HHostingByteSoftware
Ctrl K
ComunidadGuías…

CHANGELOG.md

Rama master · réplica de lectura del repositorio original.

Archivo original ↗Preguntar a KiBot
# Changelog

All notable public changes to Unified AI System are recorded here.

The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and the project uses [Semantic Versioning](https://semver.org/).

## [Unreleased]

### Fixed

- `/v1/responses` no longer rejects an OpenAI-compatible request that carries
  `reasoning.summary: "none"`. The compatibility route treated the explicit
  "none" value as an unset field and returned a validation error, so clients
  that intentionally disable reasoning summaries could not use the Responses
  API at all (T-064).

### Security

- Local-client proof-of-possession now binds the native addon's SHA-256 into
  the combined binding, so a replaced or rebuilt native authority addon cannot
  satisfy a previously issued possession challenge (T-043).

### Changed

- Broke the remaining file cycles in the agent-governance module by extracting
  type-only leaf modules. Internal structure only; no behaviour or public
  interface changed (T-094).

## [0.8.0] - 2026-09-25

### Added

- Added the Agent Governance control plane: a dependency-free
  `packages/policy-engine` plus a gateway service that gives every governed
  Agent a deterministic permission lifecycle — classification, policy
  compilation, per-call Tool Proxy enforcement, approvals, expiry and cascade
  revocation, with SQLite and PostgreSQL agent registries, an authority switch,
  and a JSON-to-SQLite migration tool. It stays off until
  `AI_GATEWAY_AGENT_GOVERNANCE_ENABLED=true`, and the source MCP tool surface
  grew from twelve to fifteen with the read-only `agent_governance_status`,
  `agent_governance_list`, and `agent_governance_describe` tools. See
  `docs/agent-governance.md`.
- Added governed Workforce code delivery: up to sixteen server-side profiles in
  `AI_GATEWAY_WORKFORCE_CODE_DELIVERY_PROFILES_JSON` bind exact relative
  read/write files, immutable test hashes, a baseline revision, one fixed
  command, and a digest-pinned image. Execution happens in a Workforce-owned
  worktree, verification runs in a read-only network-disabled container
  snapshot, and a successful task returns one complete patch artifact plus
  durable evidence readable back after restart. Requires
  `WORKFORCE_EXECUTION_ENABLED=true`, is single-host only, and never commits,
  merges, deploys, or publishes. See `docs/workforce-code-delivery.md` and
  `docs/agent-console-code-approval.md`.
- Added an opt-in native Codex backend for a Workforce role: an operator
  selects a hash-pinned `externalRunner` profile and the gateway drives the
  installed Codex CLI `0.153.4` inside the task's own worktree, accepting
  changes only item by item and marking a task `verified` only after
  permission-checked file changes, a reviewed full diff, and fixed tests
  passing in an isolated container. Windows x64 only; unsupported platforms are
  rejected before startup. See `docs/workforce-native-runner.md`.
- Added governed long-task operation for a retained Agent task: one original
  task UUID now covers prepare, plan, approval, bounded run fragments, status,
  pause, cancel, original-session recovery, and an explicit `reconcile` that
  settles an unknown pending operation to terminal failure without replaying
  any effect. Added resident multi-goal advancement: an operator can `schedule`
  a task into a shared server-side AgentPool (up to 16 projects, 1-64 admitted
  goals, 1-8 concurrent fragments) that re-verifies identity, approval,
  workspace, and full checkpoint after a restart inside the original grant.
  Off by default; see `docs/governed-agent-long-tasks.md`.
- Added approved speech delivery to Forge: `options.mediaTask` on
  `POST /forge/orchestrate` sends one fixed text-to-speech request through the
  existing gateway Provider channel, the server validates the returned PCM WAV
  (RIFF length, chunk bounds, `fmt`/`data` uniqueness, frames, duration,
  SHA-256), and the CLI saves it only to a new operator-named `.wav` file and
  reports path, bytes, and digest. Profiles come from
  `AI_GATEWAY_FORGE_MEDIA_PROFILES_JSON` (at most 8); the `local-fake-provider`
  profile uses a built-in synthetic tone and makes no real Provider call. See
  `docs/governed-media-tasks.md`.
- Added finite governed Forge browser tasks: `options.webTask` runs a registered
  local catalog profile (fill an item ID, search, open a detail page, extract
  results) and only reports success after the program re-reads the real DOM;
  the model returning `done` merely requests verification. Profiles are bound to
  a literal `http://127.0.0.1` origin and four administrator-registered element
  IDs, never attach to the user's browser, and carry no cookies, logins,
  uploads, messaging, or payment. Web tasks require Agent Governance and return
  `503 FORGE_WEB_GOVERNANCE_REQUIRED` without it.
- Added the taiji governed capability surface: `/taiji/capabilities` and the
  `taiji` operator CLI command expose inspect, evaluate, activate, execute,
  revoke, repair, reweight, and prune for three actually-executing local
  profiles (`context-jsonl-v1`, `risk-classification-v1`, `evidence-summary-v1`)
  that run in a bounded worker thread and produce verified receipts plus
  durable feedback. Activation, execution, and feedback changes each bind their
  own single approval, the runtime stays behind
  `TAIJI_BEIDOU_AUTO_RUNTIME_ENABLED` (default off), and multi-instance or
  PostgreSQL governance profiles are refused. See `docs/taiji-capabilities.md`.
- Added Feishu enterprise-application API delivery alongside webhook mode:
  `FEISHU_CONNECTOR_MODE=api` with `FEISHU_APP_ID`, an existing secret
  reference, and `FEISHU_API_TARGETS_JSON` sends text, markdown, or simple
  cards only to the authenticated tenant's configured recipients, caches the
  enterprise token in memory until lifetime minus a 30-second margin, and
  performs no automatic retry after any unknown outcome. Both connector routes
  now share one application-owned IM runtime, the SDK gains `connectors()` and
  `sendConnectorMessage()`, and `GET /connectors` reports modes and allowed
  target counts without recipient IDs or secret references.
- Added the local AI control center as the first personal-developer surface:
  `pnpm gateway control-center` (alias `center`, `--json`) is a strictly
  read-only snapshot of Provider mode and identifiers, health and chat
  readiness, the OpenAI-compatible model catalog, tenant-level aggregate
  virtual-key and budget usage, the redacted local-client registry, and the
  governed onboarding profiles with their install state. A credential-free
  desired-state manifest can now plan, approve, and apply two to six clients
  across JSON, JSONC, TOML, and YAML in one sequential batch with per-profile
  receipts and per-client governed rollback. See
  `docs/local-ai-control-center.md`.
- Added lossless governed onboarding for native client configuration formats:
  VS Code `settings` JSONC (comments and unknown keys preserved), Codex
  `config.toml` (bounded lossless TOML codec), and Continue `config.yaml`,
  each written through the existing config transaction with a receipt and
  byte-exact rollback.
- Added verified context re-encoding and model comparison: an optional
  `contextCodec` on native `/chat` and `/chat/stream` rewrites explicitly
  selected JSON blocks as YAML, JSONL, or a column/row table, and the gateway
  decodes and compares keys, types, values, and array order before the request
  proceeds, restoring the original input on any mismatch. Enabled only with
  `AI_GATEWAY_CONTEXT_CODEC_ENABLED=true`; the `codec preview` and
  `codec compare --yes` CLI operations make at most two exact-model requests.
  See `docs/context-codec.md`.
- Added durable, owner-scoped workflow run history with fenced recovery:
  `GET /workflow/runs`, `GET /workflow/runs/{workflowId}`, and
  `POST /workflow/runs/{workflowId}/recover`, plus exact approved artifact
  publication, and the matching `workflow run|list|status|recover` CLI. Added
  governed runtime Provider credential clearing through
  `DELETE /providers/runtime-credential`, the SDK, and
  `pnpm gateway providers clear-credential`. See `docs/workflow-recovery.md`.
- Added governed Workforce role execution: approvals bind to explicit role
  execution profiles, qualified employee selections compile into governed
  profiles, role budgets and final Provider-dispatch fences are enforced, and
  approved employee contributions execute through the gateway's own Provider
  channel. Added three-perspective consensus review (`ceo`/Critic, `pm`/Planner,
  `architect`/Architect) executed through `/workforce/execute`, opt-in bounded
  lifecycle hooks (`beforePlan`/`afterPlan`/`beforeExport`/`beforeWorkflowRun`,
  default off), and role-level Workforce-to-local-workflow handoff. See
  `docs/workforce-consensus.md`, `docs/workforce-lifecycle-hooks.md`, and
  `docs/workforce-workflow-handoff.md`.
- Added a protected native PoP replay profile for Windows: an opt-in
  `AI_GATEWAY_LOCAL_CLIENT_POP_REPLAY_PROTECTION_MODE=windows-native`
  configuration binds the gateway's SQLite PoP replay guard to the protected
  native authority service with durable mutation intent, a schema-4 checkpoint,
  persistent request lifetimes, and a fresh native challenge around each
  consume, plus versioned authority maintenance that preserves state across
  upgrades. Single-host only and never satisfies distributed replay
  requirements. See `docs/local-client-native-pop-replay.md` and
  `docs/local-client-windows-authority-maintenance.md`.
- Added deployment profiles and artifact identity: a digest-pinned
  single-instance Compose release profile with `tools/verify-compose-release.mjs`,
  a single-writer Kubernetes gateway profile, native gateway service
  definitions rendered with explicit state paths, and an artifact-bound
  `buildIdentity` (`sourceDigest`, `lockfileDigest`, `packageVersion`,
  `sourceFileCount`) exposed on health and `api/overview`. See
  `docs/deployment/README.md`, `docs/deployment/kubernetes.md`,
  `docs/deployment/native-services.md`, and `docs/runtime-build-identity.md`.
- Added B.AI as the independent gateway Provider `bai`, pinned to
  `https://api.b.ai/v1` and served through the existing OpenAI-compatible Chat
  Completions adapter, with model discovery, probing, and a credential-free
  smoke path. It is disabled by default and changes no existing Provider
  routing. See `docs/bai-provider.md`.
- Added private virtual-key request accounting and native budget enforcement:
  each actual gateway execution settles once against its key, and native
  `/chat` now performs budget admission and usage settlement instead of
  bypassing the shared manager. Added the bounded `verification` CLI operation
  for local Windows validation history, and an offline import of all 1,016
  pinned O*NET 31.0 occupations as inactive employee candidates that no import
  path reads automatically. See `docs/virtual-keys.md`,
  `docs/windows-validation.md`, and `docs/official-occupation-import.md`.

### Changed

- Unified Provider usage accounting across every execution entry: native chat,
  OpenAI chat and Responses, Anthropic Messages, Gemini, WebSocket chat, A2A
  task execution, and trusted Workforce/Forge/Agent projections now settle
  through one gateway boundary, an explicitly reported zero is distinguished
  from a legacy synthesized zero, and each settlement records `reported`,
  `estimated`, `partial`, or `unknown` instead of writing a fictitious
  zero-token record. Cache hits consume a fresh admission and charge from the
  stored internal snapshot.
- Aligned the first-run setup payload with what the instance actually routes:
  it now reports Provider mode, the real-provider switch, and the fixed or
  policy-selected default Provider as separate facts, and each step names the
  `status`/`doctor`/`chat` command that proves it rather than implying the
  check already ran. `doctor` now matches the supported toolchain requirements.
- `/v1/responses` now accepts and ignores known Codex built-in tool
  declarations (for example `web_search`) with a server-generated
  `unified_ai.compatibility` notice listing `ignored_tool_types`,
  `ignored_include`, `ignored_parameters`, and `ignored_reasoning_input_items`
  consistently across normal replies, SSE events, and stored retrieval, instead
  of failing the request. Unknown tool types and mandatory built-in
  `tool_choice` still return an explicit error.
- Clarified the shipped tool count in the README: the published image exposes
  twelve bounded MCP tools while the current source build exposes fifteen, and
  readers are pointed to the first runnable proof instead of a claim.

### Fixed

- Fixed guardrail coverage: input redaction now applies through final protocol
  normalization rather than only the inbound shape, Anthropic `system` text and
  normalized tool-result text are inspected by input guardrails, A2A text is
  validated before task creation, and streamed or stored responses can no
  longer replay another session's content; response sessions are now bound to
  their owning tenant and caller.
- Fixed Provider accounting regressions: Gemini requests are now counted and
  SSE cache charges preserved, Provider-reported usage and complete token
  totals survive normalization, virtual-key usage persists across restart with
  separate per-minute rate windows, internal Provider calls keep their actual
  evidence, and invalid HTTP Provider attempt counts are rejected before
  dispatch.
- Fixed the reverse-MCP REST bridge to honor declared OpenAPI input bindings:
  path-item inheritance, `query_`/`header_`/`cookie_`/`body` mapping, `simple`
  and `form` styles with `explode`, bounded JSON-Pointer expansion, and
  pre-dispatch refusal of missing required values, header/cookie collisions,
  and unsupported shapes instead of publishing a partial tool catalog.
- Fixed state loss and platform startup issues: the model library now survives
  storage failures, the Compose model library persists in the writable data
  volume, local vector storage works in the production Node runtime, exact
  registry file identities are retained beyond numeric precision, SQLite
  defensive mode is optional on Node 22, and the PoP replay guard health check
  reads one consistent snapshot.
- Fixed delivered code work: Workforce edits now apply bounded exact edits that
  preserve untouched file content instead of rewriting whole files, completion
  requires actually executed immutable verification checks, and every safe
  route cause code now retains its delivery failure for inspection.
- Fixed the published container image: the shipped source tree is readable by
  the non-root runtime user, so in-container build identity can re-hash it
  instead of reporting `source-unavailable`.

### Dependencies

- Added a pre-publication dependency vulnerability gate
  (`pnpm check:dependency-vulnerabilities`) with a recorded baseline, and
  updated the affected packages through `@xmldom/xmldom` 0.8.15 and `hono`
  4.13.5 workspace overrides plus a pinned `vitest` 4.1.11.
- Added pinned runtime dependencies for the new surfaces: `yaml` 2.9.0,
  `jsonc-parser` 3.3.1, and `toml-eslint-parser` 1.0.3 in the gateway, and the
  gateway now depends on the existing `web-agent` workspace package.

## [0.7.0] - 2026-09-04

### Added

- Added a terminal-first operations overview API: `GET /api/overview` returns a
  compact JSON snapshot (provider mode, health, readiness, request stats,
  circuit state) from the `/metrics` sources behind standard enterprise auth
  with the `dashboard:read` permission and an `EXACT_ROUTE_PERMISSIONS`
  registration.
- Added external verification on-ramps: `docs/security/external-audit-kit.md`
  (four-chain reviewer scope and reproducible target), an advisory OSV
  dependency scan plus SPDX SBOM workflow pinned to the verified upstream
  release, and enabled GitHub private vulnerability reporting.
- Added a zero-budget human test loop to the launch kit: completed runs,
  feedback reports, and external Stars are the growth signals, with a
  copy-ready provider-free invitation.

### Changed

- Pinned the terminal-first boundary: an unregistered `GET /console` and
  `GET /ui` must stay 404, enforced by a regression test, and the browser
  console option is recorded in ROADMAP under Not Doing as an owner decision.
- Pruned the zero-reference `im-connector-*` workspace dependencies from the
  gateway manifest and corrected README cache wording to lexical-approximate
  matching.
- Rewrote ROADMAP around the governed client and agent-gateway narrative with
  a four-item v0.7.0 scope, a labs package boundary, and explicit non-goals.
- Added SECURITY.md support for the `0.7.x` line.

### Dependencies

- Bumped `@anthropic-ai/sdk` to 0.120.0 in lockstep with the public-clone
  verifier's pinned version, `@types/node` to 26.4.1 with the matching
  `JsonWebKey` and child-process IPC typing fixes, `c8` to 12, and `mammoth`
  to 1.12.1, plus the pending GitHub Actions dependency updates.
- Reverted the `better-sqlite3` 13 upgrade after the runtime image build
  failed (no prebuilt for the container platform and no Python toolchain);
  the bump needs a container build strategy before it can land.

## [0.6.0] - 2026-08-29

### Added

- Added opt-in A2A v1.0 Agent Card identity signing with a stable Ed25519
  private-key file, official JCS/JWS generation, a public JWKS endpoint,
  HTTPS enforcement outside loopback, restricted-file validation, and a
  fail-closed `AI_GATEWAY_A2A_AGENT_CARD_SIGNING_REQUIRED` deployment mode.
  Rotation can now retain up to three restricted previous Ed25519 keys through
  a bounded JSON path list, publish primary-first overlap JWKS, and generate one
  independently verifiable signature per key. Malformed, unanchored, duplicate,
  or over-capacity overlap configuration fails startup.
- Added bounded A2A task storage with tenant/owner isolation, TTL, global and
  per-owner capacity, task/history/artifact limits, scope-bound keyset
  pagination, restart-safe same-host SQLite, multi-instance defaults, safe
  readiness output, and a fail-closed durable-required mode. An explicit
  PostgreSQL mode now adds cross-host lifecycle sharing with database-clock TTL,
  transactional counters and task locks, stale-write rejection, corruption
  digests, repeatable-read pages, verified remote TLS, and safe health output.
  Cross-host mode now also requires a tenant/owner/task-scoped PostgreSQL
  execution lease with digest-only tokens, heartbeat renewal, monotonic fences,
  duplicate-executor rejection, pre-publication stale-result blocking, and
  remote cancellation. PostgreSQL A2A terminal TaskStore commits now lock,
  validate, and consume the active token digest/fence in one transaction;
  cross-replica cancellation atomically stores `canceled` and deletes the fence,
  terminal tasks cannot be reopened, and a new acquire checks terminal state
  under the same lock order. Downstream provider/sink fence consumption remains
  explicit.
- Fixed the live A2A Workforce skill wiring: the controlled executor created by
  the application is now passed to the HTTP/A2A gateway instead of being
  dropped from the application boundary and reported as unavailable at runtime.
- Added a PostgreSQL Workforce task-claim backend with database-clock leases,
  atomic cross-pool ownership, monotonically increasing fencing tokens,
  namespace/capacity bounds, digest-only bearer persistence, renewal/release/
  revoke operations, verified-TLS configuration, safe health output, and a
  fail-closed multi-instance execution requirement.
- Added a central PostgreSQL Workforce queue/result backend with tenant/owner
  scope, bounded retention/capacity/payloads, task-state corruption digests,
  cross-replica expired-owner recovery, redacted health/metrics, and a
  fail-closed multi-instance requirement. Terminal completion/failure now
  validates the digest-only claim and monotonic fence, persists the result, and
  deletes the lease in one transaction. External irreversible sinks still need
  their own fence-aware commit boundary before exactly-once can be claimed.
- Added a destructive PostgreSQL logical-recovery gate that deletes its source
  database and volume, restores twelve covered gateway tables, builds an
  asynchronous streaming standby with `pg_basebackup -R`, and proves replay of
  a post-basebackup WAL marker. It interrupts an in-flight query by destroying
  primary, then a healthy-armed controller requires three consecutive failures
  plus confirmation before automatically promoting the one known standby and
  switching a stable endpoint. Before destruction, a separate probe container
  and the streaming standby are disconnected from the still-writable primary
  by a real Docker-bridge partition. The full failure sequence must be rejected
  because an independent Docker-state fence still reports the primary running;
  after bridge healing, the probe must recover and the standby must replay a
  marker written during the partition. The same sentinel Pool plus eight
  clients must recover after switch/restart. This bounded single-bridge proof
  now also retains the fenced old-primary volume, persists rewind prerequisites,
  runs PostgreSQL 17 `pg_rewind -R`, and starts the old volume only as a
  streaming standby. It must replay a post-promotion marker, preserve exact
  inventory and client health, then reconnect and replay another marker after
  the promoted primary restarts. It also creates a separately manifested
  physical base backup plus continuous WAL archive, removes all bundled backup
  WAL, and performs archive-only recovery to an inclusive LSN between an
  included and excluded marker; exact inventory and all eight contracts are
  required. This is not multi-candidate election/quorum, external HA control,
  long-duration/off-host archive custody, time-based PITR, arbitrary multi-host
  partition/rejoin control, complete split-brain safety, or production RTO/RPO
  proof.
- Added central PostgreSQL Workforce execution control: raw-identifier-free
  tenant/plan/subject keys, atomic single-use approval consumption, versioned
  digest-verified lifecycle transitions, bounded retention/capacity, remote
  cancel visibility, verified TLS, safe readiness, and Prometheus metrics.
  Multi-instance execution now fails closed unless claims, queue/results, and
  approval/lifecycle control all use the same database.
- Fixed controlled Workforce isolation adapters that were previously wired to
  the wrong method/return contracts: worktree creation failures now block,
  cleanup is verified and affects terminal status, the configured repo root is
  actually checked, and lifecycle/evidence use an opaque tenant+owner scope.
  The real pre/post security checkpoint now runs and fails closed; its local
  audit uses hashed filenames plus atomic restricted writes, and per-role
  evidence is bounded, redacted, atomic, and no longer silently skipped. Forge
  adapters must attest and receive an isolated project root before execution.
  Lifecycle snapshots now use hashed filenames, serialized atomic `0600`
  writes in `0700` directories, bounded/redacted state, corruption detection,
  and initialization rollback instead of logging persistence failures as if the
  transition had succeeded.
- Fixed the sandbox-merge lane using nonexistent security/evidence/redactor
  methods and deleting its own green candidate branch during worktree cleanup.
  Real pre/post checkpoints and evidence sessions now run, rollback/cleanup
  failures are terminal, LLM abort signals reach the provider, and a verified
  manual-merge candidate branch survives directory cleanup.
- Hardened controlled-execution timeout/cancel draining: the gateway now waits
  for cooperative role settlement before removing its worktree. Providers that
  ignore abort past the bounded drain deadline produce an explicit unconfirmed-
  quiescence failure and the worktree is retained instead of being deleted under
  a still-running task. Legacy source-text timeout tests now assert the current
  abort/settlement contract, backed by delayed-abort and ignored-abort behavior
  tests.
- Added a central PostgreSQL usage ledger with awaited write-ahead reservation
  and terminal commits, per-attempt idempotency/conflict detection, tenant
  queries and spend aggregation, retention/capacity bounds, verified TLS,
  redacted health/metrics, and a fail-closed multi-instance real-provider gate.
- Added a central PostgreSQL enterprise audit chain with transactional global
  sequencing, per-entry hash/HMAC, signed state, external sequence/hash floors,
  idempotent event IDs, tenant-scoped canonical reads, bounded append-only
  capacity, chunked full verification, safe health/metrics, and a mandatory
  multi-instance real-provider gate. External WORM retention remains an
  independently verified deployment property.
- Added admin-only provider statement reconciliation against the central usage
  ledger: exact usage-attempt matching, tenant binding, USD micro-unit variance,
  missing/duplicate/unresolved classifications, stable normalized-statement
  digests, strict input/query bounds, audit summaries, and explicit non-invoice
  and unauthenticated-source boundaries.
- Corrected the Go open-loop benchmark's managed-capacity contract: methodology
  v2 sizes the sustained in-flight cap from target RPS and allowed p95 latency,
  adds safety headroom, rejects contradictory zero-error configurations, and
  keeps overload proof in a larger independent burst.
- Upgraded the open-loop methodology to v3 after fresh hosted runners still
  alternated between single-digit-millisecond passes and multi-second startup
  saturation. Managed runs now require a reported, bounded five-sample
  steady-state warmup before the one-shot measured phase. Warmup failure blocks;
  measured 100 RPS, zero-error, protocol, and 750 ms gates are unchanged and
  are never retried.
- Added OIDC SSO (authorization code + PKCE + JWKS RS256/ES256 ID-token
  verification, one-time state, issues an API token on login) and SCIM 2.0
  user provisioning (bearer-auth create/get/list/patch/deactivate) for
  enterprise IdP integration.
- Added operator-configurable weighted routing splits and shadow traffic
  (`AI_GATEWAY_WEIGHTED_ROUTES_JSON`): requests split across providers by
  weight; shadow calls fire after the primary response and enter the usage
  ledger separately. Real-provider shadowing requires the additional explicit
  `AI_GATEWAY_SHADOW_REAL_PROVIDER_ENABLED=true` gate.
- Added same-host multi-instance defaults (`AI_GATEWAY_MULTI_INSTANCE=true`):
  rate limiting and idempotency dedup default to shared SQLite stores with a
  load-or-generate shared HMAC secret file.
- Added Anthropic prompt-caching passthrough (message-level
  `cache_control: ephemeral` breakpoints, ≤4 per request, re-attached on the
  outbound wire) with `cache_read/creation_input_tokens` mapped into usage
  for both JSON and streaming responses.
- Added the Gemini `:batchGenerateContent` inbound endpoint (sequential
  per-entry execution, per-entry error isolation, ≤16 entries).
- Added an execution-gates e2e suite and closed the agentic/rag test gap
  (helpers + source-selection benchmark coverage).
- Removed both im-connector packages and the gateway-side context-codec
  adapter dead links (the context-codec-core package stays — codex-context-gateway
  consumes it), and unwired the taiji-beidou preview hooks from the `/chat`
  hot paths (ledger D2 cleanup). The initially drafted removals of
  workforce-contracts, position-library, workforce-scheduler,
  employee-brain-adapter, and the workforce preview service were rolled back
  and stay in-tree pending the owner's decision.
  (Superseded: the whole D2 subtraction was rolled back with the restoration
  below — the im-connector packages, the gateway context-codec adapter, and
  the live taiji-beidou `/chat` preview hook are all in-tree.)
- Fixed Chinese keyword retrieval/RAG: the local tokenizer now emits CJK
  runs plus overlapping bigrams, so Chinese queries match Chinese documents
  (whitespace-only tokenization previously made CJK prose unmatchable).
- Fixed usage-ledger tenant attribution: gateway inputs now carry the
  server-resolved enterprise identity (stamped at execute time and immune to
  client spoofing), so /usage/summary and /usage/logs return real per-tenant
  records instead of collapsing everything into the default tenant.
- Fixed the native /chat and /chat/stream lane missing the guardrail
  enforcement (input block/PII redaction and output redaction) that the
  /v1 protocol lanes already applied.
- Fixed agent-exec wall-clock timeouts: the abort signal now reaches
  in-flight provider calls through execution.signal instead of only being
  checked at iteration boundaries.
- Fixed the public-clone verifier regression: the official OpenAI SDK
  example now uses `logprobs` (still unsupported) as its structured-rejection
  sample now that `n>1` is a supported feature.
- Added real-worktree and approval gate verification: the workforce execution
  gates (git worktree isolation and the SHA-256-bound execution approval
  gate with single-use consumption) are now covered by end-to-end tests
  against a real temporary git repository, and the execution readiness
  preflight honestly reports both gates as implemented-and-default-off
  (`WORKFORCE_EXECUTION_ENABLED` stays the master switch).
- Added `input_audio` multimodal passthrough on `/v1/chat/completions`
  (user messages, wav/mp3, base64-validated, ≤4 parts and ≤20MB base64 per
  part) with verbatim forwarding to OpenAI-compatible providers; the Gemini
  inbound lane maps `audio/wav` and `audio/mpeg` `inlineData` parts to
  `input_audio`. `unified_ai.multimodalAudio` metadata reports the outcome.
- Removed the forge-core package (92k lines, runtime-unwired since 0.5.0) and
  web-agent entirely, along with the three-mode simulation layer and its
  routes, telemetry, and permission mappings (subtraction ledger D3/D4).
  Forge-core fixes shipped earlier in this cycle (real knowledge DELETE,
  FileSnapshot API, revived incremental tests) were removed with the package;
  their diffs are preserved in the session baseline notes.
  (Superseded: fully restored on 2026-08-23 — see the Restoration Note below;
  forge-core is a runtime gateway dependency, web-agent and its tests are
  active, and `/three-mode/execute` is wired.)
- Added inbound Gemini compatibility routes: Gemini-native clients can now
  call `POST /v1beta/models/{model}:generateContent`,
  `POST /v1beta/models/{model}:streamGenerateContent` (SSE), and
  `GET /v1beta/models`. Requests reuse the OpenAI normalizer for validation
  and model resolution, so guardrails, virtual-key budgets, and metrics
  behave identically across protocol lanes; function calling and inline
  image parts translate in both directions.
- Added `n>1` multi-choice support on `/v1/chat/completions` and legacy
  `/v1/completions` (JSON and streaming, choices indexed; prompt tokens
  counted once, completion tokens summed). `n` is validated to 1–8.
- Added `stream_options.include_usage` support on legacy `/v1/completions`
  with a provider-usage-aware terminal usage chunk.
- Added opt-in RAG injection for `/v1/chat/completions` via the
  `unified_ai.rag` request extension (`{ enabled, topK?, sourceIds? }`):
  the last user message retrieves tenant-scoped knowledge, and the cited
  context is injected as a system message. Injected context re-passes the
  guardrails engine; RAG-augmented requests bypass the response cache.
- Added guardrails coverage for `/v1/responses` and the internal `/chat`
  and `/chat/stream` routes (input inspection, output redaction, and
  per-delta SSE redaction — same engine, same tenant overrides as
  `/v1/chat/completions`).
- Added A2A streaming: `message/stream` JSON-RPC results are forwarded as
  SSE `data` events instead of a 501; version-less requests now default to
  the gateway's advertised protocol version instead of failing.
- Added a pluggable HTTP embedding provider (OpenAI-compatible
  `/embeddings`, batch-async) activated by the reserved
  `KNOWLEDGE_EMBEDDING_*` env contract; the credential-free deterministic
  provider remains the default and the fallback. Knowledge retrieval is now
  async-capable end to end.
- Added a local-ledger billing provider implementing all six
  `billingProviderAdapter` operations (customers, usage events, invoice
  issue/void, payment sync) against a durable JSONL ledger, plus manual
  payment recording. No payment provider is connected; invoices stay
  clearly labeled as ledger statements, not legal invoices.
- Added real workforce execution primitives: a single-use TTL-bound task
  claim token service, an AbortController-backed cancellable execution
  lifecycle, and a claim-token-gated workflow run handoff. The workforce
  preflight now reports these as implemented; worktree isolation and real
  human approval remain the gates before execution can be enabled.
- Added a `file_key_path` credential vault resolver (CREDENTIAL_VAULT_DIR,
  traversal-guarded, size-capped) plus an explicit
  `materializeCredentialRef` for runtime-internal secret access; secrets
  never appear in logs, audits, or resolution summaries.
- Added real p50/p95/p99 latency quantiles (nearest-rank over recent
  request-log records) to `/metrics`; the average-value placeholder remains
  only as a fallback.

### Changed

- Marked the declared `bin` entrypoints (`packages/mcp-server/src/index.js`,
  `packages/mcp-server/src/http-entry.js`, `packages/mcp-service/bin/install.js`)
  executable in git. pnpm chmods declared bin files 0755 during install on
  POSIX, which made the Linux CI worktree report exactly those files as
  modified and fail the public-clone verifier's clean-candidate gate.
- Made the local-client test suites platform-honest: the durable SQLite
  store suites (feedback dedup, verification-authority epoch, onboarding
  receipt authority, governed onboarding, and the durable gateway-application
  compositions) now skip on Node runtimes without `node:sqlite` defensive
  mode, and the Windows protected-authority/tasklist-discovery tests skip on
  non-win32 platforms, so `pnpm test` is green on both the CI Linux runner
  and Windows development hosts. The public-clone verifier's dirty-worktree
  failure now lists the offending paths for direct diagnosis.
- Updated pinned `actions/cache` to v6.1.0 and `actions/upload-artifact` to
  v7.0.1 across CI, quality-trend, and Docker evidence workflows so GitHub's
  Node 20 action-runtime deprecation no longer leaves a forced-runtime warning;
  all references remain immutable commit SHAs.
- Upgraded the short resource-regression gate to methodology v2: its
  bounded client now requires a minimum sustained arrival pressure while the
  separate open-loop gate remains responsible for zero-drop capacity, and
  fixed-target metrics scrapes no longer drift when an earlier scrape is slow.
- Moved the container's public enterprise-auth boolean default from an `ENV`
  layer into an `exec`-based CMD default, preserving explicit overrides and PID
  1 signal handling while eliminating Docker's secret-in-ENV false positive.
- Hardened knowledge-file ingestion: PDF, DOCX, XLS, and XLSX parsing now runs
  in bounded worker threads with hard time, heap, concurrency, queue, input,
  extracted-text, PDF-page, sheet, row, column, and cell limits. Invalid base64
  and oversized batches fail before parser invocation.
- Enterprise audit hash-chain writes are awaited and fail the governed
  operation when durable append fails; health degrades instead of silently
  treating an asynchronous audit failure as success.
- Fixed local audit lock reclamation across Node worker threads. Threads share
  a process ID but not module memory, so the former 250 ms same-process orphan
  shortcut could delete another thread's live lock and create two entries from
  one tail. Lock cleanup now verifies its nonce, and any lock owned by a live
  process remains fail-closed. A deterministic two-worker regression reproduces
  the former `chain_linkage` corruption and now requires a valid 2-entry chain.
- Placeholder executions are now honest: `LocalRunner` marks handler-less
  tasks `skipped`, and `SubProcessRunner` fails fast with
  `SCRIPT_PATH_MISSING` instead of reporting fake completions.
- `DELETE /api/knowledge/:id` in the forge-core API server now deletes the
  entry and returns 404 for unknown ids instead of a fake 200.

### Added (vision revival, per owner selection)

- Lit up the forge vision families (all except context engineering):
  governed /forge endpoints (polish, quality, memory, orchestrate, runs,
  status, consensus) bridging forge-core engines through the gateway
  provider lane, plus /taiji/compile and /workforce/preview; a 
  CLI command group; three-mode execution restored and live.
- Performance (fake lane, single node, same benchmark tool): chat JSON
  p50 15.7ms → **3.3ms (~4.8×)**, SSE TTFT 2.6ms → **1.6ms** — via
  versioned provider-registry/model-list caching and removal of the artificial
  20ms fake-provider latency. Audit hash-chain writes are now deliberately
  awaited so a durable-audit failure cannot be reported as a successful
  governed operation.

## [Restoration Note]

The subtraction entries listed above were fully restored on 2026-08-23 at
the owner's direction (they carry the original design vision). This covers
the forge-core / web-agent / three-mode / dead-chain removals (ledger D3/D4)
and the im-connector packages, the gateway-side context-codec adapter, and
the taiji-beidou `/chat` preview hooks (ledger D2). The restored tree is the
source of truth; see docs/vision-revival-inventory.md for the revival menu.

## [0.5.0] - 2026-08-15

### Added

- Added reverse MCP governance: the gateway aggregates operator-declared
  upstream MCP servers (`MCP_UPSTREAM_SERVERS_JSON`) over Streamable HTTP,
  stdio, and a REST→MCP OpenAPI bridge, exposing them through
  `GET /mcp/tools` and `POST /mcp/call` with tenant-scoped identities,
  per-upstream tool allowlists, size caps, timeouts, outbound-policy egress,
  and full audit-trail recording of every tool call. The OpenAPI bridge
  generates governed MCP tools from any HTTPS OpenAPI 3 spec. See
  `docs/reverse-mcp-governance.md`.
- Added an opt-in semantic layer to the chat response cache
  (`AI_GATEWAY_RESPONSE_CACHE_SEMANTIC_ENABLED`): exact-key misses are
  matched against a bounded per-tenant in-memory vector index built with the
  new credential-free deterministic embedding provider; hits replay the
  neighbor payload and are logged/metered as `semantic`.
- Activated vector retrieval for the local knowledge base
  (`KNOWLEDGE_INFRA_MODE=sqlite-vec`): a credential-free deterministic
  embedding provider (`deterministic-hash-v1`) plus the SQLite-backed vector
  store back a new `mode: "vector"` retrieval path with lazy embedding on
  load/retrieve, tenant-safe filtering (vector results are intersected with
  the tenant-visible document set), and unchanged keyword-mode behavior.
- Added chat-specific Prometheus metrics on `GET /metrics`
  (`ai_gateway_chat_requests_total`, `ai_gateway_chat_tokens_total`,
  `ai_gateway_chat_ttft_ms` histogram, `ai_gateway_chat_cache_events_total`,
  `ai_gateway_chat_virtual_key_rejections_total`) with capped label
  cardinality, plus an opt-in Langfuse export (`LANGFUSE_PUBLIC_KEY` /
  `LANGFUSE_SECRET_KEY`) that batches generation events with usage,
  provider, latency, cache-hit, and virtual-key fingerprint metadata,
  truncates captured content, and fails open on export errors. See
  `docs/observability-export.md`.
- Added virtual keys (`uai-`) with periodic token budgets and per-key rate
  limits. Operators create, list, and revoke keys through
  `/enterprise/virtual-keys` (user:admin); keys authenticate through the
  enterprise governance layer as tenant-scoped identities; and
  `POST /v1/chat/completions` enforces a pre-request budget check (429
  `VIRTUAL_KEY_BUDGET_EXHAUSTED` / `VIRTUAL_KEY_RATE_LIMITED`), records
  actual usage (including response-cache hits and streaming), and emits a
  soft-budget service-log event at the configured threshold. Keys persist as
  SHA-256 hashes with usage counters in `.data/enterprise/api-keys.json`.
  See `docs/virtual-keys.md`.
- Added native streaming to the Anthropic provider adapter. `generateStream`
  now consumes the upstream Anthropic Messages SSE stream directly (text
  deltas, usage accounting from `message_start`/`message_delta`, stop-reason
  mapping, inactivity-based timeout, and caller abort propagation), so
  streaming requests no longer fail with `PROVIDER_STREAMING_UNSUPPORTED`
  when a real Anthropic provider is selected. Also fixed the non-streaming
  timeout error, which previously shipped without `category`/`retryable`.
- Added an opt-in response cache for the OpenAI-compatible chat hot path.
  With `AI_GATEWAY_RESPONSE_CACHE_ENABLED=true`, identical tenant-scoped
  `POST /v1/chat/completions` requests replay the exact JSON or SSE wire
  response without a provider call, reusing the existing response-cache store,
  tenant scoping, TTL, and audit trail. See
  `docs/response-cache-hot-path.md` for eligibility rules and operations.
- Added a credential-gated real-provider smoke: `tools/real-provider-smoke.mjs`
  plus the manual **Real Provider Smoke** workflow. The wrapper pins the
  OpenAI lane, bootstraps a per-run enterprise token (real modes require
  authentication even on loopback), enforces a timeout, treats fake-lane
  fallback as a failure, and exits with an explicit skip when
  `secrets.OPENAI_API_KEY` is absent, so zero-credential runs stay green.
- Added the real provider enablement runbook
  (`docs/real-provider-enablement.md`) covering the three-gate whitelist
  matrix, credential provisioning paths, verification, cost control, the
  unchanged fake boundary, and rollback.
- Added a task handoff loop reference that documents the read and write handoff
  endpoints, the task card schema, the standard round, and a read-only
  connection verification card that any MCP host can run.
- Added a design-only proposal for a gateway-driven external runner, covering
  token scope, command whitelist, and the approval gate. No runtime code
  implements it, and it stays closed until the repository owner authorizes it.

### Changed

- Archived the forge gateway embedding: the module was never wired into the
  application (zero callers), and now additionally requires an explicit
  `FORGE_ENABLED=true` opt-in. Annotated the dead route modules
  (`legacyRoutes.js`, `enterpriseRoutes.js`) as archived and recorded the
  D-track subtraction inventory in `docs/subtraction-ledger.md`.
- Moved the Codex plugin and manual Agent Skill procedure to the reviewed
  immutable `v0.4.9` MCP image index.
- Documented local client convergence for the three source hosts and ignored
  `.zcode/`, so per-machine interpreter paths stay out of version control.
- Corrected the governed tool count in the Chinese MCP compatibility baseline
  from nine to twelve, completing an earlier alignment that missed this line.
- Corrected the supervised MCP service README from nine to twelve governed
  tools and refreshed its tool list to match the MCP server README.

### Fixed

- Fixed managed MCP sessions losing every authenticated tool after about ten
  minutes. The ephemeral managed token no longer carries a fixed wall-clock
  expiry; its lifetime is bounded by the fake-provider, loopback-only gateway
  child process that the MCP host already owns.

### Verification

- Ran a live-process attack/defense regression against the gateway's new
  surfaces (`node tools/security-attack-regression.mjs`): cross-tenant
  cache reads, tenant-header forgery, viewer-role keys on chat/admin/MCP
  surfaces, budget exhaustion, per-key rate limits, cross-tenant key
  revocation, secret-like cache poisoning, anonymous and oversized MCP
  calls, revoked-key replay, and /metrics authentication/secret hygiene —
  16/16 outcomes defended, zero findings.
- Reviewed both published `v0.4.9` Linux platforms without starting them,
  including OCI identities, flattened filesystems, native binaries, lifecycle
  hooks, privileged files, internal links, and credential-like artifacts.
- Held one stdio MCP session for 12.05 minutes across twelve authenticated
  polls with zero authentication failures, called chat successfully past the
  former ten-minute boundary in fake mode, closed the managed gateway, and
  recorded no new token-expiry audit entry.
- Ran the three source client profiles concurrently from their own on-disk
  configuration: each discovered the same twelve governed tools, held a distinct
  loopback port, returned fake-provider output, released only its own port on
  disconnect, and left no orphan listener.

## [0.4.9] - 2026-08-10

### Added

- Added `GET /v1/models` and `POST /v1/chat/completions` as a focused
  OpenAI-compatible inbound API with text completions, data-only SSE streaming,
  standard error envelopes, visible execution metadata, and optional local
  prompt enhancement.
- Added public protocol types and bilingual OpenAI SDK integration guides.
- Added a credential-free end-to-end example that verifies the gateway with
  the official OpenAI JavaScript SDK `7.4.0`.

### Changed

- Made the growth dashboard distinguish merged directory submissions from
  pull requests closed without merge, show listing titles, and include the
  current ToolSDK and awesome-ai-gateway submissions.
- Replaced status-only PR follow-up advice with a contributor-safe policy:
  answer technical feedback, but do not repeatedly ping waiting maintainers.
- Aligned source development and full verification on Node.js 22, matching the
  existing CI and container runtime.

### Documentation

- Refreshed the bilingual README around the gateway platform positioning:
  a new "Gateway Capabilities" table (virtual keys and budgets, exact +
  semantic response cache, reverse MCP governance with REST→MCP, chat
  observability, vector retrieval, provider governance, security drills)
  and a Star History section. Repository topics and description were
  updated to gateway discovery terms.
- Added the 2026-08 growth launch kit
  (`docs/growth-launch-kit-2026-08.md`): ready-to-post Show HN, Reddit
  (three subreddits, three angles), an X thread, Chinese community drafts,
  an MCP-directory/awesome-list submission checklist, and the v0.5.0
  release-notes draft.
- Simplified the bilingual README first screen around one visual proof, one
  prefilled no-install Prompt Lab path, and one published-container command.
- Refreshed the reproducible social preview around the MCP gateway, Codex,
  prompt enhancement, and the nine governed tools.
- Added copy-ready Windows PowerShell request-file commands to the bilingual
  README and community promotion paths.
- Added a dedicated MCP client report template with required client, version,
  environment, tool-count, and sanitized health/readiness evidence fields.
- Routed the bilingual Codex MCP quickstarts to the dedicated client report
  flow so client evidence is captured with the right context.
- Refreshed the public Codex for Open Source application copy and the v0.4.8
  Showcase and MCP compatibility contribution entry points.

### Verification

- Extended the credential-free public-clone verifier with model listing,
  regular and enhanced Chat Completions, OpenAI-compatible streaming, fake-
  provider evidence, and process cleanup.
- Added `pnpm eval:prompt-enhancement`, a credential-free contract evaluation
  covering representative profiles, language detection, signal compilation,
  original-input preservation, determinism, and zero provider calls.
- Reviewed the published `v0.4.8` MCP image for both Linux architectures and
  moved the Codex plugin from the historical `v0.4.0` image to the reviewed
  immutable `v0.4.8` index.
- Hardened container MCP smoke tests with the same no-network, dropped-
  capability, and no-new-privileges boundary used by the Codex plugin.
- Added official-SDK checks for source, locally built container, and anonymously
  pulled published-image paths, including structured 400 error verification.

## [0.4.8] - 2026-08-10

### Added

- Added detected request signals and compiled-section summaries to browser,
  CLI, and isolated-demo evidence packets so shared reports show what the
  local enhancer carried into the structured prompt.
- Published the evidence-first Prompt Lab workflow with detected signals,
  compiled sections, shareable state, and a structured feedback handoff.
- Added a verified Node MCP SDK test-host path to the client compatibility
  evidence.
- Made the browser Prompt Lab feedback link copy the current evidence packet
  before opening the usage-report form, with profile and language in the title.

### Changed

- Made the first-run CLI and browser paths produce inspectable, provider-free
  evidence that users can share without credentials.
- Refined the public onboarding and community promotion paths around one
  reproducible proof instead of unverifiable adoption claims.
- Updated the growth campaign command to emit evidence packets and track the
  Agent Skill Exchange submission in the external PR funnel.

### Documentation

- Added a Node MCP SDK test-host row to the bilingual compatibility matrix,
  separating protocol integration evidence from client-specific certification.
- Updated the bilingual README first-run commands to emit shareable evidence
  packets by default.
- Aligned repeated README and community quickstart snippets with the same
  evidence-producing command.

## [0.4.7] - 2026-08-10

### Added

- Compiled detected request signals for format, constraints, audience,
  environment, evidence, and success criteria into the structured prompt
  sections, so explicit user intent is carried forward instead of only being
  used to decide clarification questions.

### Documentation

- Refreshed contributor and security guidance for the current `0.4.x` release
  line and removed closed first-run issue links from public entry points.
- Routed the bilingual README Codex links to the deployed Docker quickstarts
  while keeping the repository source guide available for contributors.

## [0.4.6] - 2026-08-10

### Added

- Added caller-controlled `AbortSignal` support to Shared SDK JSON requests and
  `chatStream` calls without changing existing method signatures.
- Added deterministic cancellation coverage for JSON and streaming requests.

### Changed

- Preserved caller abort reasons through `GatewayClientError.cause` and named
  internal timeout causes `TimeoutError` so applications can distinguish them.
- Documented the cancellation contract and synchronized public release entry
  points with `0.4.6`.

## [0.4.5] - 2026-08-09

### Added

- Added `enhance --evidence` for a report-ready, provider-free prompt
  enhancement packet containing the original request, enhanced prompt, and
  verification metadata.

### Changed

- Documented the direct enhancement evidence path and synchronized public
  Docker, MCP, Codex, and documentation entry points with `0.4.5`.

## [0.4.4] - 2026-08-09

### Added

- Added human-readable CLI output for optional clarification questions and
  provider-free safety evidence after prompt enhancement.

### Changed

- Synchronized the public Docker, MCP, Codex, and documentation entry points
  with the `0.4.4` patch release.

## [0.4.3] - 2026-08-09

### Added

- Added explicit `--language auto|zh-CN|en` control to CLI prompt enhancement,
  enhanced chat, and the isolated demo workflow.
- Added a copy-ready Windows PowerShell JSON example that exposes the
  provider-free enhancement evidence fields.

### Changed

- Published the CLI, Docker image, MCP package metadata, and public examples
  under one consistent `0.4.3` release version.
- Synchronized public Codex and MCP onboarding paths with the current release.

## [0.4.2] - 2026-08-09

### Added

- Added a one-command terminal demo that enhances a natural-language request
  locally and runs the credential-free fake chat path.
- Added explicit `--enhance` and `--profile` support to the demo workflow,
  with JSON output suitable for reproducible onboarding and automation.

### Changed

- Published the CLI, Docker image, MCP package metadata, and public examples
  under one consistent `0.4.2` release version.
- Kept provider calls disabled in the public demo path and added verification
  that prompt enhancement does not silently invoke a real provider.

## [0.4.1] - 2026-08-08

### Added

- Added generic JSON `mcpServers` configuration and Windows PowerShell
  quickstarts for the credential-free gateway and MCP paths.
- Added a provider adapter contribution guide with current contracts,
  credential-free tests, catalog boundaries, and review checklist.
- Added supervised MCP service packaging, public growth snapshots, and a
  reproducible community verification workflow.

### Changed

- Kept the local fake provider as the default and made public verification
  prove prompt enhancement, MCP discovery, process cleanup, and no real
  provider calls.
- Updated public dependency overrides and package metadata for the v0.4.1
  multi-platform image and MCP Registry release.

### Security

- The public dependency scan is clean at release preparation time; real
  provider execution remains explicitly disabled by default.

## [0.4.0] - 2026-08-02

### Added

- A deterministic, provider-free natural-language prompt enhancement engine
  with Chinese and English task profiles, clarification guidance, and explicit
  completion criteria.
- `POST /prompts/enhance`, shared SDK contracts, `pnpm gateway enhance`,
  opt-in `chat --enhance`, and a ninth MCP enhancement tool.

### Changed

- Redirected internal audit, security, context-selection, and Codex handoff
  checks from the retired Workbench to the maintained terminal CLI.
- Promoted the published MCP distribution to nine tools and pinned public
  container, Registry, CLI, and project-site references to `0.4.0`.

### Removed

- Removed the dormant browser UI source tree, its unused build and route
  staging, and UI-only tests. The supported terminal, HTTP, SDK, and MCP
  runtime paths are unchanged, while `/ui` and `/console` remain verified 404s.

## [0.3.3] - 2026-08-02

### Added

- A dependency-free JavaScript chat example that checks gateway safety, pins
  the local fake provider, and verifies fake execution before printing output.
- A 60-second Codex MCP quickstart with copy-ready safety, chat, workflow, and
  workforce inspection tasks plus diagnostics and removal.
- A Codex plugin distribution with marketplace metadata, project-level MCP
  configuration, and a catalog-ready operating skill.
- A terminal-first project site with search metadata, a sitemap, an LLM-readable
  project summary, and direct setup paths for Codex, Cursor, and Cline.
- Cline installation guidance, cross-client configuration generation, and
  Glama discovery metadata.

### Changed

- Extended public-clone verification to execute the JavaScript example against
  the credential-free gateway path.
- Moved the public README and project site toward the verified gateway demo,
  explicit agent connection paths, and a clearer contribution call to action.
- Pointed package, plugin, and official MCP Registry website metadata at the
  public project site.
- Pinned public container examples and Registry metadata to `0.3.3`.

### Security

- Added a reproducible content review for the immutable `0.3.2` MCP image used
  by the hardened Codex skill setup path.
- Added the HOL plugin scanner and strengthened executable-file inventory,
  special-mode preservation, and scanner finding visibility.

## [0.3.2] - 2026-07-30

### Added

- A square project icon in the official MCP Registry metadata for richer client
  and directory presentation.
- Stable GitHub repository identity, MCP package subfolder, and project website
  metadata for downstream discovery services.

### Changed

- Moved the one-command Codex MCP path ahead of the general gateway demo in the
  public README.
- Pinned public container examples to the reproducible `0.3.2` release.

## [0.3.1] - 2026-07-30

### Added

- A dedicated multi-architecture MCP OCI image whose default command starts
  the stdio server without a command override.
- Official MCP Registry metadata in `server.json`, including the verified
  GitHub namespace, OCI package, and stdio transport.
- Pinned, checksum-verified MCP Registry publishing through GitHub Actions
  OIDC on version tags.
- Protocol smoke coverage that talks to the default command of both local and
  anonymously pulled MCP container images.

### Changed

- Simplified the no-clone Codex command to use the dedicated MCP image.
- Extended public repository guards to keep project, Registry, image, and
  protocol versions aligned.

### Fixed

- Made the MCP image and project-level Codex configuration invoke the Node
  entrypoint directly so package-manager banners cannot corrupt stdio JSON-RPC.

## [0.3.0] - 2026-07-30

### Added

- A one-command, disposable terminal demo inside the public container image.
- OCI source, description, and license metadata for the published image.
- Repository and container guards that keep historical phase artifact roots
  out of the public product tree.
- Public-clone verification for the terminal-only default route surface.
- A Codex-ready stdio MCP server with eight governed inspection and
  fake-provider chat tools.
- Project-level Codex MCP configuration plus source and Docker startup paths.
- Official MCP v2 client coverage and a dependency-free container MCP smoke
  test with managed-process cleanup verification.

### Changed

- Made the no-clone container demo the primary README quickstart.
- Made the terminal and HTTP API the only default public product surfaces.
- Extended the container workflow to verify the bundled CLI before publishing,
  then anonymously pull the published SHA image and run both terminal and MCP
  demos again.
- Moved generated capability references under ignored `.data/` runtime state.

### Removed

- Retired the default `/ui` and `/console` browser routes after visual
  verification found the legacy Workbench unsuitable for the public preview.
- Removed 168 generated phase ledgers, dry-run results, routing evidence files,
  and provider-expansion artifacts from the public product tree.
- Removed historical read-only UI panels that only rendered those generated
  artifacts, along with the obsolete Workbench screenshot.

## [0.2.0] - 2026-07-30

### Added

- A formal `pnpm gateway` terminal CLI with `demo`, `serve`, `status`, `chat`,
  `doctor`, `help`, and `version` commands.
- Machine-readable `--json` output for automation and operator diagnostics.
- Focused CLI tests for argument validation, gateway readiness, fake-provider
  chat, offline diagnostics, and real-provider authorization.
- A task-oriented terminal CLI reference.

### Changed

- Made the terminal CLI the primary source workflow while keeping the browser
  Workbench as an optional operator surface.
- Extended Linux CI to run the CLI doctor and isolated terminal demo.

### Security

- `gateway chat` now fails closed when a real provider may be active. The
  request is not sent unless the operator adds `--allow-real-provider`
  explicitly for that command.

## [0.1.1] - 2026-07-30

### Added

- GitHub community templates, project roadmap, support guide, and launch kit.
- A real Workbench screenshot and repository social preview.
- A concise project vision and a complete Simplified Chinese README.
- A credential-free `pnpm demo` terminal path with isolated startup, verified
  fake-provider chat, and automatic process cleanup.
- A real terminal-demo image for the repository's primary product preview.

### Changed

- Refreshed the public Workbench identity around the Unified AI System brand.
- Replaced stale repository guidance with the maintained public checks.
- Improved repository metadata, topics, and community entry points.
- Reordered the main README around the real product, a 60-second container
  trial, verified capabilities, and honest boundaries.
- Made the terminal and API the primary README experience while keeping the
  browser Workbench available as an optional operator surface.

## [0.1.0] - 2026-07-30

### Added

- Local-first AI gateway with chat, streaming, routing, health, and diagnostics.
- Browser Workbench at `/ui`.
- Deterministic local fake provider for credential-free startup and verification.
- Explicit opt-in paths for user-configured real providers.
- Agent, workforce, knowledge, context, approval, and observability modules.
- Shared contracts, SDKs, configuration, and reusable workspace packages.
- Multi-architecture public container for `linux/amd64` and `linux/arm64`.
- Linux CI, repository hygiene checks, and clean-clone runtime verification.

### Notes

- This is an open-source public preview.
- It is not presented as production-certified, L5 autonomous, or established
  AGI. Those claims require independent evidence beyond local verification.

[Unreleased]: https://github.com/happy520ai/unified-ai-system/compare/v0.8.0...HEAD
[0.8.0]: https://github.com/happy520ai/unified-ai-system/compare/v0.7.0...v0.8.0
[0.7.0]: https://github.com/happy520ai/unified-ai-system/compare/v0.6.0...v0.7.0
[0.6.0]: https://github.com/happy520ai/unified-ai-system/compare/v0.5.0...v0.6.0
[0.5.0]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.9...v0.5.0
[0.4.9]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.8...v0.4.9
[0.4.8]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.7...v0.4.8
[0.4.7]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.6...v0.4.7
[0.4.6]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.5...v0.4.6
[0.4.5]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.4...v0.4.5
[0.4.4]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.3...v0.4.4
[0.4.3]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.2...v0.4.3
[0.4.2]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.1...v0.4.2
[0.4.1]: https://github.com/happy520ai/unified-ai-system/compare/v0.4.0...v0.4.1
[0.4.0]: https://github.com/happy520ai/unified-ai-system/compare/v0.3.3...v0.4.0
[0.3.3]: https://github.com/happy520ai/unified-ai-system/compare/v0.3.2...v0.3.3
[0.3.2]: https://github.com/happy520ai/unified-ai-system/compare/v0.3.1...v0.3.2
[0.3.1]: https://github.com/happy520ai/unified-ai-system/compare/v0.3.0...v0.3.1
[0.3.0]: https://github.com/happy520ai/unified-ai-system/compare/v0.2.0...v0.3.0
[0.2.0]: https://github.com/happy520ai/unified-ai-system/compare/v0.1.1...v0.2.0
[0.1.1]: https://github.com/happy520ai/unified-ai-system/compare/v0.1.0...v0.1.1
[0.1.0]: https://github.com/happy520ai/unified-ai-system/releases/tag/v0.1.0