef66f373ad26b2469b1ba02911))
## [1.4.1](https://github.com/nimbus-agent/Nimbus/compare/v1.4.0...v1.4.1) (2026-07-28)
### Bug Fixes
* **gateway:** nimbus init could never index — connector.sync rejected every local syncable ([#895](https://github.com/nimbus-agent/Nimbus/issues/895)) ([f16b012](https://github.com/nimbus-agent/Nimbus/commit/f16b012cd2d4af2f2bc3ccf90cf74cc34ab12a99))
### Performance Improvements
* **ci:** cut a push run 105 -> 75 jobs — CI was queueing behind its own fan-out ([#894](https://github.com/nimbus-agent/Nimbus/issues/894)) ([1462894](https://github.com/nimbus-agent/Nimbus/commit/146289412bcc865d8583093a25a747c5fb979563))
## [1.4.0](https://github.com/nimbus-agent/Nimbus/compare/v1.3.0...v1.4.0) (2026-07-28)
### Features
* **demos:** recut the hero cast to the zero-config path ([#888](https://github.com/nimbus-agent/Nimbus/issues/888)) ([ad437ba](https://github.com/nimbus-agent/Nimbus/commit/ad437ba28522369411d96289998e8f2b9d95d016))
## [1.3.0](https://github.com/nimbus-agent/Nimbus/compare/v1.2.0...v1.3.0) (2026-07-28)
### Features
* zero-config onboarding — nimbus init, and the LLM demoted to optional ([#887](https://github.com/nimbus-agent/Nimbus/issues/887)) ([3e51aaf](https://github.com/nimbus-agent/Nimbus/commit/3e51aaf9f8171415c81d97a9b77f0f0141d40c76))
### Bug Fixes
* **perf:** stop a huggingface.co stall from blowing the 45m bench timeout ([#885](https://github.com/nimbus-agent/Nimbus/issues/885)) ([22938ac](https://github.com/nimbus-agent/Nimbus/commit/22938ac57788eed724d1ab6a28553bb7138b7631))
## [1.2.0](https://github.com/nimbus-agent/Nimbus/compare/v1.1.0...v1.2.0) (2026-07-27)
### Features
* **audit:** P4b — measure CI latency before tuning anything ([#877](https://github.com/nimbus-agent/Nimbus/issues/877)) ([6ffe23f](https://github.com/nimbus-agent/Nimbus/commit/6ffe23f3f0f9d94601ff4b9a23a48b3d3fc3f2a7))
### Bug Fixes
* **ci:** retry the Rust toolchain install, drop the redundant one, and close [#809](https://github.com/nimbus-agent/Nimbus/issues/809)/[#810](https://github.com/nimbus-agent/Nimbus/issues/810)/[#812](https://github.com/nimbus-agent/Nimbus/issues/812) ([#855](https://github.com/nimbus-agent/Nimbus/issues/855)) ([bb729c5](https://github.com/nimbus-agent/Nimbus/commit/bb729c5b55f3d64823a29e1b15bdd7e6c85a110a))
* **release:** publish the install scripts and stable-name aliases users are told to download ([#881](https://github.com/nimbus-agent/Nimbus/issues/881)) ([fdbc246](https://github.com/nimbus-agent/Nimbus/commit/fdbc2467bfa503a208d2f463e2b786f9cb4885e8))
## [1.1.0](https://github.com/nimbus-agent/Nimbus/compare/v1.0.1...v1.1.0) (2026-07-26)
### Features
* **audit:** action-pin freshness — pinned is not the same as current ([#847](https://github.com/nimbus-agent/Nimbus/issues/847)) ([fd1e7ae](https://github.com/nimbus-agent/Nimbus/commit/fd1e7ae03019158cbd3796d9e4933263d8687ea1))
* **audit:** P2 Release Train Phase 2 — dependency-DAG edges ([#843](https://github.com/nimbus-agent/Nimbus/issues/843)) ([1e8c9ea](https://github.com/nimbus-agent/Nimbus/commit/1e8c9eafdcde6a9f338ce87a613d19e417de8dfa))
* **review:** give the monorepo a tuned CodeRabbit config ([#846](https://github.com/nimbus-agent/Nimbus/issues/846)) ([060f50c](https://github.com/nimbus-agent/Nimbus/commit/060f50cda7c240651954cb7294c64d0a249d12a4))
## [1.0.1](https://github.com/nimbus-agent/Nimbus/compare/v1.0.0...v1.0.1) (2026-07-26)
### Bug Fixes
* **ci:** stop pending-run eviction silently cancelling main's validation ([#840](https://github.com/nimbus-agent/Nimbus/issues/840)) ([7ce8815](https://github.com/nimbus-agent/Nimbus/commit/7ce8815952858b16f367b98941539375e0af105e))
## [1.0.0](https://github.com/nimbus-agent/Nimbus/compare/v0.27.0...v1.0.0) (2026-07-26)
### ⚠ BREAKING CHANGES
* **security:** clear all high advisories (react-router v8, postcss, brace-expansion) + scope cla.yml permissions ([#835](https://github.com/nimbus-agent/Nimbus/issues/835))
### Features
* **infra:** P2 Release Train Phase 1 — release-staleness gate ([#836](https://github.com/nimbus-agent/Nimbus/issues/836)) ([98b0327](https://github.com/nimbus-agent/Nimbus/commit/98b03278380e946c36c4ae2c0038321969d2ff83))
### Bug Fixes
* **release:** reconcile step never detected a missing tag (gh writes 422 to stdout) ([#834](https://github.com/nimbus-agent/Nimbus/issues/834)) ([ffcec8e](https://github.com/nimbus-agent/Nimbus/commit/ffcec8eab8370ab6b8f908e0646a0f3975bd2194))
* **release:** request workflows:write so the App can create the release tag ([#837](https://github.com/nimbus-agent/Nimbus/issues/837)) ([2be97d7](https://github.com/nimbus-agent/Nimbus/commit/2be97d743861edb2764d707f349522161f9cf077))
* **security:** clear all high advisories (react-router v8, postcss, brace-expansion) + scope cla.yml permissions ([#835](https://github.com/nimbus-agent/Nimbus/issues/835)) ([7d2129e](https://github.com/nimbus-agent/Nimbus/commit/7d2129e62387e4de74159befbc6db1f85440d9fa))
## [0.27.0](https://github.com/nimbus-agent/Nimbus/compare/v0.26.0...v0.27.0) (2026-07-24)
### Features
* **infra:** P6a access model — team-reachability + org-settings drift gates ([#826](https://github.com/nimbus-agent/Nimbus/issues/826)) ([52afca3](https://github.com/nimbus-agent/Nimbus/commit/52afca34746045f202545d0bf0d55d70483d4afa))
## [0.26.0](https://github.com/nimbus-agent/Nimbus/compare/v0.25.0...v0.26.0) (2026-07-24)
### Features
* **agents:** the why lens — why agent, whyPeek, on-demand blame + index regraph (step 1b) ([#820](https://github.com/nimbus-agent/Nimbus/issues/820)) ([940cb2e](https://github.com/nimbus-agent/Nimbus/commit/940cb2e01c5c8ecb853c2d359c203022457a7efd))
* **blame:** whole-file 90-day blame indexer (Stage 2a un-park PR B) ([#819](https://github.com/nimbus-agent/Nimbus/issues/819)) ([4bcc076](https://github.com/nimbus-agent/Nimbus/commit/4bcc0767d5e1bb452789baff27f6aee98c517a91))
* **github:** enrich fallback 'PR #N' titles via pull-detail fetch ([#817](https://github.com/nimbus-agent/Nimbus/issues/817)) ([465bee0](https://github.com/nimbus-agent/Nimbus/commit/465bee092dcc732d72b52fd9b93adeb758edceba))
* **graph:** make resolves, mentions and correlates_with real (why-lens step 1a) ([#813](https://github.com/nimbus-agent/Nimbus/issues/813)) ([44e1c38](https://github.com/nimbus-agent/Nimbus/commit/44e1c384243354593ecbcea32df5b4af6a843b0c))
* nimbus index add + filesystem.ensureRoot — register blame roots (Stage 2a PR C) ([#822](https://github.com/nimbus-agent/Nimbus/issues/822)) ([67a9f75](https://github.com/nimbus-agent/Nimbus/commit/67a9f75cd2765c3f3f751b9db90f04f718fa265a))
### Bug Fixes
* **agents:** report why a janitor resourceRef was rejected ([#805](https://github.com/nimbus-agent/Nimbus/issues/805)) ([1b002b5](https://github.com/nimbus-agent/Nimbus/commit/1b002b516180b8ba039a5279d8db50d03e7e9227))
* **ipc:** the connector HITL prompts named params no caller sends ([#811](https://github.com/nimbus-agent/Nimbus/issues/811)) ([cc2b07f](https://github.com/nimbus-agent/Nimbus/commit/cc2b07fb65e49bacc8cc208d8b84986527d2ae65))
* **secrets:** VSCE_PAT deadline is its expiry (2026-09-20), not the decommission ([#803](https://github.com/nimbus-agent/Nimbus/issues/803)) ([bdb79f8](https://github.com/nimbus-agent/Nimbus/commit/bdb79f858de97f7e68d519de62c2c32d496866ff))
## [0.25.0](https://github.com/nimbus-agent/Nimbus/compare/v0.24.0...v0.25.0) (2026-07-22)
### Features
* **gateway:** research briefs — staged HTTP reasoning surface with citation-validated reports ([#799](https://github.com/nimbus-agent/Nimbus/issues/799)) ([f310d2a](https://github.com/nimbus-agent/Nimbus/commit/f310d2a679ca7edc1f73c6abde808acd0c851931))
### Bug Fixes
* clear the SonarCloud board (15), the 6 astro XSS advisories, and the stale release line ([#801](https://github.com/nimbus-agent/Nimbus/issues/801)) ([825df03](https://github.com/nimbus-agent/Nimbus/commit/825df03e6157ebfa2299984115aa68be24539fe1))
## [0.24.0](https://github.com/nimbus-agent/Nimbus/compare/v0.23.2...v0.24.0) (2026-07-22)
### Features
* **apple:** iCloud Mail + Calendar connector (Phase 6 Slice 9-E) ([#711](https://github.com/nimbus-agent/Nimbus/issues/711)) ([58c69e0](https://github.com/nimbus-agent/Nimbus/commit/58c69e09fba285b03b94eed60f69751103da1bf3))
* **audit:** promote D12 to binary; new DB_RUN_EXEC_ALLOW_LIST (T6 PR 4) ([10b9876](https://github.com/nimbus-agent/Nimbus/commit/10b9876a4fbd1e1a4e1c16b7bc0b3c425697a305))
* **auth+connectors:** OAuth provider registry (PR-1) + Tier-1 connector batch + Zoom planning ([#447](https://github.com/nimbus-agent/Nimbus/issues/447)) ([9d71a62](https://github.com/nimbus-agent/Nimbus/commit/9d71a62fa5058475b8482469e82b76b8eb05615c))
* **cli:** add `nimbus --version` / `-v` / `version` ([#753](https://github.com/nimbus-agent/Nimbus/issues/753)) ([5eec16c](https://github.com/nimbus-agent/Nimbus/commit/5eec16c118e94667ddccc0ebb0e122f0bc31f136))
* **client:** add searchRanked to NimbusClient + MockClient ([#742](https://github.com/nimbus-agent/Nimbus/issues/742)) ([a378884](https://github.com/nimbus-agent/Nimbus/commit/a378884360c50b55f1d76bcd61492c1594327b86))
* **client:** expose egress ledger reads on NimbusClient + MockClient ([#751](https://github.com/nimbus-agent/Nimbus/issues/751)) ([31c05b2](https://github.com/nimbus-agent/Nimbus/commit/31c05b25c17b858d14980455ad8800fbfb99e875))
* **cli:** nimbus clip list + clip delete (+ clip-scoped tags) ([#760](https://github.com/nimbus-agent/Nimbus/issues/760)) ([65e8857](https://github.com/nimbus-agent/Nimbus/commit/65e8857a27dff10ac85f9c3e63c2fd2a21628bb2))
* **cli:** nimbus mcp-server — expose local index to editor AIs over MCP ([#480](https://github.com/nimbus-agent/Nimbus/issues/480)) ([003e32d](https://github.com/nimbus-agent/Nimbus/commit/003e32dd0c85ba6224acb27d0fc5f5c2e73e013c))
* **cli:** print the gateway URL from `nimbus clip pair` ([#761](https://github.com/nimbus-agent/Nimbus/issues/761)) ([b72f96d](https://github.com/nimbus-agent/Nimbus/commit/b72f96dcb862f54084927d8542edce9e0e795ad7))
* **clips:** web clipper gateway — POST /v1/clips, pairing auth, invariant I30 (Phase 6 Slice 9) ([#718](https://github.com/nimbus-agent/Nimbus/issues/718)) ([17d325e](https://github.com/nimbus-agent/Nimbus/commit/17d325e7a55729772623438fa4a914c762d810ea))
* **cli:** T6 PR 3 — nimbus index reembed ([46f1e8c](https://github.com/nimbus-agent/Nimbus/commit/46f1e8c4e3cfc2f43d2abe8e2a2b44f60e9d292b))
* **config:** [pagerduty] TOML block — max_pages_per_sync + severity_p1_aliases ([62eeb39](https://github.com/nimbus-agent/Nimbus/commit/62eeb3960dda99955c0a46c51928ae9e79db3a67))
* **config:** add severityP1Aliases field to ServiceConfig ([5dfca63](https://github.com/nimbus-agent/Nimbus/commit/5dfca63e0e6554598957977ed5e4f26ff2939c13))
* **config:** thread [pagerduty].severity_p1_aliases into ServiceConfig ([18e1612](https://github.com/nimbus-agent/Nimbus/commit/18e161291b4bae3acb8ee2e2e83bb7f0967d752a))
* **connectors:** declare permissions.network for all 30 first-party connectors (T2 PR 1) ([9a5bf7a](https://github.com/nimbus-agent/Nimbus/commit/9a5bf7af56ac8cb0e75a8db885c65611cfc42739))
* **connectors:** Mendeley connector (Phase 6 Slice 9 — sub-project A) ([#631](https://github.com/nimbus-agent/Nimbus/issues/631)) ([1ddeae5](https://github.com/nimbus-agent/Nimbus/commit/1ddeae52ca6301d5992a915250a9189b4c61f3a4))
* **connectors:** Phase 6 Slice 7 Wave 7b — team-shared credentials for warehouse/BI connectors ([#617](https://github.com/nimbus-agent/Nimbus/issues/617)) ([e5d1665](https://github.com/nimbus-agent/Nimbus/commit/e5d1665ef7f98203ea9f72bfe28ee2e32e602eeb))
* **connectors:** Phase 6 Slice 7 Wave 7c — HITL-gated WRITE actions for warehouse/BI connectors ([#632](https://github.com/nimbus-agent/Nimbus/issues/632)) ([822cebc](https://github.com/nimbus-agent/Nimbus/commit/822cebc39ad17cd1b6d1605f0a1296ac1d8cb68f))
* **coverage-floor:** baseline format + diff helpers ([2d909cc](https://github.com/nimbus-agent/Nimbus/commit/2d909cc68c56df5322af89c8a3f89a345b070b4c))
* **coverage-floor:** exclusion registry + matcher ([25d7ead](https://github.com/nimbus-agent/Nimbus/commit/25d7eadd035387c6cec081d5ad73a80cab69a668))
* **coverage-floor:** exclusion-parity check ([f2527ef](https://github.com/nimbus-agent/Nimbus/commit/f2527efc5e8edc2b1894c42da04293f1ae907190))
* **coverage-floor:** orchestration entry point ([1e34574](https://github.com/nimbus-agent/Nimbus/commit/1e34574adace51054c99878337148ac4ed6efd6d))
* **coverage-floor:** per-file 80% line-coverage gate (Phase 0) ([5b958d5](https://github.com/nimbus-agent/Nimbus/commit/5b958d56bb1da4b56ab6c7ba4e52581554715a8d))
* **coverage-floor:** pure lcov parser ([f78e592](https://github.com/nimbus-agent/Nimbus/commit/f78e59279fc2c9ad356925d575d70f91524be144))
* **coverage-floor:** scope walker to bun-tested packages; add build-lcov.sh ([6d0dba5](https://github.com/nimbus-agent/Nimbus/commit/6d0dba548deb6136e90e9f636db34c82e3ef81d8))
* **coverage:** branch-coverage foundation (true-coverage Sub-project A) ([#530](https://github.com/nimbus-agent/Nimbus/issues/530)) ([49768bb](https://github.com/nimbus-agent/Nimbus/commit/49768bb99eb074810602da74763b84e7e38d9b09))
* **db:** add dbStmtRun wrapper for prepared-statement writes (T6 PR 4) ([3dfd2ea](https://github.com/nimbus-agent/Nimbus/commit/3dfd2ea81c51f4ee235421f747b6783f1a134763))
* **db:** T6 PR 4 — route all writes through dbRun/dbExec/dbStmtRun (I14) ([639dd64](https://github.com/nimbus-agent/Nimbus/commit/639dd64321aea479e527d48286a2b476a96e30db))
* **db:** widen dbRun to return RunResult (T6 PR 4) ([4511a5b](https://github.com/nimbus-agent/Nimbus/commit/4511a5bd7f81d14f740192589da8d5bf992d6068))
* **diag/cli:** three-surface degraded label for sandbox posture (T2 PR 1) ([c74acbc](https://github.com/nimbus-agent/Nimbus/commit/c74acbc4d80a130069d194ab709b6f8462497262))
* **egress:** Egress Ledger & nimbus prove (S1 Local Brain — I29/D22/V44) ([#698](https://github.com/nimbus-agent/Nimbus/issues/698)) ([34fb594](https://github.com/nimbus-agent/Nimbus/commit/34fb5942fd536981f58405a8e4904529addd40a3))
* **extensions:** hard-disable pre-T2 extensions until reinstall (T2 PR 1) ([2e67dcc](https://github.com/nimbus-agent/Nimbus/commit/2e67dcce686e1c3e1320a6bcfcf225c7b8fdb724))
* **extensions:** object-form permissions schema + legacy array normalizer (T2 PR 1) ([649d573](https://github.com/nimbus-agent/Nimbus/commit/649d5736de026fcbc11cd7095e7436b05d6b6d6c))
* **gateway:** route ask through local LLM providers ([#479](https://github.com/nimbus-agent/Nimbus/issues/479)) ([b49e7ae](https://github.com/nimbus-agent/Nimbus/commit/b49e7aeb8d55d4f98e3a128f089321852d8e5efc))
* **gateway:** wire [pagerduty].max_pages_per_sync at bootstrap ([ca7d65b](https://github.com/nimbus-agent/Nimbus/commit/ca7d65bee2ee6b3b02282186fe4ecdbb592773d9))
* **gateway:** wire Updater factory in assemblePlatformServices (S6-F1) ([5fd38bd](https://github.com/nimbus-agent/Nimbus/commit/5fd38bd73005441e75b02f0a9bff01cef4f36a76))
* **invariants:** wire I14 — typed dbRun/dbExec/dbStmtRun (T6 PR 4) ([eda338e](https://github.com/nimbus-agent/Nimbus/commit/eda338ea50ccae4e66e064a97ccee35ced0eebb7))
* **ipc:** T6 PR 3 — index.reembed long-running RPC ([26c1075](https://github.com/nimbus-agent/Nimbus/commit/26c1075eac8727a6d50ff0df183e79f7a0f9245a))
* **lazy-mesh:** wrap MCP ServerSpec through sandbox-wrapper script (T2 PR 1, I15) ([95b46a0](https://github.com/nimbus-agent/Nimbus/commit/95b46a0ebebde45aa5483f70dbea4d1980533c19))
* **pagerduty:** walk all incident pages per sync ([e4a0720](https://github.com/nimbus-agent/Nimbus/commit/e4a0720d4764111bcb31873782cf18df2b35c82f))
* **pagerduty:** write metadata.urgency on indexed incidents ([596b47a](https://github.com/nimbus-agent/Nimbus/commit/596b47add2799557d93e464bcbb86e154c6b5ab1))
* **perf:** hybrid perf-CI strategy — gate stable surfaces, trend the noisy ones ([#642](https://github.com/nimbus-agent/Nimbus/issues/642)) ([abfdfbe](https://github.com/nimbus-agent/Nimbus/commit/abfdfbe8c76ec59dcd3337317bc0c3241775a2db))
* **perf:** wire up the sustained-drift detector (daily _perf-drift.yml) ([#659](https://github.com/nimbus-agent/Nimbus/issues/659)) ([e433ec7](https://github.com/nimbus-agent/Nimbus/commit/e433ec71c9651f07cb8109e848a97b4923a8d95b))
* Phase 6 Slice 1 — Federation Core ([#519](https://github.com/nimbus-agent/Nimbus/issues/519)) ([bb92960](https://github.com/nimbus-agent/Nimbus/commit/bb92960cb4e29c2290c98821d867566f0de00b03))
* Phase 6 Slice 1 — real two-gateway over-the-wire federation ([#521](https://github.com/nimbus-agent/Nimbus/issues/521)) ([8f61f16](https://github.com/nimbus-agent/Nimbus/commit/8f61f16e2a85fd2c813c61cba3c21be2907440b9))
* Phase 6 Slice 3 — Identity & Access (SSO/OIDC + SCIM) ([#523](https://github.com/nimbus-agent/Nimbus/issues/523)) ([9af95d6](https://github.com/nimbus-agent/Nimbus/commit/9af95d68ce6426984361351fad823c42120bb876))
* **preflight:** urgency-gap diagnostic probe ([80ef006](https://github.com/nimbus-agent/Nimbus/commit/80ef00637bfa36b5cc1540704618daed30c7a378))
* **preflight:** widen active-P1 filter to severity_p1_aliases ([742740d](https://github.com/nimbus-agent/Nimbus/commit/742740db5c8c560ce030a15f4c4f70bc1680cd82))
* **release-health:** loud release-asset gate + weekly secret-health monitor ([#768](https://github.com/nimbus-agent/Nimbus/issues/768)) ([2417189](https://github.com/nimbus-agent/Nimbus/commit/241718962e707e4f236b457dc8bd2ff21a255c4c))
* **sandbox-helper:** enforce-and-exec mode + RFC 1123 + post-unshare seccomp (T2 PR 1) ([c5c7fea](https://github.com/nimbus-agent/Nimbus/commit/c5c7fea29573b480e89c9847acff171126654997))
* **sandbox-helper:** scaffold + --check-caps mode (T2 PR 1) ([80a84d0](https://github.com/nimbus-agent/Nimbus/commit/80a84d0d15ba13ab327d3d7ed22effee393dbc7b))
* **sandbox:** default Linux seccomp BPF filter (T2 PR 1) ([92d821f](https://github.com/nimbus-agent/Nimbus/commit/92d821fc121554cf294baa30338053e228f82eb7))
* **sandbox:** Linux SandboxRunner — bwrap + nimbus-sandbox-helper (T2 PR 1) ([6ea6c6a](https://github.com/nimbus-agent/Nimbus/commit/6ea6c6a6bf7e0b14617f8f38306dce5fda731e6f))
* **sandbox:** macOS SandboxRunner — sandbox-exec with SBPL profile (T2 PR 1) ([be8b001](https://github.com/nimbus-agent/Nimbus/commit/be8b001e7c4a99faf7aacca4fa2d34ac5577885b))
* **sandbox:** SandboxRunner PAL interface + dispatcher (T2 PR 1) ([d4ec092](https://github.com/nimbus-agent/Nimbus/commit/d4ec092388870d2ae096d52fdfffdfaa1f1962fa))
* **sandbox:** T2 PR 1 — Sandbox PAL + 3-OS isolation + I15 ([e668244](https://github.com/nimbus-agent/Nimbus/commit/e668244a42858d810a4e82c777c5d9565ddc3a10))
* **sandbox:** Windows AppContainer orphan-reap helper (T2 PR 1) ([01f16aa](https://github.com/nimbus-agent/Nimbus/commit/01f16aaec89300b53be6c9ca1215d31e3c7e27dd))
* **sandbox:** Windows SandboxRunner — AppContainer profile + capability surface (T2 PR 1) ([1efb7e8](https://github.com/nimbus-agent/Nimbus/commit/1efb7e8d1cbc4e5842b52d9bf4393c55cf7acd84))
* **sdk:** runSandboxContractTests + probe (T2 PR 1) ([633b464](https://github.com/nimbus-agent/Nimbus/commit/633b464336aa8196550d8db9748858317bb385dd))
* **search:** T6 PR 3 — wire dual-search through hybrid options ([4570841](https://github.com/nimbus-agent/Nimbus/commit/4570841d5b1f2607203ae8286e5c5be6fac9e3e2))
* **share:** Phase 6 Slice 8a — Share foundation (I27 share-gate, verify-share, V41) ([#661](https://github.com/nimbus-agent/Nimbus/issues/661)) ([c4f12d3](https://github.com/nimbus-agent/Nimbus/commit/c4f12d382be6e8601858605089b664f7c5604e0c))
* **share:** Phase 6 Slice 8b — recipe (--as-recipe declarative DAG, V42 params) ([#679](https://github.com/nimbus-agent/Nimbus/issues/679)) ([97573bd](https://github.com/nimbus-agent/Nimbus/commit/97573bdc2423d8687a974ccc08ad4d5f26da15df))
* **share:** Phase 6 Slice 8c — replay (verify-share --replay, recipe-runner) ([#684](https://github.com/nimbus-agent/Nimbus/issues/684)) ([8535f4d](https://github.com/nimbus-agent/Nimbus/commit/8535f4db75a68806806813131e7fb0a34327fba7))
* **share:** Phase 6 Slice 8d — sovereign-mesh referral (forwarding, provenance, V43 inbox) ([#687](https://github.com/nimbus-agent/Nimbus/issues/687)) ([18131cf](https://github.com/nimbus-agent/Nimbus/commit/18131cf9d9499614d20b10421e5c511086942618))
* **slice9-w1:** HITL-gated GitOps + ML writes (ArgoCD/Flux/MLflow), generalize I26 ([#700](https://github.com/nimbus-agent/Nimbus/issues/700)) ([bccab8b](https://github.com/nimbus-agent/Nimbus/commit/bccab8bf9e8f34fabed47afff3619bf6dc6802ff))
* **slice9:** Workday connector (read-only) — workers/time-off/job-postings + RaaS reports ([#709](https://github.com/nimbus-agent/Nimbus/issues/709)) ([2646918](https://github.com/nimbus-agent/Nimbus/commit/2646918570aaa52e1477765fe169df3433bdba25))
* tool_call_log retention policy ([audit].tool_call_log_retention_days) ([#511](https://github.com/nimbus-agent/Nimbus/issues/511)) ([83165b1](https://github.com/nimbus-agent/Nimbus/commit/83165b1764faf08ab1066abaea143a0ceba3b3b3))
* **updater:** createUpdaterFromConfig factory with disabled + unsupported-platform paths ([423fe23](https://github.com/nimbus-agent/Nimbus/commit/423fe23677615f8153ca1bd9106c4230edde7a5b))
* **updater:** S6-F1 production wiring ([a1c69b9](https://github.com/nimbus-agent/Nimbus/commit/a1c69b9e46d9fc0ec6c3a570b695b8f7ff53b06f))
* **zoom:** PR-3 cloud recordings + AI transcripts (Walk B) ([#458](https://github.com/nimbus-agent/Nimbus/issues/458)) ([21aefdd](https://github.com/nimbus-agent/Nimbus/commit/21aefdd96f8f4e6bcefa730f7f4c7d97d3ef58d8))
### Bug Fixes
* add repository field to client, sdk, and root for npm provenance ([#633](https://github.com/nimbus-agent/Nimbus/issues/633)) ([f0e7f07](https://github.com/nimbus-agent/Nimbus/commit/f0e7f075d755c8b4a006911b513979f289fa192f))
* **audit:** close credential-redaction boundary escapes + property lock (True Coverage C1) ([#596](https://github.com/nimbus-agent/Nimbus/issues/596)) ([f974c02](https://github.com/nimbus-agent/Nimbus/commit/f974c02a33b3e29ada53319c1db36643588a5188))
* **ci:** build @nimbus-dev/sdk before client in node-compat job ([#640](https://github.com/nimbus-agent/Nimbus/issues/640)) ([76b9898](https://github.com/nimbus-agent/Nimbus/commit/76b98988821e11bc279f9dea8bf6ad76d99582f6))
* **ci:** export GNUPGHOME in linux-repo publish so signing finds the key ([#605](https://github.com/nimbus-agent/Nimbus/issues/605)) ([e5f5154](https://github.com/nimbus-agent/Nimbus/commit/e5f515460d95a47e237086967e5876d22ef77525))
* **ci:** gitleaks allowlist synthetic TestFlight PEM fixture ([#670](https://github.com/nimbus-agent/Nimbus/issues/670)) ([3da4609](https://github.com/nimbus-agent/Nimbus/commit/3da460991b487b68fad2ea1febc9c32a148db807))
* **ci:** guard gateway daily-log async destination against unhandled flush errors ([#615](https://github.com/nimbus-agent/Nimbus/issues/615)) ([7a9f62c](https://github.com/nimbus-agent/Nimbus/commit/7a9f62cf733ae965e88a6614c2516990fd90de45))
* **ci:** harden Linux apt-get against flaky Microsoft repos + integration-test timeout ([#613](https://github.com/nimbus-agent/Nimbus/issues/613)) ([209fc96](https://github.com/nimbus-agent/Nimbus/commit/209fc966b8a86286f9535a8134b6238d16d1f313))
* **ci:** linux-repo publish verifies only the downloaded .deb/.rpm ([#603](https://github.com/nimbus-agent/Nimbus/issues/603)) ([4d63cad](https://github.com/nimbus-agent/Nimbus/commit/4d63cada3a55d1e3bdeb2f3c1c7e434a05457f3c))
* **ci:** publish package managers after Release uploads assets (kill the asset-race) ([#658](https://github.com/nimbus-agent/Nimbus/issues/658)) ([f5f246f](https://github.com/nimbus-agent/Nimbus/commit/f5f246fb9713a023ef8c1eaf8f09ffbac6804b80))
* **ci:** restore lint + license gates after Biome 2.5.0 / ovsx 1.0.1 bumps ([#656](https://github.com/nimbus-agent/Nimbus/issues/656)) ([76e4a88](https://github.com/nimbus-agent/Nimbus/commit/76e4a88999ddef1915b6e6c74b3c705281edf891))
* **ci:** session-memory getRecentTurns must not require sqlite-vec (share e2e I27) ([#664](https://github.com/nimbus-agent/Nimbus/issues/664)) ([0870362](https://github.com/nimbus-agent/Nimbus/commit/0870362301fecd1c6742c799ece667edf1d8f671))
* **ci:** set --timeout 60000 on the integration test step ([#610](https://github.com/nimbus-agent/Nimbus/issues/610)) ([69986c1](https://github.com/nimbus-agent/Nimbus/commit/69986c1a5eeb2b1cba00f97b3f243912d92f100f))
* **ci:** unblock cross-platform test suite + SonarCloud reliability gate ([c75dbab](https://github.com/nimbus-agent/Nimbus/commit/c75dbab037d98b9c51df38b0ea7769089c52418a))
* **ci:** unhang the Windows gateway cross-platform leg (was 30-min "cancelled") ([#591](https://github.com/nimbus-agent/Nimbus/issues/591)) ([605e46a](https://github.com/nimbus-agent/Nimbus/commit/605e46ac2a5716b7213dc4d588e623ea7729a331))
* **client:** bundle sdk via the "bun" condition so the publish build resolves ([#638](https://github.com/nimbus-agent/Nimbus/issues/638)) ([c1f36d2](https://github.com/nimbus-agent/Nimbus/commit/c1f36d2e1cee0f02430aab5f48e517a9882ccf4d))
* **client:** pin internal deps on publish so the tarball installs standalone ([#716](https://github.com/nimbus-agent/Nimbus/issues/716)) ([1ab1b5c](https://github.com/nimbus-agent/Nimbus/commit/1ab1b5c7912948394c51142519b0d2698447caf6))
* **client:** widen node-compat askStream streamId poll to STREAM_TIMEOUT_MS ([#624](https://github.com/nimbus-agent/Nimbus/issues/624)) ([e86014f](https://github.com/nimbus-agent/Nimbus/commit/e86014f3ae3b2a865a0e589eda2eb997b33ca727))
* **cli:** T6 PR 3 — drop the word "any" from index reembed help ([676cbd2](https://github.com/nimbus-agent/Nimbus/commit/676cbd219f797bfd00851b3cbaf861a1ca7a6e0c))
* **coverage-floor:** computeUpdatedBaseline seeds new below-floor entries ([2ba425a](https://github.com/nimbus-agent/Nimbus/commit/2ba425accbcc19e2ebf38938180ea027d4ed5af0))
* **coverage-floor:** drop unused [@ts-expect-error](https://github.com/ts-expect-error) in freeze test ([bc26019](https://github.com/nimbus-agent/Nimbus/commit/bc26019dfa7ded9a1de2368f887b816309ccdb45))
* **coverage-floor:** rename unused find() param to satisfy biome ([b63c40d](https://github.com/nimbus-agent/Nimbus/commit/b63c40dae65f2e664c11e38705f6958e9aa73a44))
* **coverage-floor:** Sonar new-code coverage — mirror local exemptions + lift sandbox-contract (PR [#329](https://github.com/nimbus-agent/Nimbus/issues/329)) ([51b101e](https://github.com/nimbus-agent/Nimbus/commit/51b101e0c9c20462bbd7005bb863efe546647bb6))
* **db:** enable WAL on production SQLite handles (changelog backfill for [#789](https://github.com/nimbus-agent/Nimbus/issues/789)) ([#795](https://github.com/nimbus-agent/Nimbus/issues/795)) ([88db17f](https://github.com/nimbus-agent/Nimbus/commit/88db17f708798a03a704ac37c410bb3105409364))
* **db:** T6 PR 3 — guard V30 no-vec branch against db.exec("") on macOS ([4130138](https://github.com/nimbus-agent/Nimbus/commit/4130138fedc9f06294aa88d8972ce7dcfd5fddf5))
* **deps:** clear high audit advisories (vite/protobufjs/form-data) ([#644](https://github.com/nimbus-agent/Nimbus/issues/644)) ([24169d9](https://github.com/nimbus-agent/Nimbus/commit/24169d9928b9317bd0ed19982eaad9f0b2e5e925))
* **deps:** clear the critical + high advisories blocking every PR ([#781](https://github.com/nimbus-agent/Nimbus/issues/781)) ([4d723b8](https://github.com/nimbus-agent/Nimbus/commit/4d723b80bad63d96016f5aeb379b465844f82f5e))
* **deps:** clear two high advisories blocking every PR ([#793](https://github.com/nimbus-agent/Nimbus/issues/793)) ([40007eb](https://github.com/nimbus-agent/Nimbus/commit/40007ebbfc5aa5abd06e3b3345782c72f85b18fd))
* **deps:** clear two high advisories blocking every PR (sharp, svgo) ([#796](https://github.com/nimbus-agent/Nimbus/issues/796)) ([864bb8e](https://github.com/nimbus-agent/Nimbus/commit/864bb8e0eb626725ee0c917acd7b49026f12336a))
* **extensions:** locale-aware sort in PreT2DisabledRegistry + new-code coverage push (PR [#329](https://github.com/nimbus-agent/Nimbus/issues/329)) ([afdc62e](https://github.com/nimbus-agent/Nimbus/commit/afdc62e8e8bb12d38567724a0a6393c25f8db1c6))
* **extensions:** reject trailing-hyphen + empty hostnames per RFC 1123 (T2 PR 1 code review) ([c5966b3](https://github.com/nimbus-agent/Nimbus/commit/c5966b3be793331de61c2d5cd6da060c68d3b401))
* **gateway:** report real version in `nimbus status` + stamp Windows exe metadata ([#762](https://github.com/nimbus-agent/Nimbus/issues/762)) ([d337167](https://github.com/nimbus-agent/Nimbus/commit/d337167e6e461645526525167ed6acf77396f4e2))
* **gitleaks:** rename fake API-key fixtures to defuse generic-api-key rule ([fddf720](https://github.com/nimbus-agent/Nimbus/commit/fddf7209f7064cbd8aed8b9982a27f5ad3c8363d))
* **llm:** report fallback provider in `llm status`, fix reason labels, reuse IPC helper ([#513](https://github.com/nimbus-agent/Nimbus/issues/513)) ([4bfb99a](https://github.com/nimbus-agent/Nimbus/commit/4bfb99ac019ca71f013f81ae6fb5f9e813e1c475))
* **perf:** gate S1 + S11-b latency on Linux only to stop main bench delta-flapping ([#623](https://github.com/nimbus-agent/Nimbus/issues/623)) ([52eff98](https://github.com/nimbus-agent/Nimbus/commit/52eff98bfe540d1edbb72de78db1e51487697df6))
* **perf:** gate S11-a latency on Linux only (completes the spawn-jitter set) ([#628](https://github.com/nimbus-agent/Nimbus/issues/628)) ([f107082](https://github.com/nimbus-agent/Nimbus/commit/f107082655a3f031776b7717d8509328d24111b3))
* **perf:** median baseline over recent main runs to stop bench delta-flapping ([#618](https://github.com/nimbus-agent/Nimbus/issues/618)) ([e6c34c2](https://github.com/nimbus-agent/Nimbus/commit/e6c34c2023b9e31f74d0bc1e98a9bd6aee4eef8c))
* **sandbox-helper:** freeaddrinfo leak on inet_ntop error + AUDIT_ARCH_X86_64 seccomp guard (T2 PR 1 code review) ([f8c91a2](https://github.com/nimbus-agent/Nimbus/commit/f8c91a298d84130511400c7216ea11d60d73616a))
* **sandbox-helper:** guard _GNU_SOURCE redefine to unblock -Werror build ([#346](https://github.com/nimbus-agent/Nimbus/issues/346)) ([6f0e231](https://github.com/nimbus-agent/Nimbus/commit/6f0e231ea39052fc28b28638525442f2dc11a478))
* **sandbox:** allow epoll_wait + clone3, block io_uring (T2 PR 1 code review) ([dc63c7c](https://github.com/nimbus-agent/Nimbus/commit/dc63c7c1122fbcf5640ecc1e3c9a79961bb9ea78))
* **sandbox:** AUDIT_ARCH_X86_64 guard in connector seccomp filter (T2 PR 1 review) ([20fb86c](https://github.com/nimbus-agent/Nimbus/commit/20fb86c6a4ff0bde9c00409bac69366ed71c3c8e))
* **sandbox:** match platform/index.ts dispatcher idiom — node:os + .ts extensions (T2 PR 1 code review) ([cd9886d](https://github.com/nimbus-agent/Nimbus/commit/cd9886da39224528b8a51d227aa4aa40ac8c734f))
* **sandbox:** mkdtempSync for seccomp BPF tmpfile (CodeQL js/insecure-temporary-file) ([7804539](https://github.com/nimbus-agent/Nimbus/commit/78045391701e8738fdcb180e0b398aa0eed68303))
* **sdk:** drop .ts extension on testing/index re-export (T2 PR 1 CI) ([51b218c](https://github.com/nimbus-agent/Nimbus/commit/51b218c981fec8189829fca29181c6fc0d729a30))
* **sdk:** point published entry points at dist so the package is usable ([#637](https://github.com/nimbus-agent/Nimbus/issues/637)) ([155b127](https://github.com/nimbus-agent/Nimbus/commit/155b127f9577d8f19a4e822ba5ee3714b2a5badd))
* **security:** connector nextLink SSRF + email header CR/LF injection hardening ([#694](https://github.com/nimbus-agent/Nimbus/issues/694)) ([6257da8](https://github.com/nimbus-agent/Nimbus/commit/6257da812df50705eaf62ba78d4fb20fa4693df0))
* **security:** T6 PR 3 — block index.reembed* over LAN (I5) ([4f0d6c4](https://github.com/nimbus-agent/Nimbus/commit/4f0d6c4946e058c3ab14ac4b206504a519bbdef1))
* **sonar:** clear last 2 S7735 negated-condition smells ([#683](https://github.com/nimbus-agent/Nimbus/issues/683)) ([e6cbfff](https://github.com/nimbus-agent/Nimbus/commit/e6cbfff9b4fdb173b3f650e8f1f98c494b985c43))
* **sonar:** clear the board — S3776/S8786/S7735 sweep + warehouse-mapper dedup ([#743](https://github.com/nimbus-agent/Nimbus/issues/743)) ([2401330](https://github.com/nimbus-agent/Nimbus/commit/2401330932fa941bdf584c87bca88ea69167fa0c))
* **sonar:** clear the SonarCloud board — S5906 sweep + long-tail code smells ([#731](https://github.com/nimbus-agent/Nimbus/issues/731)) ([3a87e54](https://github.com/nimbus-agent/Nimbus/commit/3a87e54a7335c1be87ecb582673183b242b97c88))
* stop relabelling 55% of indexed items, and return NimbusItem from index.queryItems ([#780](https://github.com/nimbus-agent/Nimbus/issues/780)) ([008615d](https://github.com/nimbus-agent/Nimbus/commit/008615da3ba74fec7aabf935abc57b7eabda90bb))
* **test:** add --timeout 30000 to all coverage shards (Windows flake) ([#681](https://github.com/nimbus-agent/Nimbus/issues/681)) ([93270ca](https://github.com/nimbus-agent/Nimbus/commit/93270cad4eae8c14330ca67c09947d692ecc18e8))
* **test:** remove real-resolver connector-spawns twin that reds the combined run ([#675](https://github.com/nimbus-agent/Nimbus/issues/675)) ([fde6718](https://github.com/nimbus-agent/Nimbus/commit/fde67189a6bca3e2289f522eb981d1560d5de768))
* **test:** resolve LanServer gate test flake ([#705](https://github.com/nimbus-agent/Nimbus/issues/705)) ([2e757e8](https://github.com/nimbus-agent/Nimbus/commit/2e757e8143045963ba7c78cb58bcb4806071fdd9))
* **vscode-extension:** scope tsconfig to types:[node] (fixes CI typecheck) ([#446](https://github.com/nimbus-agent/Nimbus/issues/446)) ([78484a6](https://github.com/nimbus-agent/Nimbus/commit/78484a6e67bef930040afd4cc5b69d5f153aae0c))
### Performance Improvements
* Phase 2 (Bencher) — advisory trend ingest (soak alongside github-action-benchmark) ([#666](https://github.com/nimbus-agent/Nimbus/issues/666)) ([5993765](https://github.com/nimbus-agent/Nimbus/commit/5993765bb97b1058676e7ecde34b112d4ed33c87))
* **slo:** widen S1 noise floor 200→300 ms to absorb cold-start jitter ([#608](https://github.com/nimbus-agent/Nimbus/issues/608)) ([b49c799](https://github.com/nimbus-agent/Nimbus/commit/b49c799af4e59ea93b2fff71d3eae2cb7c2e9caf))
## [0.23.2](https://github.com/nimbus-agent/Nimbus/compare/v0.23.1...v0.23.2) (2026-07-21)
### Bug Fixes
* **deps:** clear two high advisories blocking every PR ([#793](https://github.com/nimbus-agent/Nimbus/issues/793)) ([40007eb](https://github.com/nimbus-agent/Nimbus/commit/40007ebbfc5aa5abd06e3b3345782c72f85b18fd))
## [0.23.1](https://github.com/nimbus-agent/Nimbus/compare/v0.23.0...v0.23.1) (2026-07-21)
### Bug Fixes
* **deps:** clear the critical + high advisories blocking every PR ([#781](https://github.com/nimbus-agent/Nimbus/issues/781)) ([4d723b8](https://github.com/nimbus-agent/Nimbus/commit/4d723b80bad63d96016f5aeb379b465844f82f5e))
* stop relabelling 55% of indexed items, and return NimbusItem from index.queryItems ([#780](https://github.com/nimbus-agent/Nimbus/issues/780)) ([008615d](https://github.com/nimbus-agent/Nimbus/commit/008615da3ba74fec7aabf935abc57b7eabda90bb))
## [0.23.0](https://github.com/nimbus-agent/Nimbus/compare/v0.22.0...v0.23.0) (2026-07-19)
### Features
* **release-health:** loud release-asset gate + weekly secret-health monitor ([#768](https://github.com/nimbus-agent/Nimbus/issues/768)) ([2417189](https://github.com/nimbus-agent/Nimbus/commit/241718962e707e4f236b457dc8bd2ff21a255c4c))
## [0.22.0](https://github.com/nimbus-agent/Nimbus/compare/v0.21.0...v0.22.0) (2026-07-18)
### Features
* **cli:** nimbus clip list + clip delete (+ clip-scoped tags) ([#760](https://github.com/nimbus-agent/Nimbus/issues/760)) ([65e8857](https://github.com/nimbus-agent/Nimbus/commit/65e8857a27dff10ac85f9c3e63c2fd2a21628bb2))
* **cli:** print the gateway URL from `nimbus clip pair` ([#761](https://github.com/nimbus-agent/Nimbus/issues/761)) ([b72f96d](https://github.com/nimbus-agent/Nimbus/commit/b72f96dcb862f54084927d8542edce9e0e795ad7))
### Bug Fixes
* **gateway:** report real version in `nimbus status` + stamp Windows exe metadata ([#762](https://github.com/nimbus-agent/Nimbus/issues/762)) ([d337167](https://github.com/nimbus-agent/Nimbus/commit/d337167e6e461645526525167ed6acf77396f4e2))
## [0.21.0](https://github.com/nimbus-agent/Nimbus/compare/v0.20.0...v0.21.0) (2026-07-16)
### Features
* **cli:** add `nimbus --version` / `-v` / `version` ([#753](https://github.com/nimbus-agent/Nimbus/issues/753)) ([5eec16c](https://github.com/nimbus-agent/Nimbus/commit/5eec16c118e94667ddccc0ebb0e122f0bc31f136))
## [0.20.0](https://github.com/nimbus-agent/Nimbus/compare/v0.19.0...v0.20.0) (2026-07-14)
### Features
* **client:** expose egress ledger reads on NimbusClient + MockClient ([#751](https://github.com/nimbus-agent/Nimbus/issues/751)) ([31c05b2](https://github.com/nimbus-agent/Nimbus/commit/31c05b25c17b858d14980455ad8800fbfb99e875))
## [0.19.0](https://github.com/nimbus-agent/Nimbus/compare/v0.18.0...v0.19.0) (2026-06-23)
### Features
* **client:** add searchRanked to NimbusClient + MockClient ([#742](https://github.com/nimbus-agent/Nimbus/issues/742)) ([a378884](https://github.com/nimbus-agent/Nimbus/commit/a378884360c50b55f1d76bcd61492c1594327b86))
### Bug Fixes
* **sonar:** clear the board — S3776/S8786/S7735 sweep + warehouse-mapper dedup ([#743](https://github.com/nimbus-agent/Nimbus/issues/743)) ([2401330](https://github.com/nimbus-agent/Nimbus/commit/2401330932fa941bdf584c87bca88ea69167fa0c))
* **sonar:** clear the SonarCloud board — S5906 sweep + long-tail code smells ([#731](https://github.com/nimbus-agent/Nimbus/issues/731)) ([3a87e54](https://github.com/nimbus-agent/Nimbus/commit/3a87e54a7335c1be87ecb582673183b242b97c88))
## [0.18.0](https://github.com/nimbus-agent/Nimbus/compare/v0.17.0...v0.18.0) (2026-06-23)
### Features
* **clips:** web clipper gateway — POST /v1/clips, pairing auth, invariant I30 (Phase 6 Slice 9) ([#718](https://github.com/nimbus-agent/Nimbus/issues/718)) ([17d325e](https://github.com/nimbus-agent/Nimbus/commit/17d325e7a55729772623438fa4a914c762d810ea))
## [0.17.0](https://github.com/nimbus-agent/Nimbus/compare/v0.16.0...v0.17.0) (2026-06-22)
### Features
* **apple:** iCloud Mail + Calendar connector (Phase 6 Slice 9-E) ([#711](https://github.com/nimbus-agent/Nimbus/issues/711)) ([58c69e0](https://github.com/nimbus-agent/Nimbus/commit/58c69e09fba285b03b94eed60f69751103da1bf3))
### Bug Fixes
* **client:** pin internal deps on publish so the tarball installs standalone ([#716](https://github.com/nimbus-agent/Nimbus/issues/716)) ([1ab1b5c](https://github.com/nimbus-agent/Nimbus/commit/1ab1b5c7912948394c51142519b0d2698447caf6))
## [0.16.0](https://github.com/nimbus-agent/Nimbus/compare/v0.15.0...v0.16.0) (2026-06-21)
### Features
* **slice9:** Workday connector (read-only) — workers/time-off/job-postings + RaaS reports ([#709](https://github.com/nimbus-agent/Nimbus/issues/709)) ([2646918](https://github.com/nimbus-agent/Nimbus/commit/2646918570aaa52e1477765fe169df3433bdba25))
## [0.15.0](https://github.com/nimbus-agent/Nimbus/compare/v0.14.0...v0.15.0) (2026-06-21)
### Features
* **slice9-w1:** HITL-gated GitOps + ML writes (ArgoCD/Flux/MLflow), generalize I26 ([#700](https://github.com/nimbus-agent/Nimbus/issues/700)) ([bccab8b](https://github.com/nimbus-agent/Nimbus/commit/bccab8bf9e8f34fabed47afff3619bf6dc6802ff))
### Bug Fixes
* **test:** resolve LanServer gate test flake ([#705](https://github.com/nimbus-agent/Nimbus/issues/705)) ([2e757e8](https://github.com/nimbus-agent/Nimbus/commit/2e757e8143045963ba7c78cb58bcb4806071fdd9))
## [0.14.0](https://github.com/nimbus-agent/Nimbus/compare/v0.13.1...v0.14.0) (2026-06-21)
### Features
* **egress:** Egress Ledger & nimbus prove (S1 Local Brain — I29/D22/V44) ([#698](https://github.com/nimbus-agent/Nimbus/issues/698)) ([34fb594](https://github.com/nimbus-agent/Nimbus/commit/34fb5942fd536981f58405a8e4904529addd40a3))
## [0.13.1](https://github.com/nimbus-agent/Nimbus/compare/v0.13.0...v0.13.1) (2026-06-20)
### Bug Fixes
* **security:** connector nextLink SSRF + email header CR/LF injection hardening ([#694](https://github.com/nimbus-agent/Nimbus/issues/694)) ([6257da8](https://github.com/nimbus-agent/Nimbus/commit/6257da812df50705eaf62ba78d4fb20fa4693df0))
## [0.13.0](https://github.com/nimbus-agent/Nimbus/compare/v0.12.0...v0.13.0) (2026-06-18)
### Features
* **share:** Phase 6 Slice 8d — sovereign-mesh referral (forwarding, provenance, V43 inbox) ([#687](https://github.com/nimbus-agent/Nimbus/issues/687)) ([18131cf](https://github.com/nimbus-agent/Nimbus/commit/18131cf9d9499614d20b10421e5c511086942618))
## [0.12.0](https://github.com/nimbus-agent/Nimbus/compare/v0.11.2...v0.12.0) (2026-06-17)
### Features
* **share:** Phase 6 Slice 8b — recipe (--as-recipe declarative DAG, V42 params) ([#679](https://github.com/nimbus-agent/Nimbus/issues/679)) ([97573bd](https://github.com/nimbus-agent/Nimbus/commit/97573bdc2423d8687a974ccc08ad4d5f26da15df))
* **share:** Phase 6 Slice 8c — replay (verify-share --replay, recipe-runner) ([#684](https://github.com/nimbus-agent/Nimbus/issues/684)) ([8535f4d](https://github.com/nimbus-agent/Nimbus/commit/8535f4db75a68806806813131e7fb0a34327fba7))
### Bug Fixes
* **sonar:** clear last 2 S7735 negated-condition smells ([#683](https://github.com/nimbus-agent/Nimbus/issues/683)) ([e6cbfff](https://github.com/nimbus-agent/Nimbus/commit/e6cbfff9b4fdb173b3f650e8f1f98c494b985c43))
* **test:** add --timeout 30000 to all coverage shards (Windows flake) ([#681](https://github.com/nimbus-agent/Nimbus/issues/681)) ([93270ca](https://github.com/nimbus-agent/Nimbus/commit/93270cad4eae8c14330ca67c09947d692ecc18e8))
## [0.11.2](https://github.com/nimbus-agent/Nimbus/compare/v0.11.1...v0.11.2) (2026-06-17)
### Bug Fixes
* **test:** remove real-resolver connector-spawns twin that reds the combined run ([#675](https://github.com/nimbus-agent/Nimbus/issues/675)) ([fde6718](https://github.com/nimbus-agent/Nimbus/commit/fde67189a6bca3e2289f522eb981d1560d5de768))
## [0.11.1](https://github.com/nimbus-agent/Nimbus/compare/v0.11.0...v0.11.1) (2026-06-17)
### Bug Fixes
* **ci:** gitleaks allowlist synthetic TestFlight PEM fixture ([#670](https://github.com/nimbus-agent/Nimbus/issues/670)) ([3da4609](https://github.com/nimbus-agent/Nimbus/commit/3da460991b487b68fad2ea1febc9c32a148db807))
## [0.11.0](https://github.com/nimbus-agent/Nimbus/compare/v0.10.0...v0.11.0) (2026-06-16)
### Features
* **share:** Phase 6 Slice 8a — Share foundation (I27 share-gate, verify-share, V41) ([#661](https://github.com/nimbus-agent/Nimbus/issues/661)) ([c4f12d3](https://github.com/nimbus-agent/Nimbus/commit/c4f12d382be6e8601858605089b664f7c5604e0c))
### Bug Fixes
* **ci:** session-memory getRecentTurns must not require sqlite-vec (share e2e I27) ([#664](https://github.com/nimbus-agent/Nimbus/issues/664)) ([0870362](https://github.com/nimbus-agent/Nimbus/commit/0870362301fecd1c6742c799ece667edf1d8f671))
### Performance Improvements
* Phase 2 (Bencher) — advisory trend ingest (soak alongside github-action-benchmark) ([#666](https://github.com/nimbus-agent/Nimbus/issues/666)) ([5993765](https://github.com/nimbus-agent/Nimbus/commit/5993765bb97b1058676e7ecde34b112d4ed33c87))
## [0.10.0](https://github.com/nimbus-agent/Nimbus/compare/v0.9.1...v0.10.0) (2026-06-16)
### Features
* **perf:** wire up the sustained-drift detector (daily _perf-drift.yml) ([#659](https://github.com/nimbus-agent/Nimbus/issues/659)) ([e433ec7](https://github.com/nimbus-agent/Nimbus/commit/e433ec71c9651f07cb8109e848a97b4923a8d95b))
### Bug Fixes
* **ci:** publish package managers after Release uploads assets (kill the asset-race) ([#658](https://github.com/nimbus-agent/Nimbus/issues/658)) ([f5f246f](https://github.com/nimbus-agent/Nimbus/commit/f5f246fb9713a023ef8c1eaf8f09ffbac6804b80))
## [0.9.1](https://github.com/nimbus-agent/Nimbus/compare/v0.9.0...v0.9.1) (2026-06-16)
### Bug Fixes
* **ci:** restore lint + license gates after Biome 2.5.0 / ovsx 1.0.1 bumps ([#656](https://github.com/nimbus-agent/Nimbus/issues/656)) ([76e4a88](https://github.com/nimbus-agent/Nimbus/commit/76e4a88999ddef1915b6e6c74b3c705281edf891))
## [0.9.0](https://github.com/nimbus-agent/Nimbus/compare/v0.8.0...v0.9.0) (2026-06-15)
### Features
* **perf:** hybrid perf-CI strategy — gate stable surfaces, trend the noisy ones ([#642](https://github.com/nimbus-agent/Nimbus/issues/642)) ([abfdfbe](https://github.com/nimbus-agent/Nimbus/commit/abfdfbe8c76ec59dcd3337317bc0c3241775a2db))
### Bug Fixes
* **deps:** clear high audit advisories (vite/protobufjs/form-data) ([#644](https://github.com/nimbus-agent/Nimbus/issues/644)) ([24169d9](https://github.com/nimbus-agent/Nimbus/commit/24169d9928b9317bd0ed19982eaad9f0b2e5e925))
## [0.8.0](https://github.com/nimbus-agent/Nimbus/compare/v0.7.0...v0.8.0) (2026-06-15)
### Features
* **connectors:** Mendeley connector (Phase 6 Slice 9 — sub-project A) ([#631](https://github.com/nimbus-agent/Nimbus/issues/631)) ([1ddeae5](https://github.com/nimbus-agent/Nimbus/commit/1ddeae52ca6301d5992a915250a9189b4c61f3a4))
* **connectors:** Phase 6 Slice 7 Wave 7c — HITL-gated WRITE actions for warehouse/BI connectors ([#632](https://github.com/nimbus-agent/Nimbus/issues/632)) ([822cebc](https://github.com/nimbus-agent/Nimbus/commit/822cebc39ad17cd1b6d1605f0a1296ac1d8cb68f))
### Bug Fixes
* add repository field to client, sdk, and root for npm provenance ([#633](https://github.com/nimbus-agent/Nimbus/issues/633)) ([f0e7f07](https://github.com/nimbus-agent/Nimbus/commit/f0e7f075d755c8b4a006911b513979f289fa192f))
* **ci:** build @nimbus-dev/sdk before client in node-compat job ([#640](https://github.com/nimbus-agent/Nimbus/issues/640)) ([76b9898](https://github.com/nimbus-agent/Nimbus/commit/76b98988821e11bc279f9dea8bf6ad76d99582f6))
* **client:** bundle sdk via the "bun" condition so the publish build resolves ([#638](https://github.com/nimbus-agent/Nimbus/issues/638)) ([c1f36d2](https://github.com/nimbus-agent/Nimbus/commit/c1f36d2e1cee0f02430aab5f48e517a9882ccf4d))
* **perf:** gate S11-a latency on Linux only (completes the spawn-jitter set) ([#628](https://github.com/nimbus-agent/Nimbus/issues/628)) ([f107082](https://github.com/nimbus-agent/Nimbus/commit/f107082655a3f031776b7717d8509328d24111b3))
* **sdk:** point published entry points at dist so the package is usable ([#637](https://github.com/nimbus-agent/Nimbus/issues/637)) ([155b127](https://github.com/nimbus-agent/Nimbus/commit/155b127f9577d8f19a4e822ba5ee3714b2a5badd))
## [0.7.0](https://github.com/nimbus-agent/Nimbus/compare/v0.6.3...v0.7.0) (2026-06-14)
### Features
* **connectors:** Phase 6 Slice 7 Wave 7b — team-shared credentials for warehouse/BI connectors ([#617](https://github.com/nimbus-agent/Nimbus/issues/617)) ([e5d1665](https://github.com/nimbus-agent/Nimbus/commit/e5d1665ef7f98203ea9f72bfe28ee2e32e602eeb))
### Bug Fixes
* **perf:** median baseline over recent main runs to stop bench delta-flapping ([#618](https://github.com/nimbus-agent/Nimbus/issues/618)) ([e6c34c2](https://github.com/nimbus-agent/Nimbus/commit/e6c34c2023b9e31f74d0bc1e98a9bd6aee4eef8c))
## [0.6.3](https://github.com/nimbus-agent/Nimbus/compare/v0.6.2...v0.6.3) (2026-06-14)
### Bug Fixes
* **ci:** guard gateway daily-log async destination against unhandled flush errors ([#615](https://github.com/nimbus-agent/Nimbus/issues/615)) ([7a9f62c](https://github.com/nimbus-agent/Nimbus/commit/7a9f62cf733ae965e88a6614c2516990fd90de45))
* **ci:** harden Linux apt-get against flaky Microsoft repos + integration-test timeout ([#613](https://github.com/nimbus-agent/Nimbus/issues/613)) ([209fc96](https://github.com/nimbus-agent/Nimbus/commit/209fc966b8a86286f9535a8134b6238d16d1f313))
* **ci:** set --timeout 60000 on the integration test step ([#610](https://github.com/nimbus-agent/Nimbus/issues/610)) ([69986c1](https://github.com/nimbus-agent/Nimbus/commit/69986c1a5eeb2b1cba00f97b3f243912d92f100f))
### Performance Improvements
* **slo:** widen S1 noise floor 200→300 ms to absorb cold-start jitter ([#608](https://github.com/nimbus-agent/Nimbus/issues/608)) ([b49c799](https://github.com/nimbus-agent/Nimbus/commit/b49c799af4e59ea93b2fff71d3eae2cb7c2e9caf))
## [0.6.2](https://github.com/nimbus-agent/Nimbus/compare/v0.6.1...v0.6.2) (2026-06-14)
### Bug Fixes
* **ci:** export GNUPGHOME in linux-repo publish so signing finds the key ([#605](https://github.com/nimbus-agent/Nimbus/issues/605)) ([e5f5154](https://github.com/nimbus-agent/Nimbus/commit/e5f515460d95a47e237086967e5876d22ef77525))
* **ci:** linux-repo publish verifies only the downloaded .deb/.rpm ([#603](https://github.com/nimbus-agent/Nimbus/issues/603)) ([4d63cad](https://github.com/nimbus-agent/Nimbus/commit/4d63cada3a55d1e3bdeb2f3c1c7e434a05457f3c))
## [0.6.1](https://github.com/nimbus-agent/Nimbus/compare/v0.6.0...v0.6.1) (2026-06-13)
### Bug Fixes
* **audit:** close credential-redaction boundary escapes + property lock (True Coverage C1) ([#596](https://github.com/nimbus-agent/Nimbus/issues/596)) ([f974c02](https://github.com/nimbus-agent/Nimbus/commit/f974c02a33b3e29ada53319c1db36643588a5188))
* **ci:** unhang the Windows gateway cross-platform leg (was 30-min "cancelled") ([#591](https://github.com/nimbus-agent/Nimbus/issues/591)) ([605e46a](https://github.com/nimbus-agent/Nimbus/commit/605e46ac2a5716b7213dc4d588e623ea7729a331))
## [0.6.0](https://github.com/nimbus-agent/Nimbus/compare/v0.5.0...v0.6.0) (2026-06-11)
### Features
* **coverage:** branch-coverage foundation (true-coverage Sub-project A) ([#530](https://github.com/nimbus-agent/Nimbus/issues/530)) ([49768bb](https://github.com/nimbus-agent/Nimbus/commit/49768bb99eb074810602da74763b84e7e38d9b09))
* Phase 6 Slice 1 — Federation Core ([#519](https://github.com/nimbus-agent/Nimbus/issues/519)) ([bb92960](https://github.com/nimbus-agent/Nimbus/commit/bb92960cb4e29c2290c98821d867566f0de00b03))
* Phase 6 Slice 1 — real two-gateway over-the-wire federation ([#521](https://github.com/nimbus-agent/Nimbus/issues/521)) ([8f61f16](https://github.com/nimbus-agent/Nimbus/commit/8f61f16e2a85fd2c813c61cba3c21be2907440b9))
* Phase 6 Slice 3 — Identity & Access (SSO/OIDC + SCIM) ([#523](https://github.com/nimbus-agent/Nimbus/issues/523)) ([9af95d6](https://github.com/nimbus-agent/Nimbus/commit/9af95d68ce6426984361351fad823c42120bb876))
## [0.5.0](https://github.com/nimbus-agent/Nimbus/compare/v0.4.0...v0.5.0) (2026-06-04)
### Features
* **auth+connectors:** OAuth provider registry (PR-1) + Tier-1 connector batch + Zoom planning ([#447](https://github.com/nimbus-agent/Nimbus/issues/447)) ([9d71a62](https://github.com/nimbus-agent/Nimbus/commit/9d71a62fa5058475b8482469e82b76b8eb05615c))
* **cli:** nimbus mcp-server — expose local index to editor AIs over MCP ([#480](https://github.com/nimbus-agent/Nimbus/issues/480)) ([003e32d](https://github.com/nimbus-agent/Nimbus/commit/003e32dd0c85ba6224acb27d0fc5f5c2e73e013c))
* **gateway:** route ask through local LLM providers ([#479](https://github.com/nimbus-agent/Nimbus/issues/479)) ([b49e7ae](https://github.com/nimbus-agent/Nimbus/commit/b49e7aeb8d55d4f98e3a128f089321852d8e5efc))
* tool_call_log retention policy ([audit].tool_call_log_retention_days) ([#511](https://github.com/nimbus-agent/Nimbus/issues/511)) ([83165b1](https://github.com/nimbus-agent/Nimbus/commit/83165b1764faf08ab1066abaea143a0ceba3b3b3))
* **zoom:** PR-3 cloud recordings + AI transcripts (Walk B) ([#458](https://github.com/nimbus-agent/Nimbus/issues/458)) ([21aefdd](https://github.com/nimbus-agent/Nimbus/commit/21aefdd96f8f4e6bcefa730f7f4c7d97d3ef58d8))
### Bug Fixes
* **llm:** report fallback provider in `llm status`, fix reason labels, reuse IPC helper ([#513](https://github.com/nimbus-agent/Nimbus/issues/513)) ([4bfb99a](https://github.com/nimbus-agent/Nimbus/commit/4bfb99ac019ca71f013f81ae6fb5f9e813e1c475))
* **vscode-extension:** scope tsconfig to types:[node] (fixes CI typecheck) ([#446](https://github.com/nimbus-agent/Nimbus/issues/446)) ([78484a6](https://github.com/nimbus-agent/Nimbus/commit/78484a6e67bef930040afd4cc5b69d5f153aae0c))
## [0.4.0](https://github.com/nimbus-agent/Nimbus/compare/v0.3.0...v0.4.0) (2026-05-22)
### Features
* **audit:** promote D12 to binary; new DB_RUN_EXEC_ALLOW_LIST (T6 PR 4) ([10b9876](https://github.com/nimbus-agent/Nimbus/commit/10b9876a4fbd1e1a4e1c16b7bc0b3c425697a305))
* **cli:** T6 PR 3 — nimbus index reembed ([46f1e8c](https://github.com/nimbus-agent/Nimbus/commit/46f1e8c4e3cfc2f43d2abe8e2a2b44f60e9d292b))
* **config:** [pagerduty] TOML block — max_pages_per_sync + severity_p1_aliases ([62eeb39](https://github.com/nimbus-agent/Nimbus/commit/62eeb3960dda99955c0a46c51928ae9e79db3a67))
* **config:** add severityP1Aliases field to ServiceConfig ([5dfca63](https://github.com/nimbus-agent/Nimbus/commit/5dfca63e0e6554598957977ed5e4f26ff2939c13))
* **config:** thread [pagerduty].severity_p1_aliases into ServiceConfig ([18e1612](https://github.com/nimbus-agent/Nimbus/commit/18e161291b4bae3acb8ee2e2e83bb7f0967d752a))
* **connectors:** declare permissions.network for all 30 first-party connectors (T2 PR 1) ([9a5bf7a](https://github.com/nimbus-agent/Nimbus/commit/9a5bf7af56ac8cb0e75a8db885c65611cfc42739))
* **coverage-floor:** baseline format + diff helpers ([2d909cc](https://github.com/nimbus-agent/Nimbus/commit/2d909cc68c56df5322af89c8a3f89a345b070b4c))
* **coverage-floor:** exclusion registry + matcher ([25d7ead](https://github.com/nimbus-agent/Nimbus/commit/25d7eadd035387c6cec081d5ad73a80cab69a668))
* **coverage-floor:** exclusion-parity check ([f2527ef](https://github.com/nimbus-agent/Nimbus/commit/f2527efc5e8edc2b1894c42da04293f1ae907190))
* **coverage-floor:** orchestration entry point ([1e34574](https://github.com/nimbus-agent/Nimbus/commit/1e34574adace51054c99878337148ac4ed6efd6d))
* **coverage-floor:** per-file 80% line-coverage gate (Phase 0) ([5b958d5](https://github.com/nimbus-agent/Nimbus/commit/5b958d56bb1da4b56ab6c7ba4e52581554715a8d))
* **coverage-floor:** pure lcov parser ([f78e592](https://github.com/nimbus-agent/Nimbus/commit/f78e59279fc2c9ad356925d575d70f91524be144))
* **coverage-floor:** scope walker to bun-tested packages; add build-lcov.sh ([6d0dba5](https://github.com/nimbus-agent/Nimbus/commit/6d0dba548deb6136e90e9f636db34c82e3ef81d8))
* **db:** add dbStmtRun wrapper for prepared-statement writes (T6 PR 4) ([3dfd2ea](https://github.com/nimbus-agent/Nimbus/commit/3dfd2ea81c51f4ee235421f747b6783f1a134763))
* **db:** T6 PR 3 — V30 vec_items_1536 + dim-aware delete triggers ([0b0e3c7](https://github.com/nimbus-agent/Nimbus/commit/0b0e3c79777cfaa924c39f3131649af0e8da15a9))
* **db:** T6 PR 4 — route all writes through dbRun/dbExec/dbStmtRun (I14) ([639dd64](https://github.com/nimbus-agent/Nimbus/commit/639dd64321aea479e527d48286a2b476a96e30db))
* **db:** widen dbRun to return RunResult (T6 PR 4) ([4511a5b](https://github.com/nimbus-agent/Nimbus/commit/4511a5bd7f81d14f740192589da8d5bf992d6068))
* **diag/cli:** three-surface degraded label for sandbox posture (T2 PR 1) ([c74acbc](https://github.com/nimbus-agent/Nimbus/commit/c74acbc4d80a130069d194ab709b6f8462497262))
* **embedding:** T6 PR 3 — dim-aware pipeline + backfillForRoutingKeys ([2c258cc](https://github.com/nimbus-agent/Nimbus/commit/2c258ccf9b1a905f24310afa5b80bec10d7a54d2))
* **embedding:** T6 PR 3 — provider="hybrid" + promote provider="openai" to 1536 ([f1a3f70](https://github.com/nimbus-agent/Nimbus/commit/f1a3f704219a1ecfa9ba111c0c1440aa7e80ee46))
* **embedding:** T6 PR 3 — real embedQueryDual on lazy + worker runtimes ([2d3363a](https://github.com/nimbus-agent/Nimbus/commit/2d3363a22259c70b61ee0a7f73a6d3fb2fe1efad))
* **embedding:** T6 PR 3 — routing module + dim constants ([e392f0d](https://github.com/nimbus-agent/Nimbus/commit/e392f0dcc344d330e68c255d2397fa570b563fbc))
* **embedding:** T6 PR 3 — RoutingEmbeddingPipeline (hybrid mode) ([508f647](https://github.com/nimbus-agent/Nimbus/commit/508f647ff04f2ee70acecc458bc6798a305e6b1d))
* **extensions:** hard-disable pre-T2 extensions until reinstall (T2 PR 1) ([2e67dcc](https://github.com/nimbus-agent/Nimbus/commit/2e67dcce686e1c3e1320a6bcfcf225c7b8fdb724))
* **extensions:** object-form permissions schema + legacy array normalizer (T2 PR 1) ([649d573](https://github.com/nimbus-agent/Nimbus/commit/649d5736de026fcbc11cd7095e7436b05d6b6d6c))
* **gateway:** wire [pagerduty].max_pages_per_sync at bootstrap ([ca7d65b](https://github.com/nimbus-agent/Nimbus/commit/ca7d65bee2ee6b3b02282186fe4ecdbb592773d9))
* **gateway:** wire Updater factory in assemblePlatformServices (S6-F1) ([5fd38bd](https://github.com/nimbus-agent/Nimbus/commit/5fd38bd73005441e75b02f0a9bff01cef4f36a76))
* **invariants:** wire I14 — typed dbRun/dbExec/dbStmtRun (T6 PR 4) ([eda338e](https://github.com/nimbus-agent/Nimbus/commit/eda338ea50ccae4e66e064a97ccee35ced0eebb7))
* **ipc:** add IPCServer.setUpdater + broadcast for late attachment ([c1d9e48](https://github.com/nimbus-agent/Nimbus/commit/c1d9e48ab7f2a63a89aa425d5ff4da1445e5154c))
* **ipc:** T6 PR 3 — index.reembed long-running RPC ([26c1075](https://github.com/nimbus-agent/Nimbus/commit/26c1075eac8727a6d50ff0df183e79f7a0f9245a))
* **lazy-mesh:** wrap MCP ServerSpec through sandbox-wrapper script (T2 PR 1, I15) ([95b46a0](https://github.com/nimbus-agent/Nimbus/commit/95b46a0ebebde45aa5483f70dbea4d1980533c19))
* **pagerduty:** walk all incident pages per sync ([e4a0720](https://github.com/nimbus-agent/Nimbus/commit/e4a0720d4764111bcb31873782cf18df2b35c82f))
* **pagerduty:** write metadata.urgency on indexed incidents ([596b47a](https://github.com/nimbus-agent/Nimbus/commit/596b47add2799557d93e464bcbb86e154c6b5ab1))
* **preflight:** urgency-gap diagnostic probe ([80ef006](https://github.com/nimbus-agent/Nimbus/commit/80ef00637bfa36b5cc1540704618daed30c7a378))
* **preflight:** widen active-P1 filter to severity_p1_aliases ([742740d](https://github.com/nimbus-agent/Nimbus/commit/742740db5c8c560ce030a15f4c4f70bc1680cd82))
* **sandbox-helper:** enforce-and-exec mode + RFC 1123 + post-unshare seccomp (T2 PR 1) ([c5c7fea](https://github.com/nimbus-agent/Nimbus/commit/c5c7fea29573b480e89c9847acff171126654997))
* **sandbox-helper:** scaffold + --check-caps mode (T2 PR 1) ([80a84d0](https://github.com/nimbus-agent/Nimbus/commit/80a84d0d15ba13ab327d3d7ed22effee393dbc7b))
* **sandbox:** default Linux seccomp BPF filter (T2 PR 1) ([92d821f](https://github.com/nimbus-agent/Nimbus/commit/92d821fc121554cf294baa30338053e228f82eb7))
* **sandbox:** Linux SandboxRunner — bwrap + nimbus-sandbox-helper (T2 PR 1) ([6ea6c6a](https://github.com/nimbus-agent/Nimbus/commit/6ea6c6a6bf7e0b14617f8f38306dce5fda731e6f))
* **sandbox:** macOS SandboxRunner — sandbox-exec with SBPL profile (T2 PR 1) ([be8b001](https://github.com/nimbus-agent/Nimbus/commit/be8b001e7c4a99faf7aacca4fa2d34ac5577885b))
* **sandbox:** SandboxRunner PAL interface + dispatcher (T2 PR 1) ([d4ec092](https://github.com/nimbus-agent/Nimbus/commit/d4ec092388870d2ae096d52fdfffdfaa1f1962fa))
* **sandbox:** T2 PR 1 — Sandbox PAL + 3-OS isolation + I15 ([e668244](https://github.com/nimbus-agent/Nimbus/commit/e668244a42858d810a4e82c777c5d9565ddc3a10))
* **sandbox:** Windows AppContainer orphan-reap helper (T2 PR 1) ([01f16aa](https://github.com/nimbus-agent/Nimbus/commit/01f16aaec89300b53be6c9ca1215d31e3c7e27dd))
* **sandbox:** Windows SandboxRunner — AppContainer profile + capability surface (T2 PR 1) ([1efb7e8](https://github.com/nimbus-agent/Nimbus/commit/1efb7e8d1cbc4e5842b52d9bf4393c55cf7acd84))
* **sdk:** runSandboxContractTests + probe (T2 PR 1) ([633b464](https://github.com/nimbus-agent/Nimbus/commit/633b464336aa8196550d8db9748858317bb385dd))
* **search:** T6 PR 3 — vectorSearchChunksDual merge helper ([fe01976](https://github.com/nimbus-agent/Nimbus/commit/fe0197610eeee6cf712cd7e37d944498cf2860e0))
* **search:** T6 PR 3 — wire dual-search through hybrid options ([4570841](https://github.com/nimbus-agent/Nimbus/commit/4570841d5b1f2607203ae8286e5c5be6fac9e3e2))
* **updater:** createUpdaterFromConfig factory with disabled + unsupported-platform paths ([423fe23](https://github.com/nimbus-agent/Nimbus/commit/423fe23677615f8153ca1bd9106c4230edde7a5b))
* **updater:** derivePlatformTarget() with explicit unsupported-combo coverage ([7714aea](https://github.com/nimbus-agent/Nimbus/commit/7714aea57e1e690e8f796f6710ec94390d905ce2))
* **updater:** S6-F1 production wiring ([a1c69b9](https://github.com/nimbus-agent/Nimbus/commit/a1c69b9e46d9fc0ec6c3a570b695b8f7ff53b06f))
### Bug Fixes
* **ci:** unblock cross-platform test suite + SonarCloud reliability gate ([c75dbab](https://github.com/nimbus-agent/Nimbus/commit/c75dbab037d98b9c51df38b0ea7769089c52418a))
* **cli:** T6 PR 3 — drop the word "any" from index reembed help ([676cbd2](https://github.com/nimbus-agent/Nimbus/commit/676cbd219f797bfd00851b3cbaf861a1ca7a6e0c))
* **coverage-floor:** computeUpdatedBaseline seeds new below-floor entries ([2ba425a](https://github.com/nimbus-agent/Nimbus/commit/2ba425accbcc19e2ebf38938180ea027d4ed5af0))
* **coverage-floor:** drop unused [@ts-expect-error](https://github.com/ts-expect-error) in freeze test ([bc26019](https://github.com/nimbus-agent/Nimbus/commit/bc26019dfa7ded9a1de2368f887b816309ccdb45))
* **coverage-floor:** rename unused find() param to satisfy biome ([b63c40d](https://github.com/nimbus-agent/Nimbus/commit/b63c40dae65f2e664c11e38705f6958e9aa73a44))
* **coverage-floor:** Sonar new-code coverage — mirror local exemptions + lift sandbox-contract (PR [#329](https://github.com/nimbus-agent/Nimbus/issues/329)) ([51b101e](https://github.com/nimbus-agent/Nimbus/commit/51b101e0c9c20462bbd7005bb863efe546647bb6))
* **db:** T6 PR 3 — guard V30 no-vec branch against db.exec("") on macOS ([4130138](https://github.com/nimbus-agent/Nimbus/commit/4130138fedc9f06294aa88d8972ce7dcfd5fddf5))
* **extensions:** locale-aware sort in PreT2DisabledRegistry + new-code coverage push (PR [#329](https://github.com/nimbus-agent/Nimbus/issues/329)) ([afdc62e](https://github.com/nimbus-agent/Nimbus/commit/afdc62e8e8bb12d38567724a0a6393c25f8db1c6))
* **extensions:** reject trailing-hyphen + empty hostnames per RFC 1123 (T2 PR 1 code review) ([c5966b3](https://github.com/nimbus-agent/Nimbus/commit/c5966b3be793331de61c2d5cd6da060c68d3b401))
* **gitleaks:** rename fake API-key fixtures to defuse generic-api-key rule ([fddf720](https://github.com/nimbus-agent/Nimbus/commit/fddf7209f7064cbd8aed8b9982a27f5ad3c8363d))
* **sandbox-helper:** freeaddrinfo leak on inet_ntop error + AUDIT_ARCH_X86_64 seccomp guard (T2 PR 1 code review) ([f8c91a2](https://github.com/nimbus-agent/Nimbus/commit/f8c91a298d84130511400c7216ea11d60d73616a))
* **sandbox-helper:** guard _GNU_SOURCE redefine to unblock -Werror build ([#346](https://github.com/nimbus-agent/Nimbus/issues/346)) ([6f0e231](https://github.com/nimbus-agent/Nimbus/commit/6f0e231ea39052fc28b28638525442f2dc11a478))
* **sandbox:** allow epoll_wait + clone3, block io_uring (T2 PR 1 code review) ([dc63c7c](https://github.com/nimbus-agent/Nimbus/commit/dc63c7c1122fbcf5640ecc1e3c9a79961bb9ea78))
* **sandbox:** AUDIT_ARCH_X86_64 guard in connector seccomp filter (T2 PR 1 review) ([20fb86c](https://github.com/nimbus-agent/Nimbus/commit/20fb86c6a4ff0bde9c00409bac69366ed71c3c8e))
* **sandbox:** match platform/index.ts dispatcher idiom — node:os + .ts extensions (T2 PR 1 code review) ([cd9886d](https://github.com/nimbus-agent/Nimbus/commit/cd9886da39224528b8a51d227aa4aa40ac8c734f))
* **sandbox:** mkdtempSync for seccomp BPF tmpfile (CodeQL js/insecure-temporary-file) ([7804539](https://github.com/nimbus-agent/Nimbus/commit/78045391701e8738fdcb180e0b398aa0eed68303))
* **sdk:** drop .ts extension on testing/index re-export (T2 PR 1 CI) ([51b218c](https://github.com/nimbus-agent/Nimbus/commit/51b218c981fec8189829fca29181c6fc0d729a30))
* **security:** T6 PR 3 — block index.reembed* over LAN (I5) ([4f0d6c4](https://github.com/nimbus-agent/Nimbus/commit/4f0d6c4946e058c3ab14ac4b206504a519bbdef1))
## [0.3.0](https://github.com/nimbus-agent/Nimbus/compare/v0.2.0...v0.3.0) (2026-05-15)
### Features
* **audit:** T6 PR 2 — tool_call_log V29 + audit.toolCalls IPC (I11 complement) ([431fa47](https://github.com/nimbus-agent/Nimbus/commit/431fa47acec4777345a0674b71064404a57013bc))
* **connectors:** write tool_call_log at mesh.ts:listTools ([71042de](https://github.com/nimbus-agent/Nimbus/commit/71042deaed42b6a08d5c99c0afd5cffb33637fa7))
* **db:** tool_call_log V29 schema + write/read helpers ([216e88f](https://github.com/nimbus-agent/Nimbus/commit/216e88f8c31c0f65682bc013fb023656cafb6477))
* **docs:** embed asciinema cast SVGs in README hero ([3c5d639](https://github.com/nimbus-agent/Nimbus/commit/3c5d639b35828d1301bcf6001fb5c84f1d6e4b4b))
* **docs:** finish README hero v0.2 + prune docs/superpowers/ (48 files) ([e324899](https://github.com/nimbus-agent/Nimbus/commit/e324899f7a8af041b9a381be882ce0c8f9aed0af))
* **docs:** OG social card + JetBrains Mono fonts + deterministic renderer ([6cc24a4](https://github.com/nimbus-agent/Nimbus/commit/6cc24a4a2ab628f352320495a09417e9631792af))
* **docs:** render incident-response asciinema cast as light + dark SVGs ([105cf98](https://github.com/nimbus-agent/Nimbus/commit/105cf98bcea9cfe1e30abf481bb436c2c9469d12))
* **engine:** write tool_call_log at agent.ts wrapToolForLlm ([16b5b09](https://github.com/nimbus-agent/Nimbus/commit/16b5b09be28e1e4e5a5b401325e8d57ae83f7dc9))
* **ipc:** TDD green — audit.toolCalls dispatcher branch ([0e2e28a](https://github.com/nimbus-agent/Nimbus/commit/0e2e28a83fc49755dc175883b54f4a7a7b2a24a0))
* Phase 3 cast-tripwire — CLI rendering drift CI gate ([4144df3](https://github.com/nimbus-agent/Nimbus/commit/4144df3eef75ec45c409a47812cec64308db9a7c))
* **platform:** wire localIndex.db to agent + mesh as auditDb ([25f7b8a](https://github.com/nimbus-agent/Nimbus/commit/25f7b8aa85def594f4497cdf20d2bbe14a0ad8a0))
### Bug Fixes
* **cast-driver:** satisfy Biome lint ([1d50b38](https://github.com/nimbus-agent/Nimbus/commit/1d50b387564f16bdae5d447b1ab06b6a6197e2eb))
* **ci:** drop svg-term-cli + repair lychee fallout from spec prune ([728a073](https://github.com/nimbus-agent/Nimbus/commit/728a073ff47cce78b294f8f70a73ceed833436b1))
* **ci:** use correct pinned SHA for actions/upload-artifact ([46570d4](https://github.com/nimbus-agent/Nimbus/commit/46570d4fe781f31242ac4081d0da942d9e5b4f4c))
* **docs:** repair T6 PR 2 spec links to pruned T6 PR 1 plan/spec files ([6423398](https://github.com/nimbus-agent/Nimbus/commit/64233986b4afcd6d94c24b6468c3610efd6ad7e2))
* **docs:** rerender README hero cast with watchable dwell ([375ae9f](https://github.com/nimbus-agent/Nimbus/commit/375ae9f6bd23457fa475c36b36722535939ac921))
* **docs:** rerender README hero cast with watchable dwell ([73f638d](https://github.com/nimbus-agent/Nimbus/commit/73f638d638ea2f7d54bb0370e8c797d0032e293b))
* **index:** bump CURRENT_SCHEMA_VERSION 28 → 29 for V29 tool_call_log ([9fb029b](https://github.com/nimbus-agent/Nimbus/commit/9fb029b6e8c433dee76563db6fa1d95292e130dc))
## [0.2.0](https://github.com/nimbus-agent/Nimbus/compare/v0.1.1...v0.2.0) (2026-05-14)
### Features
* **action:** nimbus-agent/annotate-action — post-deploy annotation ([e91e1e9](https://github.com/nimbus-agent/Nimbus/commit/e91e1e90e0987c22690468fb6cedbb4020026631))
* **audit:** add release-please manifest drift check ([9ffc421](https://github.com/nimbus-agent/Nimbus/commit/9ffc421003dc6296e66a46ef4ac2289e681052e8))
* **cli:** mixed_source gap shows ⚠ + explanatory hint in nimbus metrics dora ([5fc1daf](https://github.com/nimbus-agent/Nimbus/commit/5fc1daf2bc02b866371fc83f5c0631f5dc0b5306))
* **cli:** nimbus deploy annotate ([7eff973](https://github.com/nimbus-agent/Nimbus/commit/7eff9731a8ee26fdc333b63e0ea10d5aa1634eca))
* **config:** ServiceConfig.serviceId + deployEnvironments ([225c40f](https://github.com/nimbus-agent/Nimbus/commit/225c40f05e663ffe341204b0b7616b9fabc0b8b0))
* **deployment:** annotate input/result types ([34c4797](https://github.com/nimbus-agent/Nimbus/commit/34c4797da8a99336563c17c9fcb4723b2dbbcc16))
* **deployment:** annotateDeployment — validation + transactional upsert + audit ([ea348b3](https://github.com/nimbus-agent/Nimbus/commit/ea348b34b2376b11e38a46d285012486f544d41d))
* **deployment:** three-tier external_id rule ([48d8099](https://github.com/nimbus-agent/Nimbus/commit/48d809920b16c2530d1aaf1e36e644a7bcd2c545))
* **deployment:** V28 migration — deployment_items shadow table ([4e6cb01](https://github.com/nimbus-agent/Nimbus/commit/4e6cb010dc59ff5dfc758c553c472b2f107338dd))
* **docs:** render reference benchmarks at /perf/ via BenchmarksTable ([24b8840](https://github.com/nimbus-agent/Nimbus/commit/24b884019d4c9f4e4c2fe129c078ca3c618bd54c))
* **dora:** prefer annotated deploys; emit mixed_source gap ([463103a](https://github.com/nimbus-agent/Nimbus/commit/463103aac8f3cfa185f351451c397ab60e9964d8))
* **http:** bearer auth + 60/min sliding-window rate limiter ([bde8f75](https://github.com/nimbus-agent/Nimbus/commit/bde8f75e3dea232945882c817b4ce75731e616d7))
* **http:** mount POST /v1/deployments + rename HTTP_ROUTES ([1643239](https://github.com/nimbus-agent/Nimbus/commit/1643239722b434855c02c04b8be49da5d9af7a29))
* **http:** write-route dispatcher with allowlist + auth + rate limit ([59c4fce](https://github.com/nimbus-agent/Nimbus/commit/59c4fce159c44fda2161f5b0fb26ba2f9a223c1b))
* **ipc:** deployment.annotate JSON-RPC method ([ee1694d](https://github.com/nimbus-agent/Nimbus/commit/ee1694dfd9cb15a144e813af3f9b6157ad84b1f2))
* **ipc:** wire deployment.annotate into the dispatch chain ([bb29d1e](https://github.com/nimbus-agent/Nimbus/commit/bb29d1e61397b20f04d1c16ae02830dedd9d8f69))
* **openapi:** document POST /v1/deployments + bearer security scheme ([656327c](https://github.com/nimbus-agent/Nimbus/commit/656327cd29b3541134c100239e14c0c342603353))
* **pagerduty:** enrich incident metadata + 30d cold-start window ([0db1526](https://github.com/nimbus-agent/Nimbus/commit/0db15268bcc5bb9d82128e42012f679f7015932a))
* **pagerduty:** enrich incident metadata to unblock DORA + Preflight ([0789c47](https://github.com/nimbus-agent/Nimbus/commit/0789c477a70c0f67feb94149b2bbb8ff932c63bf))
* **perf:** derive-latest-json projection + synthetic placeholder snapshot ([e81ad98](https://github.com/nimbus-agent/Nimbus/commit/e81ad98d72faf3e79d3014d82602512425425a01))
* **perf:** publish reference benchmarks to docs site at /perf/ ([b95c061](https://github.com/nimbus-agent/Nimbus/commit/b95c061ee87bc6c5baf5476f6ef4ea50946a1f21))
* **security:** I13 — HTTP write-route allowlist + bearer auth ([a761563](https://github.com/nimbus-agent/Nimbus/commit/a761563efbc140728ac31108f31080aee184fbca))
* **t4 pr 3b:** post-deploy annotation — write surface, CLI, GH Action ([29968bd](https://github.com/nimbus-agent/Nimbus/commit/29968bd48b300ce67662969303e9937bca30e789))
### Bug Fixes
* **deployment:** annotate — transactional is_new + empty-string optional ids ([3e084ce](https://github.com/nimbus-agent/Nimbus/commit/3e084ce1f4e73a5f94e895d0e72a2ff6bf82b19e))
* **docs:** MD032 blanks-around-lists in I13 section ([f878101](https://github.com/nimbus-agent/Nimbus/commit/f878101416b05b14d875a472b8a8b85613832b48))
* **http:** body cap counts bytes, not JS string length ([ab5347d](https://github.com/nimbus-agent/Nimbus/commit/ab5347d57bc86d8d0d601767f321e7e2130a312e))
* **t4 pr 3b:** defensive create:false on write DB + correct file-map description ([c2d7711](https://github.com/nimbus-agent/Nimbus/commit/c2d7711d62b71b04085e81b560455832facd3eae))
* **test:** per-test DB isolation + finished_at_ms assertion + clearer V28 test name ([24089f7](https://github.com/nimbus-agent/Nimbus/commit/24089f7fea1c5337320c826d1b550d640d689064))
## [0.1.1] - 2026-05-10
- Patch release. See the GitHub Release notes for the full change list.
## [0.1.0] - 2026-05-09
- Phase 4 release. Headless Gateway + CLI binary + VS Code extension. See [`docs/roadmap.md`](./docs/roadmap.md) for the delivered feature set.